Extracted

• • Target

    tmpo8d7q563

  • Size

    4.1MB

  • MD5

    36b0f6af785f213b030b38fd264b28a6

  • SHA1

    e4dd03d092baad2c44a93127843b9412dc4e9242

  • SHA256

    aee6a3503964755eca404182c5a3f6065f09176f52e889bfbcb0fa81d9d61e2a

  • SHA512

    c246b70eaaf63eabbf6398a16172ef523dfc31a44e1afe1e48f337855b2488c68e1a30180a59e685484560f51b8d7b015cec947553d17f5d42126d53cbbf0963

  • SSDEEP

    24576:tCNUL960NT6JtkKM5Xqix7Z4hwinQh6LhZGGNtSzGmzS+op1jHZP4qukK0PeXAyp:rX

  Score

  10^/10

  bitratpersistencetrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2