Extracted

• • Target

    jbitrt.exe

  • Size

    350.0MB

  • MD5

    ebc87e9cf7540ad79716397271c11e7e

  • SHA1

    e4901173b21c903171ef7d83a92c3609ec434fd6

  • SHA256

    3ac3647f6d46ddd5220e483a90d09442b440a01bd66ec95c117ad3d3e018def8

  • SHA512

    5dcb19389e90bf69047e94b616f843983e3852df0a59eabbdb2d682265dd4ad16b36f60b8b15d8d611824ce25faef4ef8029bc402ec6b87dc4d911db30d800cc

  • SSDEEP

    24576:vH9nvaEW1gTI9khgN36kdSG4nGQ5mYeA+igGNTH1YaA0TvD3H1Aza8LN1LV:f9xW1gTI9G0lS7t5mY2ig+yaDvD3CZ

  Score

  10^/10

  bitrattrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2