General
- Target A65C5D8268DAF8603D3F4861991CB09E.exe
- Size 1.6MB
- Sample210824-dczl87cb1a
- SHA256 3a3ff370dac609a17ea67e35e81a3b82702afe6660bb3439a489ff8f4350d607
Score
10/10
Malware Config
Targets
-
- Target A65C5D8268DAF8603D3F4861991CB09E.exe
- Size 1.6MB
- SHA256 3a3ff370dac609a17ea67e35e81a3b82702afe6660bb3439a489ff8f4350d607
Score10/10-
BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
-
BitRAT Payload
-
XenArmor Suite
XenArmor is as suite of password recovery tools for various application.
-
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads local data of messenger clients
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext