Extracted

• • Target

    7a0723aff075673ef855b4e615207dfd

  • Size

    3.6MB

  • MD5

    7a0723aff075673ef855b4e615207dfd

  • SHA1

    aa3c1654b4abefe9831f6b60866253b4b8436fe0

  • SHA256

    3cc446d6a658ce7bdf67387d6df73888b2f5ea0a3955f2c11ebdeaec4d589517

  • SHA512

    344444ca7d681f86f0707e5e788c7d20dadbcf8c69cc5afd8a5136e78848737003e5f8320356bd25d0773fb90e3ec0fe2c55d32e6923e43640b6ce204c4ade7c

  • SSDEEP

    98304:XTjwlh++gsHbQN/muXMxx2FKPv2QXMojZ5nYu3zSXYwREF0aQ:XTjKz7gF42kWQXMIjnYu+ow7J

  Score

  10^/10

  bitratblisterloadertrojan

  • BLISTER

    BLISTER is a downloader used to deliver other malware families.

    loaderblister

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Detect Blister loader x32

    loader

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $TEMP/bibs_work/WMVCORE.DLL

  • Size

    4.9MB

  • MD5

    88fba76c3a7eb0f785903de05fb0bd06

  • SHA1

    35f452a43a838cbad695d596b2cad144cc115074

  • SHA256

    8c981acb2673fa80fa39aa2ba9b1916cb9866b5e8f9ec1cc98bc7fed36b49c61

  • SHA512

    f0bfb7e85de0834c3a3a8448ba4d218d28608b3634bed24590a30e91acb51632b01b09f3734547bca383c8d69a8e4c754337fa7d44a274c458fca04d21c29876

  • SSDEEP

    98304:LXIbjOdRTNhVNwb64wmsBtA8x2nKXp8SXUMjR7VOMRf2TYwTkZ0032:jI4T9N/esBO62KSSXU0FVOM8Uwz

  Score

  1^/10
  behavioral3behavioral4