Extracted

• • Target

    76ac21d5d094a33fc1fcc0215bbcc123

  • Size

    4.0MB

  • MD5

    76ac21d5d094a33fc1fcc0215bbcc123

  • SHA1

    03aff12ac59f59a3e1c4c7ee1e79ea5840bc66bb

  • SHA256

    fe8c9e7b5df84863cebeffb7f7a6a9de7e1cfccce1a0882618438ba16b3b2780

  • SHA512

    3508f02a6d96e2988b5a232d44ffc6e7979ce3eb1c7f640417f1b1029f1e0f94f9682d95d72c108a3e2b1d706ce774d6ff140a07e4aa42565604cd2ca9a12612

  • SSDEEP

    98304:YZVblz+5RHSRptwRWNcKr709xNG8W9pIbV50OqnwhIjIlb3r:YZV5zayRQpXi7IbsDNU

  Score

  10^/10

  bitrattrojan

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Uses the VBS compiler for execution

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2