Extracted

• • Target

    YS02FNSACOPJKDSQS_Invoice_PDF.exe

  • Size

    300.0MB

  • MD5

    1420cfc2bea47d52a937fbea0415baa8

  • SHA1

    8d4ea7755d633dc9cd2f721d951fc17bdf5346d6

  • SHA256

    099afcdcf586e43f851a0a63d12328f5a44884a711c61c8679a693bd239d51b1

  • SHA512

    3546d9569ea5f6d891c42e5e805041fc288fcd78943dee2eef251cd52de1910213cfbe2d71e7386fa3d40d5a27ac3de39293e4e05487113b7cbd32c2dd3bb0c7

  • SSDEEP

    24576:C5gfuhMt53oiTyVl7gyCPUmj15wlutqzKn4QpeuCdEz9aJ3bxKui0HpzYU0:C5+IUbGcq0hz9o3bkj2U

  Score

  10^/10

  bitrattrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Uses the VBS compiler for execution

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2