Extracted

• • Target

    2e32af0a253629770be3523b0606c97c

  • Size

    2.6MB

  • MD5

    2e32af0a253629770be3523b0606c97c

  • SHA1

    ac60258698f4cd926b3afd69b5275972eae7aeb9

  • SHA256

    96a30539fee5c0fbd077700e0c8605e12ac497020d9d9d8e4f2886f5abf7c31b

  • SHA512

    995c8bbccc4fe1736ebb59efcb5b50feeca5e6454cad912ccd3a76103a5081c1d3d3e72daf47bdbbfae31ca71854983483c1ee324aaec3d794bc7c7ee9971177

  • SSDEEP

    49152:GuuEoyPJJFc4sIe7yAsxjTNwquM4e04xvbjATC2z+v6:GcPnFc4szuRHYN4J2zN

  Score

  10^/10

  bitratpersistencetrojan

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2