Extracted

• • Target

    030d4f8c3e7f3857fcf0e0b8c2d806af

  • Size

    180KB

  • MD5

    030d4f8c3e7f3857fcf0e0b8c2d806af

  • SHA1

    dfd42628a153dcbc84418213a4f23a94b6af9d01

  • SHA256

    c354325171ef02920cd542660a56651894b4d1c784398ba77da1f2ace08f254b

  • SHA512

    2e456c29b0494937ef49887ca6c0784fd1cf9f6204177b9ba66c7c432168cce544c484dff7b79b1967ba917fdf0516e0d45b015bb44f7dd3d50246cddd5562db

  Score

  10^/10

  bitratpersistencesuricatatrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

    suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

    suricata

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2