General

  • Target

    d96de808e92e4d42e93180be95ec52fbe490c506cd839365e71cb7168df6bfbd.ps1

  • Size

    3.6MB

  • Sample

    220119-slaz3abab3

  • MD5

    bdfc70e3237617d7a4509e9a857234eb

  • SHA1

    7b1e093f630ded929fefe02c554d09a1a9d13c54

  • SHA256

    d96de808e92e4d42e93180be95ec52fbe490c506cd839365e71cb7168df6bfbd

  • SHA512

    5bdde5d55b60e7ba1fb448bf95dd45feb2936ebaf53f5a78fa8272b522836d21a884ec5db523d09605f565d382e0015ee055de1976a3093defcc162d43abd857

Score
10/10

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

learnatallcost2.ddns.net:9050

Attributes
  • communication_password

    4a3e00961a08879c34f91ca0070ea2f5

  • tor_process

    tor

Targets

    • Target

      d96de808e92e4d42e93180be95ec52fbe490c506cd839365e71cb7168df6bfbd.ps1

    • Size

      3.6MB

    • MD5

      bdfc70e3237617d7a4509e9a857234eb

    • SHA1

      7b1e093f630ded929fefe02c554d09a1a9d13c54

    • SHA256

      d96de808e92e4d42e93180be95ec52fbe490c506cd839365e71cb7168df6bfbd

    • SHA512

      5bdde5d55b60e7ba1fb448bf95dd45feb2936ebaf53f5a78fa8272b522836d21a884ec5db523d09605f565d382e0015ee055de1976a3093defcc162d43abd857

    Score
    10/10
    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks