Extracted

• • Target
    transferencia interbancaria BBVA.exe
  • Size 786KB
  • SHA256 bf405d5470cb9900f08371031043f5c7c7a790fbc2af3b7d1fe43f9dbca1b705
  • MD5 5d111baa0e77c02c77cb240dfb546497
  • SHA1 68cb0382fd73f351f752c785fad2990b96bb437f
  • SHA512 b5a61ba275e0db80bf9420bad52ed145ece454e9c6ad25feb6012d7bd4af316e6d278da077226686df9b718d05363479ec8da4a4c3c3a7eeadafa2eb7bb4957f
  • SSDEEP 12288:Ek/r8H4IqVqkKDuHMpP2aHs/KuSaZYesNg+1YOMuNzunGyd:fr8HT4qnaH0P2l/daes9S7uNu
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  crypterdiscoverydarktortillaxwormloaderrattrojan

  • Darktortilla

    DarkTortilla is a highly configurable .NET based crypter that delivers a wide range of information stealers.

    loadercrypterdarktortilla

  • Darktortilla family

    darktortilla

  • Detect Xworm Payload

  • Detects Darktortilla crypter.

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2