Extracted

• • Target

    Rad. 23001410500120210054200.exe

  • Size

    3.4MB

  • MD5

    d0fe1061080757596c0ccf4858116d4e

  • SHA1

    73f413d110487f600adbc5ec976ffdbbae99528c

  • SHA256

    d00aca8df4e7efc0650d5deedc63b8638570ff9ffc9899e6b35ef67bfa434d58

  • SHA512

    0f5a6fa2cb295765ffcee1615966a5357c1ff859c105c43cd0d4725e6265abf7f6e91dd80d9ca0b234b603d095d5eff8eda2bcebbe18823ac327e1ebe2d91ef6

  • SSDEEP

    98304:HBe/eBAdHiL+BL1RctSmUfzGfLfvfoHMDfGzgav1Y6eNLcTopndyPL7:MeadHiL+BLWSmUfzGfLfvfoLzF6VckJO

  Score

  10^/10

  bitratpersistencetrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2