Overview

overview

10

Static

static

Rad. 23001...00.exe

windows7-x64

10

Rad. 23001...00.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Rad. 23001410500120210054200.exe

  • Size

    3.4MB

  • Sample

    220824-lqe19acfg4

  • MD5

    d0fe1061080757596c0ccf4858116d4e

  • SHA1

    73f413d110487f600adbc5ec976ffdbbae99528c

  • SHA256

    d00aca8df4e7efc0650d5deedc63b8638570ff9ffc9899e6b35ef67bfa434d58

  • SHA512

    0f5a6fa2cb295765ffcee1615966a5357c1ff859c105c43cd0d4725e6265abf7f6e91dd80d9ca0b234b603d095d5eff8eda2bcebbe18823ac327e1ebe2d91ef6

  • SSDEEP

    98304:HBe/eBAdHiL+BL1RctSmUfzGfLfvfoHMDfGzgav1Y6eNLcTopndyPL7:MeadHiL+BLWSmUfzGfLfvfoLzF6VckJO

Score
10/10
bitratpersistencetrojanupx

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

moneymaker.con-ip.com:3005

Attributes
  • communication_password

    202cb962ac59075b964b07152d234b70

  • tor_process

    tor

Targets

    • Target

      Rad. 23001410500120210054200.exe

    • Size

      3.4MB

    • MD5

      d0fe1061080757596c0ccf4858116d4e

    • SHA1

      73f413d110487f600adbc5ec976ffdbbae99528c

    • SHA256

      d00aca8df4e7efc0650d5deedc63b8638570ff9ffc9899e6b35ef67bfa434d58

    • SHA512

      0f5a6fa2cb295765ffcee1615966a5357c1ff859c105c43cd0d4725e6265abf7f6e91dd80d9ca0b234b603d095d5eff8eda2bcebbe18823ac327e1ebe2d91ef6

    • SSDEEP

      98304:HBe/eBAdHiL+BL1RctSmUfzGfLfvfoHMDfGzgav1Y6eNLcTopndyPL7:MeadHiL+BLWSmUfzGfLfvfoLzF6VckJO

    Score
    10/10
    bitratpersistencetrojanupx

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

      trojanbitrat

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks