General
-
Target
NWASW.exe
-
Size
1.4MB
-
Sample
220414-qa3vlahfek
-
MD5
f50b3a031cb4b833464495e0241bda98
-
SHA1
54c66169986c8a238aa0e6cf5fb537e31a9f716a
-
SHA256
8a5492235174eed38c4ed85ce6a13f0076cb73c50fb8f1cad704551403a85e63
-
SHA512
37b27936616e0d3d4a7cc395896da6c21f6a2412e789ee48ee53fe0521f5ee65acf7b3b8ea602ec6aab0fe2cd52a927fb054c6e2a20624d6512e0f99a809c562
Behavioral task
behavioral1
Sample
NWASW.exe
Resource
win7-20220331-en
Behavioral task
behavioral2
Sample
NWASW.exe
Resource
win10v2004-20220310-en
Malware Config
Extracted
bitrat
1.38
zopp.nerdpol.ovh:2222
-
communication_password
653d716345d8915046b904b90f41f271
-
tor_process
tor
Targets
-
-
Target
NWASW.exe
-
Size
1.4MB
-
MD5
f50b3a031cb4b833464495e0241bda98
-
SHA1
54c66169986c8a238aa0e6cf5fb537e31a9f716a
-
SHA256
8a5492235174eed38c4ed85ce6a13f0076cb73c50fb8f1cad704551403a85e63
-
SHA512
37b27936616e0d3d4a7cc395896da6c21f6a2412e789ee48ee53fe0521f5ee65acf7b3b8ea602ec6aab0fe2cd52a927fb054c6e2a20624d6512e0f99a809c562
Score10/10-
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-