Extracted

• • Target

    CITACION A AUDIENCIA DE CONCILIACIÓN VIRTUAL 22-2501285 RADICADO 9072022.exe

  • Size

    3.4MB

  • MD5

    627f67f2c7868795e7bf02e94cd8342e

  • SHA1

    9f82602559cb2f309891c2b31e6ced47d6322b15

  • SHA256

    e3f17802355f09925fc6d2b962e6c5af67212b770d37908c6d55ff9c9631dcbb

  • SHA512

    c9615a5e96c60c89490a2f78bce6553daa666796a6b56d4c0701f0e11162d3957a47d9f9ed8c862916ba5aa1d312eace64d004ab024c2d6dc95b2915244af2ec

  • SSDEEP

    98304:bbM8cmtgiAhhrklSDcCdkcr1xP2RrYnLi6oAXc:ZBAhhrVhH1gRP6oec

  Score

  10^/10

  bitratpersistencetrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2