Extracted

• • Target

    b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c

  • Size

    4.4MB

  • MD5

    0c09d75a290024791e700607ecea59e3

  • SHA1

    e69abb2295667c1ad8abae715c5ed10b387b0bb8

  • SHA256

    b4d965c427f37d900c4cdc0257542d33ad436efcf30a69dd006aa3321a90bc7c

  • SHA512

    1bb58ffa224869a2ceb7a9af83de6e5aad99c899b67888e17329836a959058f92133373a015ffae945d9b2c0769a9b1b49a034d5f87bf3dc0fb189b739cdd7b0

  Score

  10^/10

  bitratevasiontrojan

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2