General

  • Target

    SecuriteInfo.com.Trojan.DownLoader44.60226.4890.20245

  • Size

    1.1MB

  • Sample

    220518-n5tt3acbhl

  • MD5

    9470b7c60f200376fbfbb74e587d8c51

  • SHA1

    f86c90f8d03f2bc6ecf049aecf5ce24ae8022b86

  • SHA256

    a3137a5eb92a73b35bb269d973ad2f7354f33ce6992d67e9b550c3105d1b962c

  • SHA512

    fd9b8e3197a60c46c15c130ad8cca74aa973892837b54a3612442be27fa3a98e2d45889c1350300f4f3d2a8b93cde3cd5b1b5e733e7492f09cf6a44637d7b459

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

oka.nerdpol.ovh:2223

Attributes
  • communication_password

    b6c6e855edf908ec7c12ce8c8e628a5c

  • tor_process

    tor

Targets

    • Target

      SecuriteInfo.com.Trojan.DownLoader44.60226.4890.20245

    • Size

      1.1MB

    • MD5

      9470b7c60f200376fbfbb74e587d8c51

    • SHA1

      f86c90f8d03f2bc6ecf049aecf5ce24ae8022b86

    • SHA256

      a3137a5eb92a73b35bb269d973ad2f7354f33ce6992d67e9b550c3105d1b962c

    • SHA512

      fd9b8e3197a60c46c15c130ad8cca74aa973892837b54a3612442be27fa3a98e2d45889c1350300f4f3d2a8b93cde3cd5b1b5e733e7492f09cf6a44637d7b459

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • XenArmor Suite

      XenArmor is as suite of password recovery tools for various application.

    • suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

      suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Adds Run key to start application

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks