Extracted

• • Target

    bf9a1a690110be2f207d8015292d14a9

  • Size

    2.3MB

  • MD5

    bf9a1a690110be2f207d8015292d14a9

  • SHA1

    9732b514c34809cc74bd9aae96b2fc0773c6fe7b

  • SHA256

    b02372e2bef2a657182ad7d232baf35a321d0bc8f707d5f8292ae85f51907702

  • SHA512

    d4e02101700bdbed5cbd10be29a787751784052f4c4a6fc7a1ac5ab2f4e160e597b7c32a51c4d647dae0083b04e492ea88b17b18dc524c5544027647cbd8406e

  • SSDEEP

    49152:GLfqBDAfgnwCFIhXeNNmMlXP4RNsMyaxd7Ad/0jdH8a7Lyx:GsFIhu/m04jDTj7G/0jdH

  Score

  10^/10

  bitrattrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2