Extracted

• • Target

    68222440e7fab33d7b5ec1b6e2672962

  • Size

    2.6MB

  • MD5

    68222440e7fab33d7b5ec1b6e2672962

  • SHA1

    9e756880fc27ce0e0aa9f746039ec5fc0ca60294

  • SHA256

    9f853c69ec51eef3b38c508c2cdfaad6230c9cac218b6c1e2c1aade3e2aaa684

  • SHA512

    8fc00dc22e870a8e2150bd57b3e26d173a425ab1ab665b16548285489622f2a52db7487ce1a9811fc4c0328f673454be0f8a38d72a30e65727afabef04d63388

  • SSDEEP

    49152:wvibll7s0eIB4GzdH21N9vGHE5S9H5EsHBTzPfEAuj0/XN+fX+4T38mc:wS00SGzdHAuPmKJzXEAfXcuwU

  Score

  10^/10

  bitratpersistencetrojan

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2