Extracted

• • Target

    b8e41e942aa1da72e79abe17a2b53bd711302372c53d598b5acf7bb507c5db2c

  • Size

    3.9MB

  • MD5

    3930ae2afd78cebd07ee522014f942bc

  • SHA1

    c074738840116989c397e776f6765a7d2b05090c

  • SHA256

    b8e41e942aa1da72e79abe17a2b53bd711302372c53d598b5acf7bb507c5db2c

  • SHA512

    df24b7edfd9d402f906f30eba48a3b8f4adfc3441ac4132faaca5cace1103e4e3ebc59d0f3eac9fb4908d94773e9b982dcee733079be2ec8865b40fe3b5ac2c3

  • SSDEEP

    98304:glSQqo5yaawMonJBQ0vaQpcj9qAauBaj/S3+39Uox68a7x:aqKysMoJC+Hajacaj/SIx6l7x

  Score

  10^/10

  bitratpersistencetrojan

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2