Extracted

• • Target
    b86467c3fd901aa94ae021ee2208a477.exe
  • Size 2.1MB
  • SHA256 879b3899bd1dc321c620a9abcd9fa2ce3222047bc49b57cd00a8dabfc9e2b0ac
  • MD5 b86467c3fd901aa94ae021ee2208a477
  • SHA1 a41fb8edd0f5a84e39c6fd2fca9b036b42b4968d
  • SHA512 11bec05b9e6ad0e86f43b76631663b5f63e3a45935e530b837a58d7c210801707978c89312d605caaf5c08398885fc055a429ac4e00827b0a496c4895d042acb
  • MD5 SHA1 SHA512

  Score

  10^/10

  bitratxenarmorcollectionpasswordrecoveryspywarestealertrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • XenArmor Suite

    XenArmor is as suite of password recovery tools for various application.

    recoverypasswordxenarmor

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2