Overview

overview

10

Static

static

LBOYSFOW.exe

windows7-x64

10

LBOYSFOW.exe

windows10-2004-x64

10

Resubmissions

04-11-2022 16:57

221104-vf8egsghh6 10

04-11-2022 15:58

221104-tetn9sgeh7 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dhl_9327632.img

  • Size

    1.6MB

  • Sample

    221104-tetn9sgeh7

  • MD5

    d905582d8bec5441c0573899f57851f2

  • SHA1

    e1df528d6cb1bc5941db97be93cd869bb7632221

  • SHA256

    6197643d77b417a069ccbc742e2d4d740a6e1d8878328797795f1f93dbc80fac

  • SHA512

    ef1de865ddcdab30b82a630d640f0046e072fce082b066dac6d26fd6ce8ba595c0abc95df298f600873bba0fbef05116a6193358da19fd588450cbb4ab9f158a

  • SSDEEP

    24576:6Ik11alpxKYvIOWdB6yfgb8SDxOTeCYSfI5b2sJxHJHtuSCg/c3kCv/oMw2n+OkX:6fQnyf1dA

Score
10/10
bitratmodiloaderpersistencetrojanupx

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

davidmanne.casacam.net:2223

Attributes
  • communication_password

    b6c6e855edf908ec7c12ce8c8e628a5c

  • tor_process

    tor

Targets

    • Target

      LBOYSFOW.EXE

    • Size

      1.1MB

    • MD5

      b6211b4885b55082836497b0de3e669e

    • SHA1

      2d43a7310b06a3b5dc71c7d393eca6361a9a48ef

    • SHA256

      ad3b106fafc9cbbcc00766e2f68aac4b963312092a3a3cce1aa325348b9824e6

    • SHA512

      87d438d078ca18ba828577a2403ee2e3860edffea9b89fcd54cf7586272a989dfe7af4761b2c4a10b6800d77bd5566155cecddee094fca465c120b1d4154810a

    • SSDEEP

      24576:wIk11alpxKYvIOWdB6yfgb8SDxOTeCYSfI5b2sJxHJHtuSCg/c3kCv/oMw2n+OkX:wfQnyf1dA

    Score
    10/10
    modiloadertrojanbitratpersistenceupx

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

      trojanbitrat

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks