General
- Target Yhcmvzmpvugqazayqyzancaeziqveylhbf.exe
- Size 879KB
- Sample211117-lhmfcsehbm
- SHA256 76e7e27f4fcf15610764d121949f84e3b415376bfc5e88c08d85b613013ba87f
Score
10/10
Malware Config
Targets
-
- Target Yhcmvzmpvugqazayqyzancaeziqveylhbf.exe
- Size 879KB
- SHA256 76e7e27f4fcf15610764d121949f84e3b415376bfc5e88c08d85b613013ba87f
Score10/10BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
BitRAT Payload
XenArmor Suite
XenArmor is as suite of password recovery tools for various application.
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
Executes dropped EXE
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
Loads dropped DLL
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
Reads local data of messenger clients
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Accesses Microsoft Outlook accounts
Adds Run key to start application
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext