Extracted

• • Target

    e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b

  • Size

    3.5MB

  • MD5

    2a91c21bfc56a4fd93f7efa57724a759

  • SHA1

    3c488f16cebbe8454fb490a9305eed8b7ae9eeba

  • SHA256

    e76a3b05cbd6022aafe1c4d505220b08c0de4992bbb4faf88fa226a1d50c427b

  • SHA512

    2f4b8f7c5b7192da4706a8986943d047af18534320502f74aff3d9ff8c34c3632c238be16c25e6e2ecd4b67cc38954b0b5948e0351a21c4948224e99a1b0fbea

  • SSDEEP

    98304:p4GcmSFQwfd3TyjJPLOzvSjmDXGT48tcf5MP:p4GP+Qy5TyizveAXGU8tcf5A

  Score

  10^/10

  bitrattrojan

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2