Extracted

• • Target

    b5fec209a03ef46ff5851c223137b439c1bcfdc1d22a0c8d7bf3bc8921e4ab42.exe

  • Size

    1.8MB

  • MD5

    e1b1b4e8f48045cf18376eccaf81f897

  • SHA1

    8ebf25c2ddfaf7ea17c1be5ba7d40793fa399d58

  • SHA256

    b5fec209a03ef46ff5851c223137b439c1bcfdc1d22a0c8d7bf3bc8921e4ab42

  • SHA512

    d7b23d23fe2a935bf7f4d5440e6a2cd7e39857b3423d67b1cfcb22563ee17cc7058f252eb015c2b23ff04df7c9443d3ab04432d8977eb86c40d558ca7d0cb928

  • SSDEEP

    49152:eTUit2C759KwH8t4m6tPXuXt14qNZbzvgI5ogEyXlM:eTUiD75ns4m6qt14qjkIJ3Xy

  Score

  10^/10

  discoverybitratpersistencetrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Bitrat family

    bitrat

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2