Extracted

• • Target

    613b24d89f7d3977859c84c8a67b586b

  • Size

    2.4MB

  • MD5

    613b24d89f7d3977859c84c8a67b586b

  • SHA1

    70b2c707cf94d43cda0a86e9799ff7c4be51df64

  • SHA256

    92af4545d62a5b2af0dd493c5270a03ae5d9163b3fbda51b4dcb81996e5ee94f

  • SHA512

    07fd235d8633bfee95129cfeab10b317bb611dd9f549898c9c7c60398137041def7f648ad0faa58b607c98342765969bcc805755299c90163cd5d62e45854375

  • SSDEEP

    49152:C10KHvFYIKLuyotmWKv514UdkV0fmL8VnhGBCB:I0KWpuyotpEHdkGe8noM

  Score

  10^/10

  bitratpersistencetrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2