Extracted

• • Target

    boolhongupdater0.1.exe

  • Size

    6.2MB

  • MD5

    48b417f79606cc9033410227d375b006

  • SHA1

    fce9ce20523634aa4d9fe093dc6a21d5eefb2218

  • SHA256

    17d989ad32bf3b1056b79321c2e35d2fc812e26e05e5ab661bf8eaa256aa6cd8

  • SHA512

    8aede261d387d3434f6fbf9309e236bc8ca5ab2e8a722a60c4c3cc820ce50c88a4e7d86e8ccb1dde469715a1ae800e8dfe57d5a47c1c2e7d445ba9a913393589

  • SSDEEP

    24576:JCXRJTV2FJkhL5rR5e7Yjuif3f+hZtbow3yDLLrzCh0Jr0PoOvMmwHTeReqIMmOW:cloPHps

  Score

  10^/10

  bitratpersistencetrojan

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2