Extracted

• • Target

    JaffaCakes118_0b438c8c77430e40e17cc3ba86789e28

  • Size

    1.8MB

  • MD5

    0b438c8c77430e40e17cc3ba86789e28

  • SHA1

    fa326cf2ca9b083ff17c1c5882fca858823fc6e6

  • SHA256

    883044d41ba81300076a23457633f8cfab4e4207200b70e6ec54111b77c63e01

  • SHA512

    c9ace0ee653d56e5c14f3928c680c90c6c09fa957d4521c8217555dce9b33dcd79993379cd9b71dd1e2df077c688d7f7e9df42a321485fbbbadd3d254b7cb75b

  • SSDEEP

    49152:eTUit2C759KwH8t4m6tPXuXt14qNZbzvgI5ogEyXl:eTUiD75ns4m6qt14qjkIJ3X

  Score

  10^/10

  bitratdiscoverypersistencetrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Bitrat family

    bitrat

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2