bitrat

Resubmissions

13/05/2021, 13:31

210513-sn6a5kweke10

13/05/2021, 13:27

210513-j268h73bf21

Sharing

Copy URL Twitter E-mail

General

Target
Remittance Advice.doc
Size 3.5MB
Sample210513-sn6a5kweke
SHA256 afbe68c3191008df102a2d3eb19b38386d4ad813d4ee49fc6de51a22438c1359
MD5 c883105f4c84136865c145cb135aeefc
SHA1 605a9b14ff55100e3f4facb8a50ed5528890710b
SHA512 c3f5531ce544a44ea2015d1db8a39e9309daeac5a2ff2d5b9730a99348c83780e36a76088975532d8eff798e1b0c8ae7f933152777cd3a1199d8b0e80b7520a1
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Targets

- Target
  Remittance Advice.doc
- Size 3.5MB
- SHA256 afbe68c3191008df102a2d3eb19b38386d4ad813d4ee49fc6de51a22438c1359
- MD5 c883105f4c84136865c145cb135aeefc
- SHA1 605a9b14ff55100e3f4facb8a50ed5528890710b
- SHA512 c3f5531ce544a44ea2015d1db8a39e9309daeac5a2ff2d5b9730a99348c83780e36a76088975532d8eff798e1b0c8ae7f933152777cd3a1199d8b0e80b7520a1
- MD5 SHA1 SHA512
Score

10^/10

bitrat persistence trojan
- BitRAT
  BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
  trojan bitrat
- BitRAT Payload
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

BitRAT Payload

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2