Extracted

• • Target

    36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019

  • Size

    4.6MB

  • MD5

    c0f1f20287896ff8a866a98497ed8123

  • SHA1

    c566997f3fd2a9a2c6a5b5d96d3c1f7e81d65f36

  • SHA256

    36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019

  • SHA512

    d1d867fdc84502f98901e006e803337abfee7c58b172913813132fdf9d8d125bb1ae304f35789ee3c836240344a81e3bbb132a024c9b03bb6a77550678228c76

  • SSDEEP

    98304:Yi1FnwzTuf1TUBnuYlj+C6oes5+Pc+3PT1+Ai5ruELIUV0pIgKiNUn7MZT7pb:THnC8NUplvfesAE+3PBvQuEsU392xP

  Score

  10^/10

  bitratevasiontrojan

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2