Extracted

• • Target

    d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245

  • Size

    2.8MB

  • MD5

    ed1ececd2601553016326499250995a5

  • SHA1

    790ee4b36607be69497dc140128fef7e168041db

  • SHA256

    d2dce3308ff55e3ffcdccca4746b23861a21a54d74cad72b2c07c6352f3c1245

  • SHA512

    1e3d86795f1fbcdc5dc730ab83764a7af294a97421901c53966e8b4224e3654c36fe59d7260108702edcef60b4801c0479a1e09d3272a8688ad3798fee21f514

  • SSDEEP

    49152:WM60nwd3bfu7Kd/Qdt1kynoAYfjCAy5+245hDQESYp6O13c1teWvs1WxN:WWw47Ckt1kyoAweAy5+2uh7Jl3kq

  Score

  10^/10

  bitratpersistencetrojan

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2