Overview

overview

10

Static

static

File.exe

windows7_x64

10

File.exe

windows10_x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    File.exe

  • Size

    862KB

  • Sample

    211211-trclhscgar

  • MD5

    ce4b46d5a2055e00d3cbafa4d8fa40cd

  • SHA1

    79e3741f056583a0d63689ca6c788492bd5daae2

  • SHA256

    7cf3410e13c13eb9cdfb1fa3df95f643bfbf7b55f5de595353205b4c44b84c5d

  • SHA512

    ed96c817b7a023a1578557bedafc64dcec8c1e970c61ccfa2bd9202ca738196c110dd79827119becbc585c0b5a5f850650426b2f6e41fb87bd370a6a4a2aaf6f

Score
10/10
bitratpersistencesuricatatrojanupx

Malware Config

Targets

    • Target

      File.exe

    • Size

      862KB

    • MD5

      ce4b46d5a2055e00d3cbafa4d8fa40cd

    • SHA1

      79e3741f056583a0d63689ca6c788492bd5daae2

    • SHA256

      7cf3410e13c13eb9cdfb1fa3df95f643bfbf7b55f5de595353205b4c44b84c5d

    • SHA512

      ed96c817b7a023a1578557bedafc64dcec8c1e970c61ccfa2bd9202ca738196c110dd79827119becbc585c0b5a5f850650426b2f6e41fb87bd370a6a4a2aaf6f

    Score
    10/10
    bitratpersistencesuricatatrojanupx

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

      trojanbitrat

    • BitRAT Payload

    • suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

      suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

      suricata

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks