Extracted

• • Target
    2026-07-02_025b3c95498e8dff1d21e807c47be6fe_bitrat_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos
  • Size 7.8MB
  • SHA256 7d5ed450cc0d92be8be16ad549e7901642f1def632fd26bad2c6280bffd0251f
  • MD5 025b3c95498e8dff1d21e807c47be6fe
  • SHA1 3af46f0a6e3f0dbcddc6df95cd8af9043f76640b
  • SHA512 f4ec6da37327f1e0dbdb8b7581e59c25ad49b49fce5f0a57f77cc67b2375f39f0976bc681dfe1da0b2f078c298fa741ed3aa6aed0d97ee2fd715ecb8c5bd2299
  • SSDEEP 196608:P4zhn+Vjekxwhzav1yo31CPwDv3uFZjeg2EeJUO9WLQkDxtw3iFFrS6XOfTV73c:Qzh6ekxwZ6v1CPwDv3uFteg2EeJUO9Wq
  • TLSH
    T1C886D011B5958C6BD5561278CAEFB33B223CFA600B23C7C367506A394E73AC13E65B16
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverybitratpersistencetrojanupx

  • Family: BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • UPX dump on OEP (original entry point)

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2