Overview

overview

10

Static

static

9401cf9f73...2b.exe

windows7_x64

10

9401cf9f73...2b.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9401cf9f73dfb187bf4cef05d8cfe72b

  • Size

    2.2MB

  • Sample

    220107-p88cascfgq

  • MD5

    9401cf9f73dfb187bf4cef05d8cfe72b

  • SHA1

    4af6544d8c94bb673f826a0ba4d24698150b1089

  • SHA256

    bb8298b28cd913814c41d7b6a878b8e2a2da7eb34083c901a5408413fed93b45

  • SHA512

    8438c79aa1ac9779bdab11a3f46f174aad97a7bc2fd1f571d42ef8817dc8477b68468be7445c789d125c1b8749338e047e20301d0a11b9e52dacf947abb65dd4

Score
10/10
bitratevasionpersistencesuricatatrojanupx

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

severdops.ddns.net:3071

Attributes
  • communication_password

    29ef52e7563626a96cea7f4b4085c124

  • tor_process

    tor

Targets

    • Target

      9401cf9f73dfb187bf4cef05d8cfe72b

    • Size

      2.2MB

    • MD5

      9401cf9f73dfb187bf4cef05d8cfe72b

    • SHA1

      4af6544d8c94bb673f826a0ba4d24698150b1089

    • SHA256

      bb8298b28cd913814c41d7b6a878b8e2a2da7eb34083c901a5408413fed93b45

    • SHA512

      8438c79aa1ac9779bdab11a3f46f174aad97a7bc2fd1f571d42ef8817dc8477b68468be7445c789d125c1b8749338e047e20301d0a11b9e52dacf947abb65dd4

    Score
    10/10
    bitratevasionpersistencesuricatatrojanupx

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

      trojanbitrat

    • Windows security bypass

      evasiontrojan

    • suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

      suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

      suricata

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Looks for VMWare Tools registry key

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Uses the VBS compiler for execution

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

2
T1089

Modify Registry

3
T1112

Virtualization/Sandbox Evasion

2
T1497

Scripting

1
T1064

Credential Access

Discovery

Query Registry

4
T1012

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks