Overview

overview

10

Static

static

10

56a6e1328b...03.exe

windows7-x64

10

56a6e1328b...03.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    56a6e1328b678620db43ea513571ab2e0a5210d53f211967b7557b95d383d103

  • Size

    1.4MB

  • Sample

    220725-cjw7hsaebp

  • MD5

    cb74327798fbd255e6aa1ba041276ebc

  • SHA1

    204ee8f8e1781a6c57e75829f9b7236b04f10ebe

  • SHA256

    56a6e1328b678620db43ea513571ab2e0a5210d53f211967b7557b95d383d103

  • SHA512

    83eda079c3af13da9a5a9934ca9c5478a9deb3e9ae5ea8d7b94af26773e2b8e89a2ee3ce147bc2238772c4c643a076b33e83d49dd6aed020520ad032f110d621

Score
10/10
bitratpersistencetrojanupx

Malware Config

Extracted

Family

bitrat

Version

1.35

C2

193.142.146.202:1234

Attributes
  • communication_password

    25dc42ffa26487682593997bc5f19f5a

  • install_dir

    ServicesWS

  • install_file

    Services.exe

  • tor_process

    tor

Targets

    • Target

      56a6e1328b678620db43ea513571ab2e0a5210d53f211967b7557b95d383d103

    • Size

      1.4MB

    • MD5

      cb74327798fbd255e6aa1ba041276ebc

    • SHA1

      204ee8f8e1781a6c57e75829f9b7236b04f10ebe

    • SHA256

      56a6e1328b678620db43ea513571ab2e0a5210d53f211967b7557b95d383d103

    • SHA512

      83eda079c3af13da9a5a9934ca9c5478a9deb3e9ae5ea8d7b94af26773e2b8e89a2ee3ce147bc2238772c4c643a076b33e83d49dd6aed020520ad032f110d621

    Score
    10/10
    bitratpersistencetrojanupx

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

      trojanbitrat

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks