Overview

overview

10

Static

static

No. 084846...54.exe

windows7-x64

10

No. 084846...54.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    No. 084846841890405108198901510854.exe

  • Size

    4.3MB

  • Sample

    220831-hkz8fsadel

  • MD5

    bb92db09f340086e56d2d52b92433cfa

  • SHA1

    ffa73080e2df83527da723abb87e578058e480c1

  • SHA256

    bf52209b7528e1583f14e3fb84ef1488a704c996473881c7aae10ecc4568b49c

  • SHA512

    4d17643d08f27bfab083d15db6b5dbb88d07b436048001acbdb4e1c0a8c1a35e286aa9b8c88acb3984dca1c66bed5e4813ad77552ac8c551cfea85d03c79c04e

  • SSDEEP

    98304:w2lzWEp7GWq47aDMn8MbSopmt0+UhIYCun7P+OKtkPd1B:tlCERGN4WMnhbSopmuIsn7PN

Score
10/10
bitratpersistencetrojanupx

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

bendito.con-ip.com:3005

Attributes
  • communication_password

    202cb962ac59075b964b07152d234b70

  • tor_process

    tor

Targets

    • Target

      No. 084846841890405108198901510854.exe

    • Size

      4.3MB

    • MD5

      bb92db09f340086e56d2d52b92433cfa

    • SHA1

      ffa73080e2df83527da723abb87e578058e480c1

    • SHA256

      bf52209b7528e1583f14e3fb84ef1488a704c996473881c7aae10ecc4568b49c

    • SHA512

      4d17643d08f27bfab083d15db6b5dbb88d07b436048001acbdb4e1c0a8c1a35e286aa9b8c88acb3984dca1c66bed5e4813ad77552ac8c551cfea85d03c79c04e

    • SSDEEP

      98304:w2lzWEp7GWq47aDMn8MbSopmt0+UhIYCun7P+OKtkPd1B:tlCERGN4WMnhbSopmuIsn7PN

    Score
    10/10
    bitratpersistencetrojanupx

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

      trojanbitrat

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks