Extracted

• • Target

    897c493548dd9537dc52dccbcd65373b86ffcef1285befaa88a252b8475a32a1.exe

  • Size

    12KB

  • MD5

    a2bf963447678bc8e50ae4be3200a2d4

  • SHA1

    f5ab9610c07d20b09b04ae45423ab7e3c1953241

  • SHA256

    897c493548dd9537dc52dccbcd65373b86ffcef1285befaa88a252b8475a32a1

  • SHA512

    6cccec003d0fb435b4698a83a7c0631afee395ce6b9e7730ac23d9878d2e409a89de39f0de770c7cf046960d4bd5997007391ed98090683de9ccf852618a23a6

  • SSDEEP

    192:rWvUwdeu5ILftAEl5IObSW0VlO1TTgJMRqIcuuuH:roNILfuSIyqlqTEKR

  Score

  10^/10

  bitratpersistencetrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2