bitrat

General

Target

DHL_924820.IMG
Size

1.2MB
Sample

221024-sln7pahdcr
MD5

cfda7c0d5667f6a214cf4996e5efde92
SHA1

7a6ed5160addc9e203696ccdaa5efc112710133a
SHA256

bf260ff15e0a10357980937576f516a75d209be93fdfe6852dc0f8cb5be34024
SHA512

792c436d175b0eb3fec94f9d09503737ed66001b99d2a30065852a135e5aeb3e0faa36444a494148e7ad4c81d952f55ede4facdf843c01f8ad55b004df23d6de
SSDEEP

12288:3FwXm1eLcZbP9mpAmFXZ5e0mvXTeYZITtsUXHvxwUxLfHazzJr0:3FGQeabFmKmFzhmvJWuMPB

Score

10^/10

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

davidmanne.casacam.net:2223

Attributes

communication_password
b6c6e855edf908ec7c12ce8c8e628a5c
tor_process
tor

Targets

- Target
  
  DHL_924820.IMG
- Size
  
  1.2MB
- MD5
  
  cfda7c0d5667f6a214cf4996e5efde92
- SHA1
  
  7a6ed5160addc9e203696ccdaa5efc112710133a
- SHA256
  
  bf260ff15e0a10357980937576f516a75d209be93fdfe6852dc0f8cb5be34024
- SHA512
  
  792c436d175b0eb3fec94f9d09503737ed66001b99d2a30065852a135e5aeb3e0faa36444a494148e7ad4c81d952f55ede4facdf843c01f8ad55b004df23d6de
- SSDEEP
  
  12288:3FwXm1eLcZbP9mpAmFXZ5e0mvXTeYZITtsUXHvxwUxLfHazzJr0:3FGQeabFmKmFzhmvJWuMPB
Score

3^/10
behavioral1 behavioral2
- Target
  
  JWBHBWZC.EXE
- Size
  
  747KB
- MD5
  
  f90bac73be91d5143bdb0b2b2898c6b0
- SHA1
  
  fdf005d2ef50d1bce66dec6f5ddc625dbd97fdaa
- SHA256
  
  2193931688547621ee5c9ec01922784fb7d3ee91ff65f5f59db006b97c5a0d7a
- SHA512
  
  9459cdc9c3774f9d25006172fbbe6fd2ffffdb792b4b0c1bf379579e5a8a258a5bd5c9cdb903ad8bef5c1b38760ea7ac098a760ab619654420c89c07e3b75c04
- SSDEEP
  
  12288:QFwXm1eLcZbP9mpAmFXZ5e0mvXTeYZITtsUXHvxwUxLfHazzJr0:QFGQeabFmKmFzhmvJWuMPB
Score

10^/10

modiloader trojan bitrat xenarmor collection password persistence recovery spyware stealer upx
- BitRAT
  BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
  trojan bitrat
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- XenArmor Suite
  XenArmor is as suite of password recovery tools for various application.
  recovery password xenarmor
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- ModiLoader Second Stage
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Adds Run key to start application
  persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral3 behavioral4