Extracted

• • Target

    cd39b649045c4556c08be586b301d1dc8536e63d14888a4e6a55636776a8e235

  • Size

    300.0MB

  • MD5

    9edb373bba31ed74e5635c8ba1ccbc24

  • SHA1

    7826110d94ad641b3cbed3eaa1c4e1ab5e329e26

  • SHA256

    cd39b649045c4556c08be586b301d1dc8536e63d14888a4e6a55636776a8e235

  • SHA512

    90c56b8545767b8b3b3292ebc71d4683b6ff0c2e0fc1135159357707bfb462878c8044eced0f6138e7771d3db3c6e8a1b363d7663fd3e5e50f46254f22ee54e4

  • SSDEEP

    24576:KQWUrKeG3ggoqRwkqbQsH50RPoE+G3ttsP2V4MM9obzQLAmLGAs4DyAunLw+6aI9:K2KtBCR3qP+JeO+/m6yDL9aITLUp

  Score

  10^/10

  bitrattrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2