bitrat | cb24ed92a870498ac3f974711a6894ff0f89d4efa1eb3c0c7d90a8554754f99f | Triage

Sharing

General

Target

PAYMENT ADVISE PO#N-R2630005JULY.exe
Size

463KB
Sample

220727-wxlgqacah3
MD5

68ca13260b23abea2b5a97cc12a2819a
SHA1

396996761ea6febc579113d0abc3436aa7f74bb3
SHA256

cb24ed92a870498ac3f974711a6894ff0f89d4efa1eb3c0c7d90a8554754f99f
SHA512

a5db697dd597ebe64cc5a8a1e877a690e90e280ca7c119f04057e91d147450076c9e658a4c6d02bfe36199c20d635ceafb30d1191b587ea10386db2222c6c6e5

Score

10^/10

bitrat persistence trojan

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

103.153.79.240:1234

Attributes

communication_password
e10adc3949ba59abbe56e057f20f883e
tor_process
tor

Targets

- Target
  
  PAYMENT ADVISE PO#N-R2630005JULY.exe
- Size
  
  463KB
- MD5
  
  68ca13260b23abea2b5a97cc12a2819a
- SHA1
  
  396996761ea6febc579113d0abc3436aa7f74bb3
- SHA256
  
  cb24ed92a870498ac3f974711a6894ff0f89d4efa1eb3c0c7d90a8554754f99f
- SHA512
  
  a5db697dd597ebe64cc5a8a1e877a690e90e280ca7c119f04057e91d147450076c9e658a4c6d02bfe36199c20d635ceafb30d1191b587ea10386db2222c6c6e5
Score

10^/10

bitrat persistence trojan
- BitRAT
  BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
  trojan bitrat
- Downloads MZ/PE file
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

bitratpersistencetrojan

behavioral2

bitratpersistencetrojan