Extracted

• • Target

    9aad75171c9f40314bb14ef323bb8fdb

  • Size

    6.1MB

  • MD5

    9aad75171c9f40314bb14ef323bb8fdb

  • SHA1

    82ec3149cab1039b2b356b8ac2d972114fc142d6

  • SHA256

    c4490d8166adf18292c8bb887a344662653881d605c71472c85e69dcc6f24f37

  • SHA512

    8de2ebe81c364ce29348e7a4b14665fc35d3a00eb5dcaaf831bca4674548b0e4e30a0be0f911386d582ece6a7a76fd3b0174a6065e50c9f982daf160f49b6719

  • SSDEEP

    98304:Gpg+erC8auYWOB+ljN6t4DiJoQJeLXFRahqvf29NvZHuXCMd/56qHstvaPXCaz2I:Wg1rOWOgotmiJoQJ4b3jXpdtHwvaj

  Score

  10^/10

  bitratpersistencetrojan

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2