Extracted

• • Target

    4961035acbeb6994d32cddd04c863934bf765693e47f78b8aa8decf63d1aa899N

  • Size

    2.6MB

  • MD5

    3fdc600285ca37b7985b8b13c86c6a70

  • SHA1

    fc12ad02fc1dbab9641e8cb3c807b3903f437626

  • SHA256

    4961035acbeb6994d32cddd04c863934bf765693e47f78b8aa8decf63d1aa899

  • SHA512

    24ba039b811e5c0dd7c5b2dcac8784620b4112cfb90fa955624be331451e343611f6becece7c3ec93371475ddc6d364cec8529484fa5b65c1b4573ed018ea854

  • SSDEEP

    49152:e/c9Kt+cgsG2P4qX7STBh0VWq2x8WoR8D3MR0aKVtRTus7:eQKoJsG2XmTBmVWq2xoRMaCtRTus7

  Score

  10^/10

  discoverypersistencebitrattrojan

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2