Extracted

• • Target

    4910d6a23280578ab838476ea8bfdc9a.exe

  • Size

    2.3MB

  • MD5

    4910d6a23280578ab838476ea8bfdc9a

  • SHA1

    7075d8998729640a7adb8f9ddfacba408bdf3109

  • SHA256

    6d9ae2b15c6995be94b84f2a1d86fc8945594215678711318c88a447263a201e

  • SHA512

    f1942ff2e88a1f627c28011cc1bfbb54dfd3de70d7566e459eb1c88221c6be139161bbef137e814be78351e25d4c477afc101c4a46dae36247dbdc50bb8b50fa

  • SSDEEP

    49152:gv2T1elN3tjmR35wgI46vntTd2sIDzh3emlFAlPTmow+VM:tBYN9SDwu6xIs4zhOmbAlPo+2

  Score

  10^/10

  bitratpersistencetrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2