Overview

overview

10

Static

static

COMPENSAR ...ON.exe

windows7-x64

1

COMPENSAR ...ON.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    COMPENSAR CAJA DE COMPENSION.exe

  • Size

    1.1MB

  • Sample

    221012-pe7hxaddhk

  • MD5

    b01493fb1cefb476e5bbf97c29ebe6d6

  • SHA1

    7099e9dd3b0d80fe7124c472e047a197e1059806

  • SHA256

    2872ca3484a8648e82cd5563c9d40c6445752786b051e7457745244703415198

  • SHA512

    9f0657ad445619276ed08f697687310d757f132074ded3061bfa3cc43e630fa5679efd9c4742edfa10f998715c9629270b9e6486bdfbe6aa83335802d8ca2ccd

  • SSDEEP

    24576:GE71UCbOvs1lhp0ZrRz/+Fg3wJtyhCWjlfkUE59jbjv:V1UCp4xB/M7zyRjlsUE5Bfv

Score
10/10
bitratpersistencetrojanupx

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

bendicioneees.con-ip.com:7777

Attributes
  • communication_password

    202cb962ac59075b964b07152d234b70

  • tor_process

    tor

Targets

    • Target

      COMPENSAR CAJA DE COMPENSION.exe

    • Size

      1.1MB

    • MD5

      b01493fb1cefb476e5bbf97c29ebe6d6

    • SHA1

      7099e9dd3b0d80fe7124c472e047a197e1059806

    • SHA256

      2872ca3484a8648e82cd5563c9d40c6445752786b051e7457745244703415198

    • SHA512

      9f0657ad445619276ed08f697687310d757f132074ded3061bfa3cc43e630fa5679efd9c4742edfa10f998715c9629270b9e6486bdfbe6aa83335802d8ca2ccd

    • SSDEEP

      24576:GE71UCbOvs1lhp0ZrRz/+Fg3wJtyhCWjlfkUE59jbjv:V1UCp4xB/M7zyRjlsUE5Bfv

    Score
    10/10
    bitratpersistencetrojanupx

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

      trojanbitrat

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks