Extracted

• • Target

    Stub_tor.bin

  • Size

    7.8MB

  • MD5

    d0e6f160ce90dfd2f1cf2e7db50386e6

  • SHA1

    7d7ac432ac9791f3e2525dd8b7be931145dd0908

  • SHA256

    36b93ea2fe4b15383747d65a7b8b030b8e0416f3bb8ce8f9afb8af983846be87

  • SHA512

    741014be891a31c532948a8c836edc397eee79e47c583cfb7f01c7840bf644430560308e6b7041ee48332bbc7941028e6a5dd51054e9a7e4747c39ef73b70a31

  Score

  10^/10

  bitratpersistencetrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2