Overview

overview

10

Static

static

10

6b42f40e4a...e5.exe

windows7_x64

10

6b42f40e4a...e5.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6b42f40e4ab8f5c0ba3020a38e52d42cec276685060d41e2805f66869ff587e5

  • Size

    3.7MB

  • Sample

    220630-vq7kyaddhq

  • MD5

    a202bac1697b6255bf5bfdf0cce9aaa6

  • SHA1

    fe0327a7a122a1086ed8cfc288e9c6716affbf69

  • SHA256

    6b42f40e4ab8f5c0ba3020a38e52d42cec276685060d41e2805f66869ff587e5

  • SHA512

    5f553747bc52a8b5e55d146f9731ecd606147c7d8f3c03ac9a5903728c2c8af26f8987e9defaa67e743346eaa1aefc14df2c5e2b03b341966c38f51cb32964f7

Score
10/10
bitratpersistencetrojan

Malware Config

Extracted

Family

bitrat

Version

1.33

C2

qwerty:4444

Attributes
  • communication_password

    827ccb0eea8a706c4c34a16891f84e7b

  • install_dir

    dfgh

  • install_file

    rftgh.exe

  • tor_process

    tor

Targets

    • Target

      6b42f40e4ab8f5c0ba3020a38e52d42cec276685060d41e2805f66869ff587e5

    • Size

      3.7MB

    • MD5

      a202bac1697b6255bf5bfdf0cce9aaa6

    • SHA1

      fe0327a7a122a1086ed8cfc288e9c6716affbf69

    • SHA256

      6b42f40e4ab8f5c0ba3020a38e52d42cec276685060d41e2805f66869ff587e5

    • SHA512

      5f553747bc52a8b5e55d146f9731ecd606147c7d8f3c03ac9a5903728c2c8af26f8987e9defaa67e743346eaa1aefc14df2c5e2b03b341966c38f51cb32964f7

    Score
    10/10
    bitratpersistencetrojan

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

      trojanbitrat

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks