Extracted

• • Target

    ESTADO PDF VER.exe

  • Size

    5.6MB

  • MD5

    ffa29931a560bb75dfe139efad4ca7d5

  • SHA1

    17bef9ea751eee1ce97e0dce90dd473ae5625ecb

  • SHA256

    4aa1ce5bc42ed8633df8586392afaec84df54ee37ce8878184f840ddc62879ba

  • SHA512

    eec1d4e55fa75d8ff49681de82b0bba0a40202df66d54e416929481c9d0e315826c99d8fbee3e72cb580bac45245716faf3d52cf61846055c19ce94f377e3583

  • SSDEEP

    24576:l+pONDPnta6Y9UfUMSR9iUFqNLcrLfQkF2uU5J9VF/08ixUoNQhGnD58fKj7m+Mp:RVdoLRHY7+UcniP/bAfKlG9r7sb

  Score

  10^/10

  bitratpersistencetrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2