Extracted

• • Target

    1b57c846642439e8075b62c48f9f308c599c2fc0c028631b9263e6724c64ecef

  • Size

    2.7MB

  • MD5

    5df4f8f8a7a896fad462276803c89857

  • SHA1

    ab113df31bb37cdb727f3ea3c6e9cc397e5be80e

  • SHA256

    1b57c846642439e8075b62c48f9f308c599c2fc0c028631b9263e6724c64ecef

  • SHA512

    08a63d53836e37a7971f76dc1e60be44ec073bdd11cbf3eb9f9dac9d1c8e1a4fa7a83c38dff972c8febad82f53b3c85f0db548664851fe7b5d60b05999ec13ee

  • SSDEEP

    24576:aju8SpOfT+Z8fDTuvlzq3ae70J6ImfeSnPlAVMRNJhpEx4oQp3d2TX9iSghV+3Ol:NOfHfvu9qakj+aRXEx4LV+3OvS

  Score

  10^/10

  bitratdiscoverypersistencetrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2