Extracted

Extracted

Extracted

• • Target

    Browser Update.js

  • Size

    606KB

  • MD5

    80f7b21c47f037118ebdce07c9ad7791

  • SHA1

    ea386166ac8a027a7f245cbfa357320734bbcfcc

  • SHA256

    fbecd7506cbac2937c708ec38567949f550e9f0d4a0575b157dec69d9920cf57

  • SHA512

    b2003629653f0a4d3402b0b10654f0bfb838d56ca3168b2e5eb29bffe814554e80c9b969cc15d6ca4e4ff8dbd223e6696a9db0d7fd0c167df412fc76a3c9d469

  • SSDEEP

    1536:5+BEG+BEVB/+BEVB/+BEVB2BEhBEZBEhBEZBEhBEZBEhBENBEFEMBEFEMBEFEMB4:n

  Score

  10^/10

  bitratrhadamanthyspersistencestealertrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2