Overview

overview

10

Static

static

OZD Paymen...7U.scr

windows7_x64

10

OZD Paymen...7U.scr

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    OZD Payment Information TT784677U.rar

  • Size

    362KB

  • Sample

    210227-wbrgzw891s

  • MD5

    5acf0076a3d4149de7d704ec8cabc0fa

  • SHA1

    d7ac748b97fee51a084c3b83ec1908f377b98183

  • SHA256

    d0602b164387e99fb78ae30de05070356e7d1165a3d8c67f708c7d4f2e78c2b6

  • SHA512

    0e314412c4becbde70ed5f36f0628a972b6da850e31c525397a3889808ce16501b45a354f27ef16559f202011492874c911993b5959da106aef068d33414cfbe

Score
10/10
bitratpersistencetrojanupx

Malware Config

Targets

    • Target

      OZD Payment Information TT784677U.scr

    • Size

      1.1MB

    • MD5

      05e699f1763f039ca9f696ef520c3b1e

    • SHA1

      e9dbd4a76a1ede5f201a849f9ba4d5cd1b35d796

    • SHA256

      ae8189a4bb0e5d94c656e530686caed2b724cfe2def4febecca71288280fd275

    • SHA512

      7d98738252993857f76267e45115bcf7cd3d9db7460ab47eef041437f936408998d0a3029f572884706cce2e70db0dda223a4db7079a0d423cd82e7eb12c94c8

    Score
    10/10
    bitratpersistencetrojanupx

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

      trojanbitrat

    • BitRAT Payload

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Install Root Certificate

1
T1130

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks