General

  • Target

    8d44a736975543b4f5c40296fb1c1a2e42700861d95704fd224d42d73d475d78

  • Size

    174KB

  • Sample

    220512-n4yfvsdef6

  • MD5

    6b1bd2bb379d1a4e929ba32100b6acd3

  • SHA1

    7e575b77c856c49495f3cf3d3dc6b3340facb99b

  • SHA256

    8d44a736975543b4f5c40296fb1c1a2e42700861d95704fd224d42d73d475d78

  • SHA512

    8e8d033bb29dbc9b36278285a4e8655e54add7a51570b3e132cb1e0992e3753eb353eb6787cc9fcb56e2f4e79f382050063eea0cf949d9a9151c9c5eed2f8cd8

Malware Config

Targets

    • Target

      8d44a736975543b4f5c40296fb1c1a2e42700861d95704fd224d42d73d475d78

    • Size

      174KB

    • MD5

      6b1bd2bb379d1a4e929ba32100b6acd3

    • SHA1

      7e575b77c856c49495f3cf3d3dc6b3340facb99b

    • SHA256

      8d44a736975543b4f5c40296fb1c1a2e42700861d95704fd224d42d73d475d78

    • SHA512

      8e8d033bb29dbc9b36278285a4e8655e54add7a51570b3e132cb1e0992e3753eb353eb6787cc9fcb56e2f4e79f382050063eea0cf949d9a9151c9c5eed2f8cd8

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    • BitRAT Payload

    • Modifies WinLogon for persistence

    • Modifies Windows Defender Real-time Protection settings

    • Windows security bypass

    • Drops startup file

    • Windows security modification

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks