Extracted

• • Target

    55ee7efcb3d1d2e0eac0ecadd651d6a299de82d94347ef9862bc981ae619532b_payload.bin

  • Size

    2.0MB

  • MD5

    63cf067ef62b81cdfbe145c30ae6bd58

  • SHA1

    5ab59a6bedc7b58d24b6fc433c7c12e868c34d27

  • SHA256

    eb3d3f3467ad0d3c84df547a2afb307c0673dd990fa84f543cd26e489614c2ce

  • SHA512

    a8423060461f12fcc14307d26e7abcb41d260c8e0fe31deee38ee21ee102a8d7451a255d8100d0ead2f4df6eb85851937f9b4d02a3ddecb6f028058934e605e2

  • SSDEEP

    24576:KndRKZCy2BrhCeU2i2cJijFbCBTPmiY05tJMSQp5ysA7Yg1nLkzLCthXu2M:sXDFBU2iIBb0xY/6sUYYECtttM

  Score

  10^/10

  bitrattrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2