Extracted

• • Target

    b1493c9c3de438c1d925f3a4af556f04

  • Size

    2.2MB

  • MD5

    b1493c9c3de438c1d925f3a4af556f04

  • SHA1

    16ba06f5872a5d79ad1dd835669a9d5f55cf10d2

  • SHA256

    418f4beab3913272a5ce86075202e67fe89a273c7840b53d0eccb0229dfea020

  • SHA512

    9556f48f59abd27cdd919fcb892de800d5291b012ebef9c4042804662f58f671fff8f700f3c22e9c6566f7994fcbd7cbadd35625faa1e17e5f72285b4359fad9

  • SSDEEP

    24576:0KtlfLm3/4s8krM4hsJgqGMDA2Q0CDwuJZqrMNCYjef9juun4MoTq0:Hj44VTgfH2r6qfpo2

  Score

  10^/10

  bitratpersistencetrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2