Overview

overview

10

Static

static

DC00243489...54.exe

windows7-x64

1

DC00243489...54.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DC0024348946451098454893973456554.exe

  • Size

    1.3MB

  • Sample

    220920-m1lr8agden

  • MD5

    1598e326811ac9fe268fffdeb60bd794

  • SHA1

    b358cc284c1260e00fdc285e274e88d27640d283

  • SHA256

    fde2dc52ebdaed66a83bab13b5509981d7169984936e2a92f6a00a14ea442e9b

  • SHA512

    50cd0eb64b99ace768c81e77969f94e3318a522517ce9f205e6a2436f937d7058a3a7d11e0981f030890826a95483363fbeeb09ca54819d17763b344367df213

  • SSDEEP

    24576:ViSNEArpn8J96cFW8KWS8JJa0UGdDywCYNmb:Vic1dn696YZKWSEJa07rCYsb

Score
10/10
bitratpersistencetrojanupx

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

bendicion777.con-ip.com:7777

Attributes
  • communication_password

    202cb962ac59075b964b07152d234b70

  • tor_process

    tor

Targets

    • Target

      DC0024348946451098454893973456554.exe

    • Size

      1.3MB

    • MD5

      1598e326811ac9fe268fffdeb60bd794

    • SHA1

      b358cc284c1260e00fdc285e274e88d27640d283

    • SHA256

      fde2dc52ebdaed66a83bab13b5509981d7169984936e2a92f6a00a14ea442e9b

    • SHA512

      50cd0eb64b99ace768c81e77969f94e3318a522517ce9f205e6a2436f937d7058a3a7d11e0981f030890826a95483363fbeeb09ca54819d17763b344367df213

    • SSDEEP

      24576:ViSNEArpn8J96cFW8KWS8JJa0UGdDywCYNmb:Vic1dn696YZKWSEJa07rCYsb

    Score
    10/10
    bitratpersistencetrojanupx

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

      trojanbitrat

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks