Extracted

• • Target

    svchost.exe

  • Size

    17.9MB

  • MD5

    0dc5eec70a1c5d641f7e2ca2fdeb0c13

  • SHA1

    045faba808f788827ac803ca23674703db202112

  • SHA256

    042fb46c57a37d6e3a96aa82bc30e294ef04d43487ebfd80c81766d37c2a5fbe

  • SHA512

    b8acbb5512a981aff7e05f7238c50880b601310910a6199afab7600bd365252da567f5414902d644c28920bfb07471f8579cc315f808ef8fc144019b69c175c3

  • SSDEEP

    393216:60cJ5TXEFbFQoEi/2rUeP/xQAiNPDak9If:cDXEF+FRHxORDakw

  Score

  10^/10

  bitratpersistencetrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1