Overview

overview

10

Static

static

COMPARECEN...2..exe

windows7-x64

10

COMPARECEN...2..exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    COMPARECENCIA PROCESO SPOA 008694194690952113 y 0500169840525332212..exe

  • Size

    3.3MB

  • Sample

    220829-xfl8csddgq

  • MD5

    a4446e6395532a34c37e74d32b6b0125

  • SHA1

    9d6842a99065b3b3eab946cba363e87a50be8094

  • SHA256

    89668ca5da2a472ae00400d95799acf068585d5f5e3028c0b10fa3d71187e80b

  • SHA512

    bc35983386eb619e19ec89106db7f47d01408384986a92a919c985e53d977dc2258836948612bd0f842067f2f50fa2845e71421a884797f92049ce1e2368086f

  • SSDEEP

    98304:EkeKZHb1fAabLHdA9qpwTAAvXF71C8ckiw/:G+BAqLH6q6TrF71hpiw/

Score
10/10
bitratpersistencetrojanupx

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

benditodios.con-ip.com:3005

Attributes
  • communication_password

    202cb962ac59075b964b07152d234b70

  • tor_process

    tor

Targets

    • Target

      COMPARECENCIA PROCESO SPOA 008694194690952113 y 0500169840525332212..exe

    • Size

      3.3MB

    • MD5

      a4446e6395532a34c37e74d32b6b0125

    • SHA1

      9d6842a99065b3b3eab946cba363e87a50be8094

    • SHA256

      89668ca5da2a472ae00400d95799acf068585d5f5e3028c0b10fa3d71187e80b

    • SHA512

      bc35983386eb619e19ec89106db7f47d01408384986a92a919c985e53d977dc2258836948612bd0f842067f2f50fa2845e71421a884797f92049ce1e2368086f

    • SSDEEP

      98304:EkeKZHb1fAabLHdA9qpwTAAvXF71C8ckiw/:G+BAqLH6q6TrF71hpiw/

    Score
    10/10
    bitratpersistencetrojanupx

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

      trojanbitrat

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks