Extracted

• • Target
    7a0723aff075673ef855b4e615207dfd
  • Size 3.6MB
  • SHA256 3cc446d6a658ce7bdf67387d6df73888b2f5ea0a3955f2c11ebdeaec4d589517
  • MD5 7a0723aff075673ef855b4e615207dfd
  • SHA1 aa3c1654b4abefe9831f6b60866253b4b8436fe0
  • SHA512 344444ca7d681f86f0707e5e788c7d20dadbcf8c69cc5afd8a5136e78848737003e5f8320356bd25d0773fb90e3ec0fe2c55d32e6923e43640b6ce204c4ade7c
  • SSDEEP 98304:XTjwlh++gsHbQN/muXMxx2FKPv2QXMojZ5nYu3zSXYwREF0aQ:XTjKz7gF42kWQXMIjnYu+ow7J
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  bitratblisterloadertrojan

  • BLISTER

    BLISTER is a downloader used to deliver other malware families.

    loaderblister

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Detect Blister loader x32

    loader

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $TEMP/bibs_work/WMVCORE.DLL
  • Size 4.9MB
  • SHA256 8c981acb2673fa80fa39aa2ba9b1916cb9866b5e8f9ec1cc98bc7fed36b49c61
  • MD5 88fba76c3a7eb0f785903de05fb0bd06
  • SHA1 35f452a43a838cbad695d596b2cad144cc115074
  • SHA512 f0bfb7e85de0834c3a3a8448ba4d218d28608b3634bed24590a30e91acb51632b01b09f3734547bca383c8d69a8e4c754337fa7d44a274c458fca04d21c29876
  • SSDEEP 98304:LXIbjOdRTNhVNwb64wmsBtA8x2nKXp8SXUMjR7VOMRf2TYwTkZ0032:jI4T9N/esBO62KSSXU0FVOM8Uwz
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral3behavioral4