Extracted

• • Target

    9edc6bd6360c3d3e593e6f63353fe45a

  • Size

    2.0MB

  • MD5

    9edc6bd6360c3d3e593e6f63353fe45a

  • SHA1

    9f305ba70a0b5056dd1934a83acfb7cc04618de6

  • SHA256

    46384028b4c21ce3ed937de84665be89cb78cad140c85a63806f7ebf0a23ce88

  • SHA512

    b1ea3103dfabba16fc3169eb5105fa4d22573d4f62beba0c1d99fae7500a8cf9ecc4330f0058fa363bb607f7cee6365e0eeb6471c3606097625a81132213aa69

  • SSDEEP

    49152:8U/koHM0rGpSTFS/bOx7wqylkFTJFeUboERX3a5a8J2Ldv:8U/kosSGpSTkD3+FVFfX3Z/L

  Score

  10^/10

  bitratpersistencetrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • CustAttr .NET packer

    Detects CustAttr .NET packer in memory.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2