Overview

overview

10

Static

static

URLScan

urlscan

1

http://45.95.169.45:...

windows10-2004-x64

10

Resubmissions

22-11-2022 00:51

221122-a7gqmagg5y 8

21-11-2022 23:09

221121-25dpqsed6v 10

21-11-2022 21:54

221121-1slddace2y 10

21-11-2022 21:30

221121-1crkfsge79 10

21-11-2022 20:42

221121-zg8h4afe23 10

21-11-2022 19:29

221121-x7e85ahb6w 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    http://45.95.169.45:23205/

  • Sample

    221121-1crkfsge79

Score
10/10
bitratpersistencetrojanupx

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

45.95.168.128:23202

Attributes
  • communication_password

    ed99c23d77796aac877ce1f91481dc28

  • install_dir

    Oracle

  • install_file

    java.exe

  • tor_process

    tor

Targets

    • Target

      http://45.95.169.45:23205/

    Score
    10/10
    bitratpersistencetrojanupx

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

      trojanbitrat

    • Downloads MZ/PE file

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks