Extracted

• • Target

    5ec2c541a8a9480a6171083f7426d699

  • Size

    2.2MB

  • MD5

    5ec2c541a8a9480a6171083f7426d699

  • SHA1

    92d3c8040709432ffeb309f0097c463c14d05a60

  • SHA256

    75c904276bfa29c610f17379679bc346d3cde985094c0fc3f088cbfcf9c05528

  • SHA512

    a6156391d84c7bd7e3788875c5924832ddf4ac35c14f667a7fa1b78192e7403981127992a5615a3c1183f40e0820bff30418c9a62e522d39661a0d8353c6a945

  • SSDEEP

    49152:KqWXbXAVzJPvk9mWIyRuzF4+2VI02OP6cf8pww9:KqKTAV9PvCmoa02OUua

  Score

  10^/10

  bitrattrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2