General
- Target edi.exe
- Size 1.8MB
- Sample210811-fe8k74thrs
- SHA256 6d7fac5d7bfe833eb0756a174ceb9ea8280cd3f9858215924284af1b559bd81f
Score
10/10
Malware Config
Targets
-
- Target edi.exe
- Size 1.8MB
- SHA256 6d7fac5d7bfe833eb0756a174ceb9ea8280cd3f9858215924284af1b559bd81f
Score10/10BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
BitRAT Payload
XenArmor Suite
XenArmor is as suite of password recovery tools for various application.
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
Executes dropped EXE
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
Loads dropped DLL
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
Reads local data of messenger clients
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Adds Run key to start application
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext