Extracted

• • Target

    59ae4f79e3ae6f4035777fbfa5e15688

  • Size

    2.2MB

  • MD5

    59ae4f79e3ae6f4035777fbfa5e15688

  • SHA1

    91314991baa2d97f9e4e22f3370f29cbde65733f

  • SHA256

    ca05d3ab36565eac8ea1e51defde0ed20d7dfed046e00de4808d0dc71bf51973

  • SHA512

    d05b8f69c89dbc5b92173c6a32dda989d9bd404b6562f0d92789ae7d854b44118c18b6172fc5482dd98a8e6678def8c053cb83452e1ded77f2cda026d2c263bb

  • SSDEEP

    49152:haPNbH/WLJpZ6xCNg1TdY4zEJ0yCHAC4fHu2+ADK/k6P1y:s48CNE2wli5DQd

  Score

  10^/10

  bitrattrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2