Extracted

• • Target

    JaffaCakes118_5cf536e4caf1db284a5a88c9d56e96a5

  • Size

    2.0MB

  • MD5

    5cf536e4caf1db284a5a88c9d56e96a5

  • SHA1

    ba28dc70b13432ad716fa8e09f9f3f02265d2d81

  • SHA256

    e07340dceefc36ddf24f971a2de0c1729cdd2832476e23c6b15f2c9aeb5e21d5

  • SHA512

    c54badada92ace5580d231e0c8ffff8ead3635602acb6fce191db66387078661d1149fe9f328552253e1e1dd7944c2302321b35b8c0ef79fb21c0dc8f0080cd5

  • SSDEEP

    49152:NBnMZxjn+QxQZSWA91+cmDUO/evRDCcj:3MZZn+QxQZSWk1+cm//evRT

  Score

  10^/10

  bitratdiscoverypersistencetrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Bitrat family

    bitrat

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2