Extracted

• • Target

    00094ef2636275cdd3e022941bd57230

  • Size

    804KB

  • MD5

    00094ef2636275cdd3e022941bd57230

  • SHA1

    4934301ca4b4b7e49702ca3214b6afad00ba0b10

  • SHA256

    5fe8ce1e015ec5141541e626be8530a3b6e59cb347e7ffe62639be9fecd9b0e3

  • SHA512

    186353dafcac06d13d9609dc5dfb8f94ec4340ae6b485a12540bc813c722df5369517a3d1f223bbf72864209b0ef3509fd7c1d4ad3f3647ee47d383e6aa4a672

  • SSDEEP

    12288:MGktoHAF1IE4LIeCTZjTgo4WYBJBqryw747zHK5rs:MGvgnINIvHnIyOt7zHK5w

  Score

  10^/10

  bitratmodiloaderpersistencetrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • ModiLoader Second Stage

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2