Extracted

• • Target
    TyaOsvKpvOsSG1h.exe
  • Size 2.0MB
  • SHA256 cda31da68a99454a628cfe74166a851d1de0af7088ab531bf03ebf684d46e0c8
  • MD5 addac59ea354e46c42f799b41f813dac
  • SHA1 3ff31f1f3005b7b88154a02d7aa0747a487b5ac2
  • SHA512 217052e7e99228645fec4aa75b8964235c944740c954ff3733b2359593df466350287bb63a39a754be4cb360cdf357493d7f347d7da9151d08ce2688472a1671
  • MD5 SHA1 SHA512

  Score

  10^/10

  evasionbitrattrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2