Behavioral task
behavioral1
Sample
4540-139-0x0000000000400000-0x00000000007CE000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4540-139-0x0000000000400000-0x00000000007CE000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
4540-139-0x0000000000400000-0x00000000007CE000-memory.dmp
-
Size
3.8MB
-
MD5
54402ff06786384cb7c0496b912085a0
-
SHA1
e124e75d6a6a1006e507351f787b101f5e84e57c
-
SHA256
bc7291a932bb48c9db0f8db228245257ecff8e72a307299a9682d279ec82425e
-
SHA512
26b25277c73de5263e00062719be59f178e565720f63c90ef20be976ca08c81728cd065e67f6e2d83ab14b19efc8fa04982fa3d7de2af18094cc490154607bfa
-
SSDEEP
98304:877Pmq33rE/JDLPWZADUGer7B6iY74M/AmlwXVZaFB:K+R/eZADUXR
Malware Config
Extracted
bitrat
1.38
103.125.190.185:1234
-
communication_password
827ccb0eea8a706c4c34a16891f84e7b
-
tor_process
tor
Signatures
-
Bitrat family
Files
-
4540-139-0x0000000000400000-0x00000000007CE000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 2.9MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 687KB - Virtual size: 686KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 72KB - Virtual size: 103KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 146KB - Virtual size: 146KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ