Overview

overview

10

Static

static

8295042594.zip

windows7-x64

1

8295042594.zip

windows10-2004-x64

1

099afcdcf5...b1.exe

windows7-x64

10

099afcdcf5...b1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8295042594.zip

  • Size

    1.8MB

  • Sample

    221104-xrsvaaabc8

  • MD5

    fff453c66a67f6b348aa170b55a0dba4

  • SHA1

    36dd470bb60fc04f6d7d87a5ed4183bce68ab1e8

  • SHA256

    cd071b60449984568f35670bcb89e4988f6532be7e6087c9ce7021bc0cc49a56

  • SHA512

    eba28dc12071a339abd5e483d0101a8bc9b4266200bf767ee0c0984baa10ca988e965e5e87781434a14d4d1eeb5870f89d2498a541faeda3d521cdcf8c545d41

  • SSDEEP

    24576:ljezx1OYvtA83GBsP6cKh38Sr0mtD03HOSrSG8IYg/8KID7Y+HaPUxENnhegiI78:Qt1O0isPVg3P03lfIDMxhYMGSg

Score
10/10
bitrattrojanupx

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

bitrat6060.duckdns.org:6060

Attributes
  • communication_password

    e10adc3949ba59abbe56e057f20f883e

  • tor_process

    tor

Targets

    • Target

      8295042594.zip

    • Size

      1.8MB

    • MD5

      fff453c66a67f6b348aa170b55a0dba4

    • SHA1

      36dd470bb60fc04f6d7d87a5ed4183bce68ab1e8

    • SHA256

      cd071b60449984568f35670bcb89e4988f6532be7e6087c9ce7021bc0cc49a56

    • SHA512

      eba28dc12071a339abd5e483d0101a8bc9b4266200bf767ee0c0984baa10ca988e965e5e87781434a14d4d1eeb5870f89d2498a541faeda3d521cdcf8c545d41

    • SSDEEP

      24576:ljezx1OYvtA83GBsP6cKh38Sr0mtD03HOSrSG8IYg/8KID7Y+HaPUxENnhegiI78:Qt1O0isPVg3P03lfIDMxhYMGSg

    Score
    1/10
    behavioral1behavioral2

    • Target

      099afcdcf586e43f851a0a63d12328f5a44884a711c61c8679a693bd239d51b1

    • Size

      300.0MB

    • MD5

      1420cfc2bea47d52a937fbea0415baa8

    • SHA1

      8d4ea7755d633dc9cd2f721d951fc17bdf5346d6

    • SHA256

      099afcdcf586e43f851a0a63d12328f5a44884a711c61c8679a693bd239d51b1

    • SHA512

      3546d9569ea5f6d891c42e5e805041fc288fcd78943dee2eef251cd52de1910213cfbe2d71e7386fa3d40d5a27ac3de39293e4e05487113b7cbd32c2dd3bb0c7

    • SSDEEP

      24576:C5gfuhMt53oiTyVl7gyCPUmj15wlutqzKn4QpeuCdEz9aJ3bxKui0HpzYU0:C5+IUbGcq0hz9o3bkj2U

    Score
    10/10
    bitrattrojanupx

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

      trojanbitrat

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Uses the VBS compiler for execution

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral3behavioral4

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Scripting

1
T1064

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks