Extracted

• • Target

    DC0024348946451098454893973456554.exe

  • Size

    1.3MB

  • MD5

    1598e326811ac9fe268fffdeb60bd794

  • SHA1

    b358cc284c1260e00fdc285e274e88d27640d283

  • SHA256

    fde2dc52ebdaed66a83bab13b5509981d7169984936e2a92f6a00a14ea442e9b

  • SHA512

    50cd0eb64b99ace768c81e77969f94e3318a522517ce9f205e6a2436f937d7058a3a7d11e0981f030890826a95483363fbeeb09ca54819d17763b344367df213

  • SSDEEP

    24576:ViSNEArpn8J96cFW8KWS8JJa0UGdDywCYNmb:Vic1dn696YZKWSEJa07rCYsb

  Score

  10^/10

  bitratpersistencetrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2