Extracted

• • Target

    c609d25041b7c463a726027c99c0a264b1e77415612e445fc39cfc9aae9801f3.exe

  • Size

    3.8MB

  • MD5

    6d4c3a4ff3637ec34f820172f897d476

  • SHA1

    d53fe8f0ecb0536088ec9be5247ab6627baf31cb

  • SHA256

    c609d25041b7c463a726027c99c0a264b1e77415612e445fc39cfc9aae9801f3

  • SHA512

    1ff5f4b215bedf6824c9c1932b5e8dbcbb8e459ee2839c598cc0f955b2948e25c5ce834b963ee1cf6ea22954e9c1fa4b102f117808f6dc8a4891b36c37d7e894

  • SSDEEP

    98304:HjHNSk7Z95fznvi8pzJzTGVDr0io7x9JgDQssR:DtSk7hvi8pzkVnYwQ

  Score

  10^/10

  bitrattrojan

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Executes dropped EXE

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2