Extracted

• • Target

    COPY0001.exe

  • Size

    300.0MB

  • MD5

    ef077d3465b442673296cee268e2973a

  • SHA1

    438ec36e4cc7cad870740c5e926753f04baa1958

  • SHA256

    f68ccb24ae1039fdfe224fd82d46e2a30e2b082d923c92510162218d453e2cfe

  • SHA512

    e53eaa044e8da60afc25f785953b4272eb684391fee5ee32c8c35946c7324ef5dfd4d4cdd9a6ad71eb7c7717fa2d1f40cead8ae5c7c5273ef3a030fdd60091ed

  • SSDEEP

    49152:YwTaSh6OnQVq2ky+jEnogf1L79QxEGIvbDmCwM4BIdN90L:fTaOsqdy1nzdLOfIvm7

  Score

  10^/10

  bitrattrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Detects executables packed with Babel

  • Detects executables packed with Dotfuscator

  • Detects executables packed with Goliath

  • Detects executables packed with SmartAssembly

  • Detects executables packed with dotNetProtector

  • UPX dump on OEP (original entry point)

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2