Extracted

• • Target

    0e5fadebbb63160d78fab09972b795f7.exe

  • Size

    2.1MB

  • MD5

    0e5fadebbb63160d78fab09972b795f7

  • SHA1

    64259d7e08928f9b2f5a8639ba970d8f36b904d6

  • SHA256

    fc729002ac4f2ca65757920fe60351d318b329d854cbf709addf0761d0c68664

  • SHA512

    949ab8bdb2e60941231faa2e744a78c8f7153536013296c459d025ce67ecd7bcf38c8f024fe4d7d79c0cc973781a4725ff07a2d1a32bb9286c0f41fcac6ebe96

  • SSDEEP

    49152:LTQrHkWhCQyTmeBm/o56gJetPDI+55De8dKbfstgi/:WCrTPm/osgJi8+fzkfs//

  Score

  10^/10

  bitrattrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2