Extracted

• • Target

    CJYUAEBL.EXE

  • Size

    1010KB

  • MD5

    7cb5f631784c4e56f1bbbd2db5e08cf4

  • SHA1

    467bcd4c278b2fae07b3dfb68b29814f0c1ec606

  • SHA256

    ffa9f3d0e3d4d29b10cba30fe3394d538b8c415e9c29cf36a56990e9204ec7bf

  • SHA512

    07ec1ed2124d24c02438fec3cd9ca65897f320fcb324192f5717ff0759c3a6a24e04e88dff84fd4ba37e0370c24d092231c93147fe90e93ce981cda6335d33f2

  • SSDEEP

    24576:owfXt2qCbasU3cyK9pNhMhtrjxLF7ZQ/ronBb5:oEcO+9bh+1lLFaMnBb

  Score

  10^/10

  bitratmodiloaderpersistencetrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • ModiLoader Second Stage

  • Modifies Installed Components in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1