Extracted

• • Target

    IMG DE ACTA 50801..exe

  • Size

    1.0MB

  • MD5

    6aa0f1a582244471edc1a027a5db7662

  • SHA1

    79919ce6b90bb8c530e3f95877854fd7309a34c4

  • SHA256

    02bc924059ec19c7f3bb1408e433fe80d91a04493da88a8b45ecba52d9682c1b

  • SHA512

    713f78d5d14ef39db13bdca4a5fd9f18ed6cfe3f2d8314a61a1da1efb3b5be1c49bb982e3d14ab4b6d614a3f7969e07b4c7c3f89bb2f0ef4457482bdcdc4cdd6

  • SSDEEP

    24576:4s2yKssWL8vNZ6f7EQnchkwoJ9BxN5FPoPIbADlwAPOGf:4s2yKssWeNZEcgJzxN5SAbKlFPf

  Score

  10^/10

  discoverybitratpersistencetrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2