Extracted

• • Target

    DOCUMENTO IMPORTANTE BOLETA CITA FISCAL.exe

  • Size

    1.4MB

  • MD5

    50333bf7c05e8cbcbb9fff3f645db645

  • SHA1

    8dc664f56e03b37f1085a910527b0b7651939060

  • SHA256

    2c8ba8509cd89c44d8b0888f3941903e64f8553eca8eac54b3196dba5c84b53a

  • SHA512

    270cde8913116f134fa331c2c0eb114ad3682cbc87bd70f3929fadad14cf730815975e516b6092e54bfe9f4227a656ff82b54a9a5b0bd04fb2b2bdbcd732db98

  Score

  10^/10

  bitratpersistencesuricatatrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

    suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

    suricata

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2