Overview

overview

10

Static

static

3a3c032d71...c7.exe

windows7_x64

10

3a3c032d71...c7.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3a3c032d71e9d97f17981bbef8e3d64fc0fe81f5fb8177f3f17dc2264ffd91c7

  • Size

    2.1MB

  • Sample

    220130-svttjadahl

  • MD5

    1b94152164f2fa88604d9942bd91addf

  • SHA1

    d25c0f37cb6e9d24301756fada9b6099f798e87d

  • SHA256

    3a3c032d71e9d97f17981bbef8e3d64fc0fe81f5fb8177f3f17dc2264ffd91c7

  • SHA512

    dc53d7a69b1320565d2e2fed0468246a5d34773ed6050121eede4ff25a26076d78bab2518c31e315ef5dcd582f23360a1d0415a243d22458813c3262b3c1cacf

Score
10/10
bitratpersistencetrojanupx

Malware Config

Extracted

Family

bitrat

Version

1.35

C2

publiquilla.linkpc.net:9097

Attributes
  • communication_password

    bfdba24ee3d61f0260c4dc1034c3ee43

  • install_dir

    System320772736e3b1d119b3

  • install_file

    System320772736e3b1d119b.exe

  • tor_process

    tor

Targets

    • Target

      3a3c032d71e9d97f17981bbef8e3d64fc0fe81f5fb8177f3f17dc2264ffd91c7

    • Size

      2.1MB

    • MD5

      1b94152164f2fa88604d9942bd91addf

    • SHA1

      d25c0f37cb6e9d24301756fada9b6099f798e87d

    • SHA256

      3a3c032d71e9d97f17981bbef8e3d64fc0fe81f5fb8177f3f17dc2264ffd91c7

    • SHA512

      dc53d7a69b1320565d2e2fed0468246a5d34773ed6050121eede4ff25a26076d78bab2518c31e315ef5dcd582f23360a1d0415a243d22458813c3262b3c1cacf

    Score
    10/10
    bitratpersistencetrojanupx

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

      trojanbitrat

    • CustAttr .NET packer

      Detects CustAttr .NET packer in memory.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks