Extracted

• • Target

    attachment_2137.exe

  • Size

    6.0MB

  • MD5

    37580d09f99717268666e091c21d344a

  • SHA1

    0b7df2ebdf61753c183c818db71b4b1f6fd57841

  • SHA256

    12d9848e317dcbf7dfb95649d7198fd93475f8b4cd093a252f28caeed8093001

  • SHA512

    f2a1295003d64be1c768afbc6bd0f93ba53a39a883759952246371d9552777432193c35a702697061febb192cb365843480cc52c3dc44d90312a4e8be7e66749

  • SSDEEP

    98304:JyQZRhelFuTw99bP/nCURx/PKnBWrmVjefsn+1:sQ7w99GURx/PKwQe

  Score

  10^/10

  bitratagilenetpersistencetrojan

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2