Overview

overview

10

Static

static

FORMATO DE...65.exe

windows7-x64

6

FORMATO DE...65.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    FORMATO DE PDF MG,236-5126-965.exe

  • Size

    1.1MB

  • Sample

    221012-p8epzsdec7

  • MD5

    c187130b77f9aeb18af72fe658582466

  • SHA1

    9f609910ec86ff5669335f53f126990b10f15c29

  • SHA256

    9d2266ca67855d7c3f117c22f47daf8b39eb95f0d6b3183e3939a47e39fb04d0

  • SHA512

    028fe42df22efff4318c2d74586b15449a7e00a2eff0d4350e991346bc6b7bbe155d3999cd3dd87801afdce9896b47ab117553a04242fcf8105606612f60a737

  • SSDEEP

    24576:TJ0tujytMxxLdlKQ0RrZ1eYFELA/ek1Eykn32TkVA6n:qujyMxJi18YI5qEyWy6n

Score
10/10
bitratdiscoverypersistencetrojanupx

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

verouvhisbdwdc.con-ip.com:1880

Attributes
  • communication_password

    202cb962ac59075b964b07152d234b70

  • tor_process

    tor

Targets

    • Target

      FORMATO DE PDF MG,236-5126-965.exe

    • Size

      1.1MB

    • MD5

      c187130b77f9aeb18af72fe658582466

    • SHA1

      9f609910ec86ff5669335f53f126990b10f15c29

    • SHA256

      9d2266ca67855d7c3f117c22f47daf8b39eb95f0d6b3183e3939a47e39fb04d0

    • SHA512

      028fe42df22efff4318c2d74586b15449a7e00a2eff0d4350e991346bc6b7bbe155d3999cd3dd87801afdce9896b47ab117553a04242fcf8105606612f60a737

    • SSDEEP

      24576:TJ0tujytMxxLdlKQ0RrZ1eYFELA/ek1Eykn32TkVA6n:qujyMxJi18YI5qEyWy6n

    Score
    10/10
    discoverybitratpersistencetrojanupx

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

      trojanbitrat

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Network Service Scanning

1
T1046

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks