Extracted

• • Target

    DOCUMENTO DE SENTENCIA DE FALLO 190014003003-2022-00299-00.exe

  • Size

    4.2MB

  • MD5

    5c1b6de769b658c8383f82da13b12176

  • SHA1

    83fb46538bf04529dc36c71ec21a9e200f15e20b

  • SHA256

    69dffcfefd0fc853db57ede9a3a374b11159778df89922af24de678d794901ba

  • SHA512

    bf0a5158cb9d664afcb66e427082cba3d4a7a949a8474092ca50cdd3320096c712c4a73331528bf8e502ff9d227f52dd9acd2f6d3156e73a1199e6c247351251

  • SSDEEP

    98304:a+L6n3g4AP3GMJhq/wsaZ5w2Sa6TLgF6gGsfksF:dL8Q5SZBXaSgF6g0C

  Score

  10^/10

  bitratpersistencetrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2