Extracted

• • Target

    a51282512c747e4696968ba0d7cac12da4c0ee23ed9bd8f9162b44cd6feae6b5

  • Size

    1.9MB

  • MD5

    496a7890c6f1d31f10acb4f36805e6ca

  • SHA1

    86da741420c2e972969133caf44e71d3bcbd58b5

  • SHA256

    a51282512c747e4696968ba0d7cac12da4c0ee23ed9bd8f9162b44cd6feae6b5

  • SHA512

    6c0dffb8361ae471cc8c2b0052f8589d70f0eee6e021aeb3970c97880723ee645bc8be40364889d61de19c15f2ba0300d5bb547d98233f8f45ef59dc092ec317

  • SSDEEP

    49152:GT/3WwVnX/4lq1zxD6foJFxxjM6GHRyc12E4ltc+aa8V:G6wVnX1y+xxjen1KTRs

  Score

  10^/10

  bitrattrojan

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2