Extracted

• • Target

    c63582cc8c24d69e4bb0829e71f395f3

  • Size

    2.5MB

  • MD5

    c63582cc8c24d69e4bb0829e71f395f3

  • SHA1

    b789bcd4020aa3bd35ad11a2fbe023772b98a648

  • SHA256

    79f721fce9ff531d55a30dca577a8c55790d9a5b88158654e1daee60e4ed014a

  • SHA512

    170c288927099f254a16ad52155e1ebba2067bab3e8b9e771a81b9946ce3c854ff7275b74911ab8e111e32efd667bcd2359aca3effca41d59447fa57df3beaad

  • SSDEEP

    49152:zb30Hlkz8scuXSG6sIr4ulgbRYfbSVfbpQxLK/SejMqzMgJKl:JoBuXL6sIUueFYfb0f1hMqQgUl

  Score

  10^/10

  bitratpersistencetrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2