bitrat

General

Target

83b8c34a7c66b407be941e59a9ce7a84ee81a8dfad3cea67e86118e96221c749
Size

2.1MB
Sample

221120-ta4nnsae84
MD5

592bef1e0325ada505ec4875d5727bc1
SHA1

d6c6aa187d2b5aaff512c12948a426584382e92c
SHA256

83b8c34a7c66b407be941e59a9ce7a84ee81a8dfad3cea67e86118e96221c749
SHA512

38410a737b63a6cf123b08b74e836e75189ce6dae8d4491b4deab5791eff29a824be24d3d70a53ccaf3137222d79253385be5180fffc1e98a0a9c11b1b1e8d3e
SSDEEP

49152:tBUOgQLgF1CiOBInpLNAZpCY3iEO+IVG5r:nU7CCtOmFNAP6O

Score

10^/10

Malware Config

Extracted

Family

warzonerat

C2

45.139.105.147:5200

Extracted

Family

marsstealer

Botnet

Default

C2

data.topababa.com/gate.php

Extracted

Family

bitrat

Version

1.38

C2

45.139.105.147:1234

Attributes

communication_password
81dc9bdb52d04dc20036dbd8313ed055
install_dir
temp
install_file
svchost
tor_process
tor

Targets

- Target
  
  83b8c34a7c66b407be941e59a9ce7a84ee81a8dfad3cea67e86118e96221c749
- Size
  
  2.1MB
- MD5
  
  592bef1e0325ada505ec4875d5727bc1
- SHA1
  
  d6c6aa187d2b5aaff512c12948a426584382e92c
- SHA256
  
  83b8c34a7c66b407be941e59a9ce7a84ee81a8dfad3cea67e86118e96221c749
- SHA512
  
  38410a737b63a6cf123b08b74e836e75189ce6dae8d4491b4deab5791eff29a824be24d3d70a53ccaf3137222d79253385be5180fffc1e98a0a9c11b1b1e8d3e
- SSDEEP
  
  49152:tBUOgQLgF1CiOBInpLNAZpCY3iEO+IVG5r:nU7CCtOmFNAP6O
Score

10^/10

bitrat marsstealer warzonerat default discovery evasion infostealer persistence rat spyware stealer trojan
- BitRAT
  BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
  trojan bitrat
- Mars Stealer
  An infostealer written in C++ based on other infostealers.
  stealer marsstealer
- Modifies security service
  evasion
- WarzoneRat, AveMaria
  WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
  rat infostealer warzonerat
- Warzone RAT payload
  rat
- Executes dropped EXE
- Stops running service(s)
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1