bitrat

General

Target

f7ddd91ad13d5a8828fb835dde001cea535a8b41dd3f8530b6274edab819fc5a
Size

149KB
Sample

210925-wvb59sdga9
MD5

eae7be913fff3de8e5af0f761bafb49f
SHA1

ee19f9142cb94a381336c51867514ed6fda2b6e9
SHA256

f7ddd91ad13d5a8828fb835dde001cea535a8b41dd3f8530b6274edab819fc5a
SHA512

8a0fd015383fecba560fe06e1ab2d44957f4dbbc0ec6d6105bc52daaec9317ce4d7138f0db4a5c42ea9f6d901fa83dedbaf30605d36a2485d03bd0f267538d77

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://naghenrietti1.top/

http://kimballiett2.top/

http://xadriettany3.top/

http://jebeccallis4.top/

http://nityanneron5.top/

http://umayaniela6.top/

http://lynettaram7.top/

http://sadineyalas8.top/

http://geenaldencia9.top/

http://aradysiusep10.top/

rc4.i32

Extracted

Family

raccoon

Botnet

5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4

Attributes

url4cnc
https://t.me/agrybirdsgamerept

rc4.plain

Extracted

Family

redline

Botnet

228

C2

159.69.123.122:23857

Extracted

Family

redline

Botnet

vol1

C2

92.222.145.232:61157

Targets

- Target
  
  f7ddd91ad13d5a8828fb835dde001cea535a8b41dd3f8530b6274edab819fc5a
- Size
  
  149KB
- MD5
  
  eae7be913fff3de8e5af0f761bafb49f
- SHA1
  
  ee19f9142cb94a381336c51867514ed6fda2b6e9
- SHA256
  
  f7ddd91ad13d5a8828fb835dde001cea535a8b41dd3f8530b6274edab819fc5a
- SHA512
  
  8a0fd015383fecba560fe06e1ab2d44957f4dbbc0ec6d6105bc52daaec9317ce4d7138f0db4a5c42ea9f6d901fa83dedbaf30605d36a2485d03bd0f267538d77
Score

10^/10

bitrat raccoon redline smokeloader 228 5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4 vol1 backdoor discovery infostealer persistence spyware stealer trojan
- BitRAT
  BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
  trojan bitrat
- BitRAT Payload
- Raccoon
  Simple but powerful infostealer which was very active in 2019.
  stealer raccoon
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Downloads MZ/PE file
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1