Extracted

• • Target

    JaffaCakes118_060d302b02129c37141233ce0d45b544

  • Size

    1.7MB

  • MD5

    060d302b02129c37141233ce0d45b544

  • SHA1

    ee11e1f3338123d75f781f3bfffb8f7496c690be

  • SHA256

    a21f3537b93ad2f5403432e03ed4a17f0c8fa57e92d69d4f40b2c4b76550ffaa

  • SHA512

    e8301ff371e1a55b08edce7a57c5d53ddb90d6d52a12b8c151ca7d8c6d5488f9e05c8e83f39775d45c7b96910b65acaa00ed88fd03ef930de53f2307784ef949

  • SSDEEP

    24576:aGAASJ+e1ne+6Iyc0mauZEpTZIc1h9A+1TcVDka13/n/nMFaWaiEpwqnyGpXS28Y:xAALe8+68auZuZ6SMJPIaoE2qne28Xo

  Score

  10^/10

  bitratdiscoverytrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Bitrat family

    bitrat

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2