Extracted

• • Target

    b68542cfc28fcfae0313042956a7bf72.exe

  • Size

    3.1MB

  • MD5

    b68542cfc28fcfae0313042956a7bf72

  • SHA1

    245eddeb197886aaa3d2eefb12ad4b074462b299

  • SHA256

    b152d8eb3429cc766add38acd8cfe35f6a67f071e9c534b679d1b8ab5f9771d3

  • SHA512

    855d457c2c0df22890bb2c0616a4edc5cd832d181be39b3e9e1495a3ec94640c367312a1fbb7450cd01f56bb1b149e1209fb5d8685f98070aee0cccc7fa47bf7

  Score

  10^/10

  bitratxenarmorpasswordpersistencerecoverysuricatatrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • XenArmor Suite

    XenArmor is as suite of password recovery tools for various application.

    recoverypasswordxenarmor

  • suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

    suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

    suricata

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2