Extracted

• • Target

    811b4b20c0130dfea97e1a470ad1cf69

  • Size

    2.1MB

  • MD5

    811b4b20c0130dfea97e1a470ad1cf69

  • SHA1

    68a20eea892f3a0bd6d1c603659b923b6c7148ca

  • SHA256

    bac0ca9fcbfdcd99d5497c07d74858e07ed6f399b50565ecdc4475846ea85af7

  • SHA512

    fd971472f526edae84bfd90865a848a7fe71f16dd6067dcced8bb6a433842e12d923f3c93b6ddc1f89489f8493dc4c9268e068bca537b149d9c32a6d1b5ca761

  • SSDEEP

    49152:acaD52D03XY33amyntl/v4Tg8iVk4cv3meXvaI1tcds/B:xaIXaVnt9v4TFV2el/B

  Score

  10^/10

  bitrattrojan

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Beds Protector Packer

    Detects Beds Protector packer used to load .NET malware.

  • Drops startup file

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2