Extracted

• • Target

    ETRANSFER_RECEIPT.exe

  • Size

    300.0MB

  • MD5

    8dac8b61bf8c23264873a3f3bee260f5

  • SHA1

    ba581c38574794324ea714a48671fad7f2384dbe

  • SHA256

    7e4a1f93d53d3962a913e000524344bdcccd6d36d0856b3df38df57d4a8e1df3

  • SHA512

    65ef0b281583e1f8303ff470dc134d8d35ccc394521fd93294cd251220af501137b17d39af91829efe0191e395c2494e1652565895647bf04a46b56fe0eae163

  • SSDEEP

    49152:Ifj16wI8BxPHNbgOHMoE7A7EXGKjf9aFEV:Ifx1BBt0OsEWk

  Score

  10^/10

  bitrattrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2