Resubmissions

14-09-2022 16:15

220914-tqmp4aage7 10

General

  • Target

    https://github.com/genekolgav/kpk/raw/main/

  • Sample

    220914-tqmp4aage7

Score
10/10

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

bit100.accesscam.org:9090

Attributes
  • communication_password

    81dc9bdb52d04dc20036dbd8313ed055

  • tor_process

    tor

Targets

    • Target

      https://github.com/genekolgav/kpk/raw/main/

    Score
    10/10
    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    • Downloads MZ/PE file

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v6

Tasks