Extracted

• • Target

    7f33bacbd78bf143a1f8a52b1f8b4cde

  • Size

    3.2MB

  • MD5

    7f33bacbd78bf143a1f8a52b1f8b4cde

  • SHA1

    97ce3f3084b8db04be526422bf9a1feb0d476e25

  • SHA256

    03957e1a76e380308206465031a99a1db9e7afce4b82e021f0f8f94888b791b2

  • SHA512

    c4dd06b99cbe62a1eb3119bdbfac096f9e54328873d8b26b7139ecd89b9ad51c83d97afed519fb81ff9b94fe2df3cbb3c746cec8ed2722af797c4a03d8e5ea08

  • SSDEEP

    98304:TKC6+yhQD2OYZGQRticLcM1cVr9D0mDpg84G:+CpYQClrRIcLcMir9DrDp

  Score

  10^/10

  bitrattrojan

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • CustAttr .NET packer

    Detects CustAttr .NET packer in memory.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2