Description
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
Document.exe
General
Target
Size
Sample
Document.exe
435KB
220112-wcvvnadecm
Score
10 /10
MD5
SHA1
SHA256
SHA512
12103b3952c09d930bf11af9df5b3ac4
914ec6513405dfe91192ed9ae2e82c9fe32c366a
4da51788f3414e7329cf4b720086550d686fa3d557c86b573a1eb0b218403c5f
a7c09de2b7d617b780238df68abf5d6c80b791af8da4d32eb56f96efe1c03cbb46c5332ed287dd8a32bd42f76d17b19b442bb854f3dbd03f80b3ebb377680064
Malware Config
Extracted
| Family | bitrat |
| Version | 1.38 |
| C2 |
covid1987.ddns.net:9090 |
| Attributes |
communication_password b4df9f494056d51f86c7f1a89850c467
tor_process tor |
Targets
Target
MD5
Filesize
Document.exe
12103b3952c09d930bf11af9df5b3ac4
435KB
Score
10/10
SHA1
SHA256
SHA512
914ec6513405dfe91192ed9ae2e82c9fe32c366a
4da51788f3414e7329cf4b720086550d686fa3d557c86b573a1eb0b218403c5f
a7c09de2b7d617b780238df68abf5d6c80b791af8da4d32eb56f96efe1c03cbb46c5332ed287dd8a32bd42f76d17b19b442bb854f3dbd03f80b3ebb377680064
Tags
Signatures
-
BitRAT
-
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
Description
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
Tags
-
Downloads MZ/PE file
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Tasks