General
-
Target
7822a580dc4b30e2314dcba289553943
-
Size
1.3MB
-
Sample
220721-zt98fsaegk
-
MD5
7822a580dc4b30e2314dcba289553943
-
SHA1
51134136b7028ef5f862d4c7f7a2ee2a86f30617
-
SHA256
01061f2fa35490bfbe6e773add480f3d5a4933ea333bf8a41f9f7e801d978c8c
-
SHA512
3109d453ff339c633eb70d7fde2c3cb3809dfd580c6863251082c2fbcb3b85cd1473ed0fea50bd64ca705d0088423d1e9a7e085a39cfce83ebede5aa23436e95
Static task
static1
Behavioral task
behavioral1
Sample
7822a580dc4b30e2314dcba289553943.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
7822a580dc4b30e2314dcba289553943.exe
Resource
win10v2004-20220721-en
Malware Config
Extracted
bitrat
1.38
markemoney.con-ip.com:3005
-
communication_password
202cb962ac59075b964b07152d234b70
-
tor_process
tor
Targets
-
-
Target
7822a580dc4b30e2314dcba289553943
-
Size
1.3MB
-
MD5
7822a580dc4b30e2314dcba289553943
-
SHA1
51134136b7028ef5f862d4c7f7a2ee2a86f30617
-
SHA256
01061f2fa35490bfbe6e773add480f3d5a4933ea333bf8a41f9f7e801d978c8c
-
SHA512
3109d453ff339c633eb70d7fde2c3cb3809dfd580c6863251082c2fbcb3b85cd1473ed0fea50bd64ca705d0088423d1e9a7e085a39cfce83ebede5aa23436e95
Score10/10-
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-