Extracted

• • Target

    FLASH BTC.exe

  • Size

    1.4MB

  • MD5

    777ae7451aabc288b883f9b286b9fae7

  • SHA1

    c4c29bc0edd084e95b1788aaa9a99dc6694d414d

  • SHA256

    730f560bd68f0fdecce02be381339fb82a76145cdf762aed4fa140f1779f13b4

  • SHA512

    9bde3874697a56837e382db8b70fbdc8b3a8a790ce67a5112cb67c2831c8bc66347857a0535d09d0971b1bf9355a2e44c0cc9a91f42778ac0de61e4f53c70919

  • SSDEEP

    24576:GQNbVHOxMZlg4xdpyCW3xwEIl74jKnUBRNFk7mGq:/Zlg4xvtW3iEIasUnTG

  Score

  10^/10

  bitratdiscoverypersistencetrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Bitrat family

    bitrat

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2