Extracted

• • Target

    6c2934d4_by_Libranalysis

  • Size

    3.5MB

  • MD5

    6c2934d437e948bf2727a4358edb9a59

  • SHA1

    f5a10d17ebb6c2bd247156387d19accc6819cd3f

  • SHA256

    aee478258bbebf0a4cb76eb703c210fa363edbb22d484fe3e6fbcf5f2c3d1af4

  • SHA512

    ccb7c83a5c4f9f96aeeb03ee1460d964bae698e7a0d6b3aec1ab96af0ca7230173023c5c3b1cef29283053153181c69aec3a96bb027e3b39a94fd50ccdf5c246

  • SSDEEP

    98304:CUXQ+L8dHaxE8npS7rpjYSxFnwKfLzy7iV/mtmY2:C6LKHaWCp/SHPje7iV/

  Score

  10^/10

  bitratdiscoverypersistencetrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Bitrat family

    bitrat

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1