Overview

overview

10

Static

static

FORMATO DE...RO.exe

windows7-x64

10

FORMATO DE...RO.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    FORMATO DE REALIZACION DE CUENTA DE AHORRO.exe

  • Size

    3.4MB

  • Sample

    220906-vm4d4sgcg5

  • MD5

    fc8292e20e956e494064d005dd3cdf7d

  • SHA1

    36fcd3d13e53ae0757a4115cacd3123e983e8937

  • SHA256

    63ec772a57bb782428643ac0926ef9a26e5687c29994041be791a313f592055f

  • SHA512

    52d34aa67efe2cce73c2390cd00e942cc85dbf7dd3db2a1663d690f893d0a7e2263f07b2d89b8a7dc07aac4678a0b73ad72f3be855f12772f769fb5bdbb448ec

  • SSDEEP

    98304:2Jm1Yc2EzHm2yMMXCjhlJIqLz6L7lE/WGBg:2QfG2yVCVlJIgCEW

Score
10/10
bitrattrojanupx

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

grtgrnmwljenf.con-ip.com:1880

Attributes
  • communication_password

    202cb962ac59075b964b07152d234b70

  • tor_process

    tor

Targets

    • Target

      FORMATO DE REALIZACION DE CUENTA DE AHORRO.exe

    • Size

      3.4MB

    • MD5

      fc8292e20e956e494064d005dd3cdf7d

    • SHA1

      36fcd3d13e53ae0757a4115cacd3123e983e8937

    • SHA256

      63ec772a57bb782428643ac0926ef9a26e5687c29994041be791a313f592055f

    • SHA512

      52d34aa67efe2cce73c2390cd00e942cc85dbf7dd3db2a1663d690f893d0a7e2263f07b2d89b8a7dc07aac4678a0b73ad72f3be855f12772f769fb5bdbb448ec

    • SSDEEP

      98304:2Jm1Yc2EzHm2yMMXCjhlJIqLz6L7lE/WGBg:2QfG2yVCVlJIgCEW

    Score
    10/10
    bitrattrojanupx

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

      trojanbitrat

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks