Extracted

• • Target

    8dd93fd81577033b184647b566e160699006396bcc6cbfff405acc4597c0d688

  • Size

    76KB

  • MD5

    d43ca72d6fd0c9a2e3f3774b74fd5028

  • SHA1

    d28a3f9edb5651de9c7a418e63f8417105c83c63

  • SHA256

    8dd93fd81577033b184647b566e160699006396bcc6cbfff405acc4597c0d688

  • SHA512

    b4e5a5df2885d59ff7f4c8325ee7b00be592a62c2ee006244e9d5a8cc67adcb6b15f557146030b9079960b538dddda8626443b9c2ebbe9f31b6e40ab87cfc639

  • SSDEEP

    1536:EwHgiRJFKfgYBUngABZvxZ/DOG8s8MkeNSzXzKD:EwASJFKRapBZP/Dl8DMDSzX+D

  Score

  10^/10

  bitratpersistencetrojan

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1