Extracted

• • Target

    955ac34a2a20fd96b038376ec0ed5142

  • Size

    1.7MB

  • MD5

    955ac34a2a20fd96b038376ec0ed5142

  • SHA1

    d38a1ba30cd2711ffb46fa72bdaf0f29cb7d1964

  • SHA256

    18b96a50da281d031e2ce58c2143a9c1bf4868c710bbcc61b7d147038b449e2b

  • SHA512

    5d2de60a4529a4ae49448ecd30ee688f5d5367d33bb900eb7edb9bd8d7a1743063b8f004843c9351e4a4a92becfd2264a9e5ab3fbdbb3fbedb3940c3024441bd

  • SSDEEP

    24576:ufNb0+uSi+JZxvZZHUqDBUP+OeEQIehk8BylYTiKjX8aHEYn0NLG8drnJviDEAoL:Oi+JZplKP+OeIO5CUgLG9DWKDEb

  Score

  10^/10

  bitrattrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2