Extracted

Extracted

• • Target

    HEUR-Trojan.Win32.Generic-66fdb47c24f569d7fae.exe

  • Size

    16.5MB

  • MD5

    b9874cdde692f485a1c609aeafd075c3

  • SHA1

    8806ac9b20eaa78f89b5dfd1b78a3c7fb5cbffce

  • SHA256

    66fdb47c24f569d7fae5707024809698812a40458216414827d3ea57cfb19dbb

  • SHA512

    955e5e731e2d3fe9299fb90995fba95409d5b6086306960defbdc17f855175c63ccdb713f16b3e6ac3ee007f2317461d2e8693afefc56e7de494d879a3fd0aee

  • SSDEEP

    98304:AQC5lSLCSHP8Z2HOR0mW1LCjqOMKmxE6G:LC5R0mh

  Score

  10^/10

  bitrathiveratquasaretratspywarestealertrojan

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • HiveRAT

    HiveRAT is an improved version of FirebirdRAT with various capabilities.

    ratstealerhiverat

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • HiveRAT payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2