Extracted

• • Target

    COMPARECENCIA_PROCESO_SPOA_008694194690952113_y_0500169840525332212.exe

  • Size

    3.3MB

  • MD5

    a4446e6395532a34c37e74d32b6b0125

  • SHA1

    9d6842a99065b3b3eab946cba363e87a50be8094

  • SHA256

    89668ca5da2a472ae00400d95799acf068585d5f5e3028c0b10fa3d71187e80b

  • SHA512

    bc35983386eb619e19ec89106db7f47d01408384986a92a919c985e53d977dc2258836948612bd0f842067f2f50fa2845e71421a884797f92049ce1e2368086f

  • SSDEEP

    98304:EkeKZHb1fAabLHdA9qpwTAAvXF71C8ckiw/:G+BAqLH6q6TrF71hpiw/

  Score

  10^/10

  bitratpersistencetrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2