Extracted

Extracted

• • Target

    Portail commercial.exe

  • Size

    2.4MB

  • MD5

    146bfd0243ed2d774ac9c6668e52c479

  • SHA1

    d716bd0f15dcf5da625f649ddb720d1d007243c4

  • SHA256

    1b1b465907d70a5be723778e15933b70e5ba1154f0f5e4c023194065c8baeb7f

  • SHA512

    2b8877de3a1bb025933b920ad032ee738cabf61643a6ca294ae54039d288477569600237eec21091458a0f393fcf42c8dc9fc23f004e9d552b5dcded9b3a9a96

  • SSDEEP

    49152:i5MGYDz/oX2xZmsty1XXT+N3mbCJdSl6YevAt6S6wQnMZSxYN6+tDq:iiGYDz/l7y1Xa5mqs6Y2pFeZH6gDq

  Score

  10^/10

  bitratnanocoreevasionkeyloggerpersistencespywarestealertrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2