Extracted

Extracted

Extracted

• • Target

    03e4a5b246180743a15aabbe28f2acb5

  • Size

    1KB

  • MD5

    03e4a5b246180743a15aabbe28f2acb5

  • SHA1

    36caf7a27c4eb6c30557737ea50b8e47e32e07a9

  • SHA256

    03674af9c28f5702955756f95a9173954188deb1d4f14b0bc8f0457e9383d6db

  • SHA512

    3cd8706b9105cd1a71d95142eb62df9f39601a7752648ce47583d1b8715f89c0d839e161730ef1d77becb7b9f0edae6ff353394046fa7e9901f9e06bbf291996

  Score

  10^/10

  bitratnjrathackedpersistencetrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2