Extracted

• • Target

    Document.exe

  • Size

    986KB

  • MD5

    9bfee233b1eb08709245723a8a67bd58

  • SHA1

    d2e1024fe896e61f3256ea1980fbdb34b493e959

  • SHA256

    3ca3364bacc38346dd777c8f90de705fd01c008161c4d1fa149ccf1b6205bbfb

  • SHA512

    9c8818c7694616130318f9b854d09777c6168c7c5d19d83269de4cbb22f6e60da081337bc0bb7eda9c9e52c171bbda1cda3959fa2a7e5001674bdaabc2972afd

  Score

  10^/10

  bitratmodiloaderpersistencetrojan

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2