Overview

overview

10

Static

static

jogb.exe

windows7_x64

10

jogb.exe

windows10_x64

10

Resubmissions

23/12/2021, 11:09

211223-m84m1aadej10

23/12/2021, 08:55

211223-kvgj7sabdn10

Sharing

Copy URL Twitter E-mail

General

  • Target
    jogb
  • Size 2.3MB
  • Sample211223-kvgj7sabdn
  • SHA256 892fe797710cbdda052f494e1979a339c14f96220d3d1a7c51d4f28ef47385de
  • MD5 SHA1 SHA512
Score
10/10
bitratpersistencetrojan

Malware Config

Extracted

Family

  • bitrat

Version

  • 1.38

C2

  • 2.56.57.68:3678

Attributes
  • communication_password

    46821e93230f353d5c46240b0462a0fe

  • tor_process

    tor

Targets

    • Target
      jogb
    • Size 2.3MB
    • SHA256 892fe797710cbdda052f494e1979a339c14f96220d3d1a7c51d4f28ef47385de
    • MD5 SHA1 SHA512
    Score
    10/10
    bitratpersistencetrojan

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

      trojanbitrat

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks