Extracted

• • Target
    adbb1af7661813a76c85b6ce8d5dc97b.exe
  • Size 20KB
  • SHA256 4e6dd147fe163628e5d79043ab25d1bdca930dfd5cbc5ca77bb345702590f199
  • MD5 adbb1af7661813a76c85b6ce8d5dc97b
  • SHA1 570400413e24746fe4942bb5d32f4ad1b3a9888c
  • SHA512 7663df4fd5bd7469b5aee806c6257f36506140456a077ba4523ae379ec987a83fa2e973c6271e5e2970c7f48a5d817e46a9cc215f45d8527c1f5b8c930ad8136
  • MD5 SHA1 SHA512

  Score

  10^/10

  bitratsuricatatrojan

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

    suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

    suricata

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2