Overview

overview

10

Static

static

10

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad

  • Size

    1.4MB

  • Sample

    220802-v4g77saegm

  • MD5

    44e041dc2e445fcd33cc89b8453d0539

  • SHA1

    99faf5ac243f30d7041e7018f41490023b552f60

  • SHA256

    707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad

  • SHA512

    893019fd4b969250464a551bdeb0fc050da5bc82f1680b5ef116e8cc43b2e0b4088ec351f91d0d4b379ffd61fb32a02a34ea11fb94ca35fc4ed064dda021bf18

Score
10/10
bitratevasiontrojanupx

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

trotox.duckdns.org:55441

Attributes
  • communication_password

    4b49ee1f55b1900518dfb23fd2d7c702

  • tor_process

    tor

Targets

    • Target

      707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad

    • Size

      1.4MB

    • MD5

      44e041dc2e445fcd33cc89b8453d0539

    • SHA1

      99faf5ac243f30d7041e7018f41490023b552f60

    • SHA256

      707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad

    • SHA512

      893019fd4b969250464a551bdeb0fc050da5bc82f1680b5ef116e8cc43b2e0b4088ec351f91d0d4b379ffd61fb32a02a34ea11fb94ca35fc4ed064dda021bf18

    Score
    10/10
    bitratevasiontrojanupx

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

      trojanbitrat

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Modifies security service

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

2
T1031

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Disabling Security Tools

1
T1089

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks