General
- Target SecuriteInfo.com.Exploit.Siggen3.19777.16732.15393
- Size 35KB
- Sample210814-2j2qgmkwne
- SHA256 06d5e005a6b82b8b04af686c2d24f14d36a7a842eb0b38940bcf3453d1222ad4
Score
10/10
Malware Config
Targets
-
- Target SecuriteInfo.com.Exploit.Siggen3.19777.16732.15393
- Size 35KB
- SHA256 06d5e005a6b82b8b04af686c2d24f14d36a7a842eb0b38940bcf3453d1222ad4
Score10/10-
BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
-
BitRAT Payload
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext