Overview

overview

10

Static

static

10

0x00080000...82.exe

windows7-x64

10

0x00080000...82.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0x0008000000013199-82.dat

  • Size

    3.8MB

  • Sample

    221120-t9avmsed3x

  • MD5

    2bc19dd96b42cea3280eb5fe1e949b82

  • SHA1

    d4daeaa890659239a848d36b34e1c5b0d150c42f

  • SHA256

    6d654b2b1830638ac56fc0801f5898e61c05c6237d007e7b4d326930e38fa205

  • SHA512

    e57a71956cab498c6d6bd4af448a3360ea13b749900d1e656904dfb5a7edb19f236a19bf72282bdc750f8bfb0148734083e6877afd4ad95c27616d207458dd1b

  • SSDEEP

    98304:d77Pmq33rE/JDLPWZADUGer7B6iY74M/qmlwXVZ4FB:5+R/eZADUXR

Score
10/10
bitratpersistencetrojan

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

45.139.105.147:1234

Attributes
  • communication_password

    81dc9bdb52d04dc20036dbd8313ed055

  • install_dir

    temp

  • install_file

    svchost

  • tor_process

    tor

Targets

    • Target

      0x0008000000013199-82.dat

    • Size

      3.8MB

    • MD5

      2bc19dd96b42cea3280eb5fe1e949b82

    • SHA1

      d4daeaa890659239a848d36b34e1c5b0d150c42f

    • SHA256

      6d654b2b1830638ac56fc0801f5898e61c05c6237d007e7b4d326930e38fa205

    • SHA512

      e57a71956cab498c6d6bd4af448a3360ea13b749900d1e656904dfb5a7edb19f236a19bf72282bdc750f8bfb0148734083e6877afd4ad95c27616d207458dd1b

    • SSDEEP

      98304:d77Pmq33rE/JDLPWZADUGer7B6iY74M/qmlwXVZ4FB:5+R/eZADUXR

    Score
    10/10
    bitratpersistencetrojan

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

      trojanbitrat

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks