Overview

overview

10

Static

static

RECEIPTUSD97.00.exe

windows7_x64

10

RECEIPTUSD97.00.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    RECEIPTUSD97.00.exe

  • Size

    1.0MB

  • Sample

    220110-l2srgseba3

  • MD5

    08e0f6fc015b6008f3d0e583c94c8772

  • SHA1

    ea87a156303f0cd82266734f7f9678faecffa18b

  • SHA256

    84e9426e79655328d7e51384cd16697772d5fa8043ef793e4777ec7e3c38c6d0

  • SHA512

    bf340c263cf3a4c1d1d58304ce921f228e2e20a70eef29322ee01894a5b7b68b5646fd800a3c4ea826472450195b7228166272b9afff750f057f8bcdd514a35c

Score
10/10
bitratpersistencetrojan

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

bitpeople.duckdns.org:9173

Attributes
  • communication_password

    81dc9bdb52d04dc20036dbd8313ed055

  • tor_process

    tor

Targets

    • Target

      RECEIPTUSD97.00.exe

    • Size

      1.0MB

    • MD5

      08e0f6fc015b6008f3d0e583c94c8772

    • SHA1

      ea87a156303f0cd82266734f7f9678faecffa18b

    • SHA256

      84e9426e79655328d7e51384cd16697772d5fa8043ef793e4777ec7e3c38c6d0

    • SHA512

      bf340c263cf3a4c1d1d58304ce921f228e2e20a70eef29322ee01894a5b7b68b5646fd800a3c4ea826472450195b7228166272b9afff750f057f8bcdd514a35c

    Score
    10/10
    bitratpersistencetrojan

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

      trojanbitrat

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks