General
- Target Yhcmvzmpvugqazayqyzancaeziqveylhbf.exe
- Size 879KB
- Sample211117-lhmfcsehbm
- SHA256 76e7e27f4fcf15610764d121949f84e3b415376bfc5e88c08d85b613013ba87f
Score
10/10
Malware Config
Targets
-
- Target Yhcmvzmpvugqazayqyzancaeziqveylhbf.exe
- Size 879KB
- SHA256 76e7e27f4fcf15610764d121949f84e3b415376bfc5e88c08d85b613013ba87f
Score10/10-
BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
-
BitRAT Payload
-
XenArmor Suite
XenArmor is as suite of password recovery tools for various application.
-
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Executes dropped EXE
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads local data of messenger clients
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts
-
Adds Run key to start application
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext