bitrat

General

Target

OZD Payment Information TT784677U.scr
Size

1.1MB
Sample

210227-zwqq9fsp4a
MD5

05e699f1763f039ca9f696ef520c3b1e
SHA1

e9dbd4a76a1ede5f201a849f9ba4d5cd1b35d796
SHA256

ae8189a4bb0e5d94c656e530686caed2b724cfe2def4febecca71288280fd275
SHA512

7d98738252993857f76267e45115bcf7cd3d9db7460ab47eef041437f936408998d0a3029f572884706cce2e70db0dda223a4db7079a0d423cd82e7eb12c94c8

Score

10^/10

Malware Config

Targets

- Target
  
  OZD Payment Information TT784677U.scr
- Size
  
  1.1MB
- MD5
  
  05e699f1763f039ca9f696ef520c3b1e
- SHA1
  
  e9dbd4a76a1ede5f201a849f9ba4d5cd1b35d796
- SHA256
  
  ae8189a4bb0e5d94c656e530686caed2b724cfe2def4febecca71288280fd275
- SHA512
  
  7d98738252993857f76267e45115bcf7cd3d9db7460ab47eef041437f936408998d0a3029f572884706cce2e70db0dda223a4db7079a0d423cd82e7eb12c94c8
Score

10^/10

bitrat persistence trojan upx xenarmor password recovery spyware
- BitRAT
  BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
  trojan bitrat
- BitRAT Payload
- XenArmor Suite
  XenArmor is as suite of password recovery tools for various application.
  recovery password xenarmor
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
- Adds Run key to start application
  persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2