Extracted

• • Target

    d76d0c80f55b69dc7c4622a3166d4b7a170c28e939bc052e11fcbdb056ef1239

  • Size

    1.9MB

  • MD5

    ddc3e1356b7807146d75a4eee20f96dd

  • SHA1

    7499a3593d4308a2208c01e766fddbf93954c61e

  • SHA256

    d76d0c80f55b69dc7c4622a3166d4b7a170c28e939bc052e11fcbdb056ef1239

  • SHA512

    250e6b7816d000a40bb272a274490325a59a87dce55b9705b65ef4e9f7c81344b93a4c2bf5125f23928f81c36231645197efcaa266c79dc07e2cf44fbf996663

  • SSDEEP

    49152:GzSJh0i1ZvjqB0LNlFRx9BWcWIqEBddvw:GgjvjqQR5WcWIqab

  Score

  10^/10

  bitratpersistencetrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1