General
- Target 584249EC870B36FCE92D4906C8003667.exe
- Size 3.8MB
- Sample210416-2fb92rmngx
- SHA256 78eafd097228f4ca24f16292f535d37d29155c4c79702dd837b4c1638743491e
Score
10/10
Malware Config
Targets
-
- Target 584249EC870B36FCE92D4906C8003667.exe
- Size 3.8MB
- SHA256 78eafd097228f4ca24f16292f535d37d29155c4c79702dd837b4c1638743491e
Score10/10BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
BitRAT Payload
XenArmor Suite
XenArmor is as suite of password recovery tools for various application.
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
Executes dropped EXE
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
Drops startup file
Loads dropped DLL
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
Reads local data of messenger clients
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Adds Run key to start application
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext