Overview

overview

10

Static

static

b9a3263925...bb.exe

windows7_x64

9

b9a3263925...bb.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b9a32639253da00c2d4492a0a3eb27bb

  • Size

    13KB

  • Sample

    220715-etnz1agea5

  • MD5

    b9a32639253da00c2d4492a0a3eb27bb

  • SHA1

    36a6c1e4e78ffb7f780e0e358697161ff3e1d1e7

  • SHA256

    7f02c324628efbcf77728cc16953e89a017ec4d9376a04e22ae5c4adb7a6b0af

  • SHA512

    8c551d077be936d9d17ef8909cc881fe608dd2f026a0b5a804cb3446f810ac132965649fd3790f646cfe28d10177d31f81307c76712d20a4509f57eb0014c4c9

Score
10/10
bitratdiscoverypersistencesuricatatrojanupx

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

62.210.55.136:3566

Attributes
  • communication_password

    3083202a936b7d0ef8b680d7ae73fa1a

  • tor_process

    tor

Targets

    • Target

      b9a32639253da00c2d4492a0a3eb27bb

    • Size

      13KB

    • MD5

      b9a32639253da00c2d4492a0a3eb27bb

    • SHA1

      36a6c1e4e78ffb7f780e0e358697161ff3e1d1e7

    • SHA256

      7f02c324628efbcf77728cc16953e89a017ec4d9376a04e22ae5c4adb7a6b0af

    • SHA512

      8c551d077be936d9d17ef8909cc881fe608dd2f026a0b5a804cb3446f810ac132965649fd3790f646cfe28d10177d31f81307c76712d20a4509f57eb0014c4c9

    Score
    10/10
    discoverybitratpersistencesuricatatrojanupx

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

      trojanbitrat

    • suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

      suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

      suricata

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks