Extracted

• • Target

    DOCUMENTO CONSIGNACION 04 OCT.exe

  • Size

    4.5MB

  • MD5

    1f5c1e925be09de49aa530db5c4435cd

  • SHA1

    2bc7eba78ec71016fd77124fd5e05b7557c44b88

  • SHA256

    a447e84ff39b927c6b677fb025f89736fdc9bdeb613eed4674956f1ca800ccbb

  • SHA512

    103c71945bbdfdb2bc0f210df17c8dbd745ec664a087e8f710beb8e18deb94e3b1f11ffa650af8ac29cc8fe8f5d1fbb8f5e53be60b742931f3d46a6b7ea2dc15

  • SSDEEP

    24576:7/MKK/93NT6JtkKM5Xqix7Z4hwinQh6LhZGGNtSzGmzS+op1jHZP4qukK0PeXAyh:16

  Score

  10^/10

  bitratpersistencetrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2