Extracted

• • Target

    FORMATO DE REALIZACION DE CUENTA DE AHORRO.exe

  • Size

    3.4MB

  • MD5

    fc8292e20e956e494064d005dd3cdf7d

  • SHA1

    36fcd3d13e53ae0757a4115cacd3123e983e8937

  • SHA256

    63ec772a57bb782428643ac0926ef9a26e5687c29994041be791a313f592055f

  • SHA512

    52d34aa67efe2cce73c2390cd00e942cc85dbf7dd3db2a1663d690f893d0a7e2263f07b2d89b8a7dc07aac4678a0b73ad72f3be855f12772f769fb5bdbb448ec

  • SSDEEP

    98304:2Jm1Yc2EzHm2yMMXCjhlJIqLz6L7lE/WGBg:2QfG2yVCVlJIgCEW

  Score

  10^/10

  bitrattrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2