Extracted

• • Target

    ORDER SMAPLES.exe

  • Size

    2.1MB

  • MD5

    507da88c0faa082c6a5974a173feafef

  • SHA1

    62bb282d4214dfde18242f77f19f818127552e1d

  • SHA256

    1b9c9b834da58ea5a48a29ecb1fa94be9745a48484417ff2caf6ed70f1a50cbd

  • SHA512

    793c3370f347cd3dbc47d198bcb8069667cc1e37e09fd9f669ff05ac950b7d741993c981da8ef1982c4ed325b7e952c17b437cd9b266c3faffe541fe72158a19

  Score

  10^/10

  bitratpersistencetrojan

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2