Extracted

• • Target

    Radicación Ref. AMH-9484-2022 , PRIMERA INSTANCIA.exe

  • Size

    62KB

  • MD5

    c3ec390f9540222363623f223fb34ee7

  • SHA1

    b0d0ad1a8a2bd3647779dad824871946210292cc

  • SHA256

    242be69b82dd980914a4dd090ba44f60de9af23a5ffa8fdd9b4d8ea243212c41

  • SHA512

    780dbe0d64f4e45cef2fb4248370a3fbd7130376f2f6765e669bfdc50ef9a5cc602d4dc460d2c83b51a4c07826a880ee03545572660c47b44d9ba8a8a28333fc

  Score

  10^/10

  bitratpersistencesuricatatrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

    suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

    suricata

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2