Extracted

• • Target

    3164_23_147_PDF.exe

  • Size

    300.0MB

  • MD5

    19ee0757397eff0b8cafa381c9c3737b

  • SHA1

    801fbacb698b52aca0448fcbd6ab44d921ff6c3d

  • SHA256

    50c0fd86906d4b61410326cde1aaf9c114684287b0b165e785873b599f6dd9c3

  • SHA512

    ef09f79119e3f55d4e85b83a2586d41b2e4156ed2a7d28784aa880218d8c1dc623268b4232b22e254bcd91aa9d202e7a044d4d25ec289ab08b3228197beed312

  • SSDEEP

    98304:FwcVlQ8/lL2LLeZWL0kDdtJRLum/quFUD1nUzsg:ycX1VCLeen1UpU

  Score

  10^/10

  bitrattrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2