Extracted

Extracted

• • Target

    20_89_27.EXE

  • Size

    9.4MB

  • MD5

    0894f84db87ca8148cd35781341489a2

  • SHA1

    de5b88287a6454115d06de0d555e94820c3791c8

  • SHA256

    c06cab989e964346467e4190f382ebc1777ef20786ac7f190ae080b8422f2d88

  • SHA512

    00579a26b5640deae733df142f3e86a4b62c9a52828256d7ce165ad8ac7ffb2233a8e1f9a96268e3391e0ebcabb136e62633660881b8dbafc410b7531731566c

  • SSDEEP

    49152:aJJKPuu28T4Vlp50dmHwWrwIdECy8AmY+VG9hk:1uu2r950873yr

  Score

  10^/10

  bitratnjratmay4000trojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2