ploutus

Resubmissions

10/10/2025, 16:16

251010-tq495symv810

23/09/2025, 13:45

250923-q2lema1zdy10

Sharing

Copy URL Twitter E-mail

General

Target
fpmaker.exe
Size 37.6MB
Sample251010-tq495symv8
SHA256 e083a4db8c36a4a416ed1def999bfe4be6a6deac55546bdaac507d87765ecc65
MD5 bfc43365f66216d3c47c7f167843f646
SHA1 01c59e4c0e882ed6a89a06860b0d1af0cd9a6749
SHA512 9b77396166bc3f2333dc63d6503f7a44a24ed693cf45779b568aee1764b348f36bf1ec61036b245f2cc871b4f5d5fb4e29ef171ccc045052e81d1c5af4d16c1e
SSDEEP 786432:st44y9RMVz3S/zhJzuCRCpZV8AMtmn8ZMj6O6S+GcT2Y2F3tC:s8RAz3Uz6SCpZV8AJn8ZMj679GcT23Vk
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  fpmaker.exe
- Size 37.6MB
- SHA256 e083a4db8c36a4a416ed1def999bfe4be6a6deac55546bdaac507d87765ecc65
- MD5 bfc43365f66216d3c47c7f167843f646
- SHA1 01c59e4c0e882ed6a89a06860b0d1af0cd9a6749
- SHA512 9b77396166bc3f2333dc63d6503f7a44a24ed693cf45779b568aee1764b348f36bf1ec61036b245f2cc871b4f5d5fb4e29ef171ccc045052e81d1c5af4d16c1e
- SSDEEP 786432:st44y9RMVz3S/zhJzuCRCpZV8AMtmn8ZMj6O6S+GcT2Y2F3tC:s8RAz3Uz6SCpZV8AJn8ZMj679GcT23Vk
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

atm backdoor discovery ploutus
- Ploutus
  Ploutus is an ATM malware written in C#.
  backdoor atm ploutus
- Ploutus family
  ploutus
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Ploutus family

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3