Extracted

• • Target

    bc0374c212e401d5f220df5657a980fc40fc210af0a7c34dd8d43556d8b2a4be.exe

  • Size

    2.1MB

  • MD5

    bf35c2910d407f1cf330f465a793dc1b

  • SHA1

    306324e8b2cc82f09c7b0f56cde008337b8f5205

  • SHA256

    bc0374c212e401d5f220df5657a980fc40fc210af0a7c34dd8d43556d8b2a4be

  • SHA512

    6fb5fa5ab36acbcf9726426b31ec843b3f8d277047e8d1d51136a91628dd3e0d2c99e6809578ab83f0cc5bb67706462b5653ce00943c7b168d010ce7faab9094

  • SSDEEP

    49152:UrpxN1w5b1QvE4mnVA93py1abMy+mUIuEMyN5KvG8aM6TyHIzkY:Ijw5K4A93paabwtIuEMyN2G8fRY

  Score

  10^/10

  bitratpersistencetrojan

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Modifies WinLogon for persistence

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2