Extracted

• • Target

    Stub_tor.exe

  • Size

    7.8MB

  • MD5

    c897b92d4619272fac887350bd38ec9b

  • SHA1

    82374b547a841c1a04a0d29c0b6a1b339e4b625d

  • SHA256

    bac43b74a0269d4f14098d8f8a51e07d14999cc393ab85a82e933ada1dffe82a

  • SHA512

    1dfeb407e3206bcea7a576d859ab6f994b56252b6c570ea08eef667bdc827b927884b899bec058b1da70a224f53cc11d580cc25c3835d0e2aabd965bd02ef47b

  • SSDEEP

    196608:oIRcbH4jSteTGvFxwhzav1yo31CPwDv3uFZjeg2EeJUO9WLQkDxtw3iFFrS6XOf:odHsfuFxwZ6v1CPwDv3uFteg2EeJUO9E

  Score

  10^/10

  bitrattrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2behavioral3