Extracted

• • Target

    Falcon.exe

  • Size

    2.1MB

  • MD5

    005e76ae2d3af2cc2a001745d5e0afd9

  • SHA1

    fa117b48f316b38db20887ba9b0138a07d686064

  • SHA256

    a427b998ac966b5f8a4ec510205b075cfe7eaa102ac1d9e1ac0182a54cb33d2c

  • SHA512

    2e5bb3e7d95230c012014184bb29ddbd56328fc8d63738ebf50923d5e86461d2f2511c32ca930d23eeec81b4a0d4ad54a4be0c782dfe01904a276a74636a1e8b

  • SSDEEP

    49152:ftBEvg4rSx4YYKOvp+QoqkxR/NPmmRFyxGFrEN0FN63lSY:fQvg4G6YDxQoqkxBNPXmUylD

  Score

  10^/10

  persistencebitrattrojan

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2