Extracted

• • Target

    Shell.exe

  • Size

    300.0MB

  • MD5

    ee792a047fb2febbdadee7d476c96fc8

  • SHA1

    ae71082d2321633e466489d37f29bfcec0913c8f

  • SHA256

    d7d98d8f0c584f85bf88ba9d1b309cd92bdc35f2786decf7ee8adae1d5904f61

  • SHA512

    6be6d06d64b949332f53f6411fd865a1c2832f57fdcce47e2afe1f8c78fa20fc248d3c950ee976a42969c590087fc64d7c2ebcc1d644eb40bc8948a7efcc6f28

  • SSDEEP

    49152:WCbXXLwkHUqmLMe6TOh3ElWQKBUDwIx2Sfr5jIiMjt2:WmrwkH2Me6KmWQKBddSH

  Score

  10^/10

  bitrattrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2