Extracted

• • Target

    bdd1438c98225e3ea172ec284a6708f9.bin

  • Size

    1.5MB

  • MD5

    bdd1438c98225e3ea172ec284a6708f9

  • SHA1

    0d1e23278ef4346d2a051f35d4cecf30199e6eae

  • SHA256

    6920c222d9646d2f191e93a2a0f5ea080615ddc88f0b65d18342eb335dfa480c

  • SHA512

    7847f435bf73205fc0f2354c4d80c16d414f2f9076a5a725cbac2bd53d72b7b0f52c5e321d03915a1e9209e99006398d6208ef66c5e77190a256b9067ad2f3a4

  • SSDEEP

    49152:VU7EGUTipLZ+DYQ1dKrHIdbbwPk+1ddjjt2:C7EZG/+DYwdKrap+1d

  Score

  10^/10

  bitrattrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Uses the VBS compiler for execution

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2