Extracted

• • Target

    5d36a8d835a2207213efed20ee9294da

  • Size

    2.8MB

  • MD5

    5d36a8d835a2207213efed20ee9294da

  • SHA1

    8a02634c5040755f24cb7bbaf8f4b1577b49761c

  • SHA256

    44648da1ebbf8ed242e9f93b9b8cbe9e035246f245b6b3b22534931725c42499

  • SHA512

    858c52d462fda710b2652dcef4ef5dd9756a6c1bb0633a7f306690c3070f2adce3ccab7623d6f1334420c7f39421c420c7d4c0178bb1893a0d8d0c4f3afcea15

  • SSDEEP

    24576:zQWYepR87h9dgxDq7FzGeeVhTilIqSCdzKPQkaxgA1Zk4OYIExiPInVxw+zyWnM1:5YN7jdg8keeVFmEQ5g5rEgAnV+rWp8

  Score

  10^/10

  bitrattrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2