Extracted

• • Target

    1.bin

  • Size

    5.1MB

  • MD5

    a402e8435cf1116d50b90f7ca24b71da

  • SHA1

    86132574ee8a7b8a9eea1e4ac60e5b0ad38b54ca

  • SHA256

    7cb1e86ca61521a5ecee7261a45111bf04ec14ded7d8757cdeb4a5a77494ae0a

  • SHA512

    4560151acb987297b068b8cc9d9719c75ec28f4c72541fadb9e05f5823bf44e9cfc5055271466676eeebd72fc61ee9c65da935eeb42d00cac054dd3c7620340d

  • SSDEEP

    24576:A+pONDPnta6Y9UfUMSR9iUFqNLcrLfQkF2uU5J9VF/08ixUoNQhGnD58fKj7m+Me:E1Fm3x6UYxhmUhcRDJAA3bR9543zoa4

  Score

  10^/10

  bitratpersistencetrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2