Overview

overview

10

Static

static

8

F6SNA4S9KD...PT.exe

windows7_x64

10

F6SNA4S9KD...PT.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    F6SNA4S9KD7_ETRANSFER_RECEIPT.exe

  • Size

    1.4MB

  • Sample

    220607-s5xceaafe6

  • MD5

    54d506080b660a0eadb72f6a7ca8264e

  • SHA1

    c7dbd1c02b9153efd4e5f01816e18b5570c7b813

  • SHA256

    6628a8883987d342555b0e13f9795abdce26b0c9a739b7d13ff0bfc9affe6995

  • SHA512

    5883fa3aa9e1cb9904ef7c5870c1a7adbbc4410e7f6fe3970513e60b51defc03eaf39b369bf5857d99d52a158b2b1851fd8d0cf5cf73f9abb64425e634537825

Score
10/10
bitratsuricatatrojanupx

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

bitrat9300.duckdns.org:9300

Attributes
  • communication_password

    e10adc3949ba59abbe56e057f20f883e

  • tor_process

    tor

Targets

    • Target

      F6SNA4S9KD7_ETRANSFER_RECEIPT.exe

    • Size

      1.4MB

    • MD5

      54d506080b660a0eadb72f6a7ca8264e

    • SHA1

      c7dbd1c02b9153efd4e5f01816e18b5570c7b813

    • SHA256

      6628a8883987d342555b0e13f9795abdce26b0c9a739b7d13ff0bfc9affe6995

    • SHA512

      5883fa3aa9e1cb9904ef7c5870c1a7adbbc4410e7f6fe3970513e60b51defc03eaf39b369bf5857d99d52a158b2b1851fd8d0cf5cf73f9abb64425e634537825

    Score
    10/10
    bitratsuricatatrojanupx

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

      trojanbitrat

    • suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

      suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

      suricata

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks