Extracted

• • Target

    40f3e277da7a04b58913ba390827cfd51b318f40768c58f81361b832096ce1ef.exe

  • Size

    7.8MB

  • MD5

    b8d03a02e654dfc840f21297b8dc99b2

  • SHA1

    615aced62a15e9a1733bfb2c390ba83f024bbbd7

  • SHA256

    40f3e277da7a04b58913ba390827cfd51b318f40768c58f81361b832096ce1ef

  • SHA512

    5f9b459df94dac7dc17f90a8dc53d968c3c0e2fc5c41b107ece1683621ef887d8f01abeec04ec0d9beb87fd11c54f39d71c7ec5c2502ec1db68ffacd018c4194

  • SSDEEP

    196608:KUYuomDLdUgXNjeOoUoB/mZMnsDJKB4o+uBxKd8c:TzoQLd0O6B7c0BTLjbc

  Score

  10^/10

  bitrattrojan

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Executes dropped EXE

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2