Overview

overview

10

Static

static

Request qu...DF.exe

windows7_x64

10

Request qu...DF.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Request quote May 2021 (Site - 580) projec00349305934067565334_PDF.exe
  • Size 2.1MB
  • Sample210503-jxan5ebxfe
  • SHA256 cab2c0c7d8cb30d77bcd469e52357f584077fbd35517f7c6a6886f42e729cc47
  • MD5 SHA1 SHA512
Score
10/10
bitrattrojanupx

Malware Config

Targets

    • Target
      Request quote May 2021 (Site - 580) projec00349305934067565334_PDF.exe
    • Size 2.1MB
    • SHA256 cab2c0c7d8cb30d77bcd469e52357f584077fbd35517f7c6a6886f42e729cc47
    • MD5 SHA1 SHA512
    Score
    10/10
    bitrattrojanupx

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

      trojanbitrat

    • BitRAT Payload

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Uses the VBS compiler for execution

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks