Overview

overview

10

Static

static

joga.exe

windows7_x64

10

joga.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    joga.exe

  • Size

    2.2MB

  • Sample

    211221-sp6k5sdhd7

  • MD5

    f9563a0236add88c9d88476b20135cef

  • SHA1

    43e5250e10ab3bc1ea6c569269f12328883974b5

  • SHA256

    cb885f967143736bd3214488784c23c1baf836462274ed172e82982fd09e61fd

  • SHA512

    6393b44c01562803d261365297ee77ce959bac0f028f02612bc0486b655a07cb74b3eb8591b77b81c851fef78d86b283c2dd5f8d0035fba5091c9bed028deca3

Score
10/10
bitratxenarmorpasswordpersistencerecoverytrojanupx

Malware Config

Targets

    • Target

      joga.exe

    • Size

      2.2MB

    • MD5

      f9563a0236add88c9d88476b20135cef

    • SHA1

      43e5250e10ab3bc1ea6c569269f12328883974b5

    • SHA256

      cb885f967143736bd3214488784c23c1baf836462274ed172e82982fd09e61fd

    • SHA512

      6393b44c01562803d261365297ee77ce959bac0f028f02612bc0486b655a07cb74b3eb8591b77b81c851fef78d86b283c2dd5f8d0035fba5091c9bed028deca3

    Score
    10/10
    bitratxenarmorpasswordpersistencerecoverytrojanupx

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

      trojanbitrat

    • BitRAT Payload

    • XenArmor Suite

      XenArmor is as suite of password recovery tools for various application.

      recoverypasswordxenarmor

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks