bitrat | 400000[.]RegAsm[.]exe | Triage

Sharing

General

Target

400000.RegAsm.exe
Size

3.9MB
MD5

02afc72fc176a68f540ae180af27fac9
SHA1

554cf102b225f9cc8d2212dee27a951138135607
SHA256

a440892ae01cf1d2dee0d644b9d8aa944f5dec3e332e839bcefb30dfaacf7ed9
SHA512

6553f78e6f4812b4df5e69233588ff1e9b450801f2ea00f4f0f1ba3d030c15fb0b6aea5b49cf4a9fefa59253c5d1360af1c09583efecfc5845cacb4a8008934a
SSDEEP

98304:577Pmq33rE/JDLPWZADUGer7B6iY74M/GmlwXVZ:1+R/eZADUXR

Score

10^/10

upx bitrat

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

bitrat9300.duckdns.org:9300

Attributes

communication_password
e10adc3949ba59abbe56e057f20f883e
tor_process
tor

Signatures

Bitrat family
bitrat
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
upx

Processes:

resource yara_rule

sample upx

Files

400000.RegAsm.exe
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

UPX1
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

UPX2
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE