Overview

overview

10

Static

static

Document.exe

windows7-x64

1

Document.exe

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Document.exe

  • Size

    986KB

  • Sample

    220726-tymp3abeej

  • MD5

    9bfee233b1eb08709245723a8a67bd58

  • SHA1

    d2e1024fe896e61f3256ea1980fbdb34b493e959

  • SHA256

    3ca3364bacc38346dd777c8f90de705fd01c008161c4d1fa149ccf1b6205bbfb

  • SHA512

    9c8818c7694616130318f9b854d09777c6168c7c5d19d83269de4cbb22f6e60da081337bc0bb7eda9c9e52c171bbda1cda3959fa2a7e5001674bdaabc2972afd

Score
10/10
bitratmodiloaderpersistencetrojan

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

leaflet304.casacam.net:9090

Attributes
  • communication_password

    b4df9f494056d51f86c7f1a89850c467

  • tor_process

    tor

Targets

    • Target

      Document.exe

    • Size

      986KB

    • MD5

      9bfee233b1eb08709245723a8a67bd58

    • SHA1

      d2e1024fe896e61f3256ea1980fbdb34b493e959

    • SHA256

      3ca3364bacc38346dd777c8f90de705fd01c008161c4d1fa149ccf1b6205bbfb

    • SHA512

      9c8818c7694616130318f9b854d09777c6168c7c5d19d83269de4cbb22f6e60da081337bc0bb7eda9c9e52c171bbda1cda3959fa2a7e5001674bdaabc2972afd

    Score
    10/10
    bitratmodiloaderpersistencetrojan

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

      trojanbitrat

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks