bitrat | NWASW[.]exe

General

Target
NWASW.exe
Size 1.4MB
Sample220414-qa3vlahfek
SHA256 8a5492235174eed38c4ed85ce6a13f0076cb73c50fb8f1cad704551403a85e63
MD5 f50b3a031cb4b833464495e0241bda98
SHA1 54c66169986c8a238aa0e6cf5fb537e31a9f716a
SHA512 37b27936616e0d3d4a7cc395896da6c21f6a2412e789ee48ee53fe0521f5ee65acf7b3b8ea602ec6aab0fe2cd52a927fb054c6e2a20624d6512e0f99a809c562
SSDEEP 24576:nndRKZCy2BrhCeU2i2cJijFbCBTPmiY05tJMSQp5ysA7Yg1nLkzmltp6vd:nXDFBU2iIBb0xY/6sUYYJn8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

upx bitrat

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

zopp.nerdpol.ovh:2222

Attributes

communication_password
653d716345d8915046b904b90f41f271
tor_process
tor

Signatures

Bitrat family
bitrat

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

File Explorer

NWASW.exe

.exe 1.4MB
out.upx

.exe 3.8MB

NWASW.exe

SHA256 8a5492235174eed38c4ed85ce6a13f0076cb73c50fb8f1cad704551403a85e63
MD5 f50b3a031cb4b833464495e0241bda98
SHA1 54c66169986c8a238aa0e6cf5fb537e31a9f716a
SHA512 37b27936616e0d3d4a7cc395896da6c21f6a2412e789ee48ee53fe0521f5ee65acf7b3b8ea602ec6aab0fe2cd52a927fb054c6e2a20624d6512e0f99a809c562
SSDEEP 24576:nndRKZCy2BrhCeU2i2cJijFbCBTPmiY05tJMSQp5ysA7Yg1nLkzmltp6vd:nXDFBU2iIBb0xY/6sUYYJn8
MD5 SHA1 SHA512 SSDEEP

windows x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

Minor OS version

Major OS version

Entry point

4073280

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

out.upx

SHA256 1705dee9c5b7319c929bba9a0b66d764cc752dd4d51556c59173d56069491165
MD5 1e5d0888cf4dd5e438d5debc92b9a009
SHA1 c9a5cb8bbc8c27d360499be1ae52dd594dcbf7ac
SHA512 1d923248333ca125d4640fba316d46498730fd858e87778a0e0d8e06868e0cef10b07e032aec9cc524fac2c5001b0905ec0c5032f8b6ec3dcc48b218c38c9a04
SSDEEP 98304:m77Pmq33rE/JDLPWZADUGer7B6iY74M/5mlwXVZ:Y+R/eZADUXR
MD5 SHA1 SHA512 SSDEEP

windows x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

Minor OS version

Major OS version

Entry point

2663560

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

687KB

Virtual Size

686KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

72KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

146KB

Virtual Size

146KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

NWASW.exe

out.upx