Extracted

• • Target

    23c38ceef63fdb7a980019e03e931920N

  • Size

    4.9MB

  • MD5

    23c38ceef63fdb7a980019e03e931920

  • SHA1

    058e6293a23d54164e8f3431e44059b6e8c1d709

  • SHA256

    5530522e25f6914e281144b9d5d119fe31d810e1e91fc71f0f7ed312528f0615

  • SHA512

    7cd85775424c134efca25575675b6f4b491fc1d0a7fd61c00dc8e3cf751e95d73c046ca927c0a32a941994b72a93b5dd974760658c8268fd84e066af4bee308f

  • SSDEEP

    98304:qH47T0SDn+CFHc8DzA8f+LKE6weJVmJlM+FYeK8KGdIYymzQsA:r0SDnTHc8DzdfCjeJIS+aeHpdIw9

  Score

  10^/10

  bitratdiscoverytrojan

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2