Extracted

• • Target

    WinLocker Builder (test version).exe

  • Size

    5.1MB

  • MD5

    fb344b1c20c3d4b66efe7194fdc7299c

  • SHA1

    c36ff3e29f450a7ffc58979cd51360d6db04e854

  • SHA256

    f3fa585e7418f8b33bb279c72461d1822d0da9c0da673d158acfeecfd0ca6017

  • SHA512

    44aad18a62c554cfa9a21dc4fe58db4f09d68d70252c59385fe54fe007e4e79172110719547e2cfd784ee98f8604561e185a0c3c05dd2443cf5cd76e92725bdb

  • SSDEEP

    98304:Ex3MI+PNSOdHfY5JX+2pgGXRNe14VMAjizLIi2tEXuDS2MTozg:EE5Ri5pgGXyp0SIi2tEXu+Px

  Score

  10^/10

  bitratbootkitdiscoveryevasionpersistencetrojan

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1