Extracted

• • Target

    76563f561fd009f9ec176320657feafa

  • Size

    1.5MB

  • MD5

    76563f561fd009f9ec176320657feafa

  • SHA1

    2f962b8a65165945c3582a49d9a410537abbc964

  • SHA256

    92fc50fbd75a13621c3d64e1ded8617c4c9f92072010f0735d050c06ba73d995

  • SHA512

    91f6dbf03f60382bdb6e3a2acb9d9b3e985abd23e2d74b1dff1b4a4c487791e7d7c068a85804e92eb67cfaecb4c33da8dbcf953c7f39204e819f1a71e9e3072e

  • SSDEEP

    24576:PKaLfALjE7E29i/dB2MJwdLN+93CyfFrwb3RtD5VwlngfdqcKn:jLfALjufc/6yIh2SyfNwbhtD5+lnW6n

  Score

  10^/10

  bitrattrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Uses the VBS compiler for execution

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2