General
-
Target
28854f11be752dcc0747681d6bc453b60bcb9cd9ce81c61280c434ea468cc1f9
-
Size
2.0MB
-
Sample
220512-n1r5nsgben
-
MD5
90566a56f87cbb3de3ee406a8031a089
-
SHA1
5f37a415bc489f03e734b1447ee844e5b2df0822
-
SHA256
28854f11be752dcc0747681d6bc453b60bcb9cd9ce81c61280c434ea468cc1f9
-
SHA512
94794faab87f8e1ddf6b3867330d79010e2e06c61b3816e1984c8c047144f4d7ee4ed02d1c5f6f466a10f26498cd508f8413a1570058e47d94b326e15978ff79
Static task
static1
Behavioral task
behavioral1
Sample
28854f11be752dcc0747681d6bc453b60bcb9cd9ce81c61280c434ea468cc1f9.exe
Resource
win7-20220414-en
Malware Config
Targets
-
-
Target
28854f11be752dcc0747681d6bc453b60bcb9cd9ce81c61280c434ea468cc1f9
-
Size
2.0MB
-
MD5
90566a56f87cbb3de3ee406a8031a089
-
SHA1
5f37a415bc489f03e734b1447ee844e5b2df0822
-
SHA256
28854f11be752dcc0747681d6bc453b60bcb9cd9ce81c61280c434ea468cc1f9
-
SHA512
94794faab87f8e1ddf6b3867330d79010e2e06c61b3816e1984c8c047144f4d7ee4ed02d1c5f6f466a10f26498cd508f8413a1570058e47d94b326e15978ff79
-
BitRAT Payload
-
Drops startup file
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-