Extracted

• • Target

    50bd4097d131a0cb93d9e6d7fa5ee6e5f32009841c34dd92928e2b0677ebb1be

  • Size

    37KB

  • MD5

    a57059121da1c80b6a2f29007c279aad

  • SHA1

    441764fbb00f2817776432ea6b4a35ea5b2c0d85

  • SHA256

    50bd4097d131a0cb93d9e6d7fa5ee6e5f32009841c34dd92928e2b0677ebb1be

  • SHA512

    2fdbbf71bfb75815b8c1cffe0380b0a1c89bacfa9e752eac4bc8b9650a3cc18916c04855e54e2d8ff5e2be8bfed18fe720eb0cf2ce515ea88428043f9f39bc2c

  • SSDEEP

    384:Fs2gHU9E6nPdcKN9AVH84ijuMCQQ/T746gfqRVb+d0E7hOh257xAookwMawAlK43:HwDTAyVboD37FSKYmediLe7

  Score

  10^/10

  bitrattrojan

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Beds Protector Packer

    Detects Beds Protector packer used to load .NET malware.

  • Drops startup file

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2