Overview

overview

10

Static

static

iprigk.exe

windows7-x64

10

iprigk.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    iprigk.exe

  • Size

    4.3MB

  • Sample

    220902-g55s1abge8

  • MD5

    0f436d1b40cc8da71989b597951ae61c

  • SHA1

    eb697a163bf73ee475c93e916bfaf90de40dd422

  • SHA256

    1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa

  • SHA512

    489c4b07fbf28921d22adfe6429e56fb70b8503ad9cde21991923bc54ee5ec78675c94185773bbabc166221b731f1e9335f59ce92113769e9d0f4becc800516e

  • SSDEEP

    98304:tmlSoZ5WrocGLpYHgyRWSJfSD8xipKbgo9PIs4qSoNMLmUzv:IlR5jcG+AyRWSJNceeLlT

Score
10/10
bitrattrojan

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

163.123.143.143:3569

Attributes
  • communication_password

    ce952068942604a6d6df06ed5002fad6

  • tor_process

    tor

Targets

    • Target

      iprigk.exe

    • Size

      4.3MB

    • MD5

      0f436d1b40cc8da71989b597951ae61c

    • SHA1

      eb697a163bf73ee475c93e916bfaf90de40dd422

    • SHA256

      1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa

    • SHA512

      489c4b07fbf28921d22adfe6429e56fb70b8503ad9cde21991923bc54ee5ec78675c94185773bbabc166221b731f1e9335f59ce92113769e9d0f4becc800516e

    • SSDEEP

      98304:tmlSoZ5WrocGLpYHgyRWSJfSD8xipKbgo9PIs4qSoNMLmUzv:IlR5jcG+AyRWSJNceeLlT

    Score
    10/10
    bitrattrojan

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

      trojanbitrat

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks