Extracted

• • Target

    JaffaCakes118_9fbb77e163710c588a557e3dfd67ff10

  • Size

    3.0MB

  • MD5

    9fbb77e163710c588a557e3dfd67ff10

  • SHA1

    99c877c6543121623ba72d61e040258fe6168389

  • SHA256

    f4b85a735a9facd0637d522ff0bb3900fbf973fc8ca07c88463cd78760cbff14

  • SHA512

    c5578a905907a827cbd9f4dba35913a1f6a920f3033cbc2d4446d0028ca43dd99b8431833ec79cb08495b1bc18198cf864a087a94293bbc40bbc48f4f60fb679

  • SSDEEP

    49152:YJXZRkXRxWCBu72E76E5jXVL5w9lmVOALga7n0Y8:K8

  Score

  10^/10

  bitratdefense_evasiondiscoveryprivilege_escalationtrojanevasionexecution

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Bitrat family

    bitrat

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Stops running service(s)

    evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2