bitrat | 8dd93fd81577033b184647b566e160699006396bcc6cbfff405acc4597c0d688 | Triage

Sharing

General

Target

8dd93fd81577033b184647b566e160699006396bcc6cbfff405acc4597c0d688
Size

76KB
Sample

221121-y1nglaac7s
MD5

d43ca72d6fd0c9a2e3f3774b74fd5028
SHA1

d28a3f9edb5651de9c7a418e63f8417105c83c63
SHA256

8dd93fd81577033b184647b566e160699006396bcc6cbfff405acc4597c0d688
SHA512

b4e5a5df2885d59ff7f4c8325ee7b00be592a62c2ee006244e9d5a8cc67adcb6b15f557146030b9079960b538dddda8626443b9c2ebbe9f31b6e40ab87cfc639
SSDEEP

1536:EwHgiRJFKfgYBUngABZvxZ/DOG8s8MkeNSzXzKD:EwASJFKRapBZP/Dl8DMDSzX+D

Score

10^/10

bitrat persistence trojan

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

37.139.128.233:3569

Attributes

communication_password
ce952068942604a6d6df06ed5002fad6
tor_process
tor

Targets

- Target
  
  8dd93fd81577033b184647b566e160699006396bcc6cbfff405acc4597c0d688
- Size
  
  76KB
- MD5
  
  d43ca72d6fd0c9a2e3f3774b74fd5028
- SHA1
  
  d28a3f9edb5651de9c7a418e63f8417105c83c63
- SHA256
  
  8dd93fd81577033b184647b566e160699006396bcc6cbfff405acc4597c0d688
- SHA512
  
  b4e5a5df2885d59ff7f4c8325ee7b00be592a62c2ee006244e9d5a8cc67adcb6b15f557146030b9079960b538dddda8626443b9c2ebbe9f31b6e40ab87cfc639
- SSDEEP
  
  1536:EwHgiRJFKfgYBUngABZvxZ/DOG8s8MkeNSzXzKD:EwASJFKRapBZP/Dl8DMDSzX+D
Score

10^/10

bitrat persistence trojan
- BitRAT
  BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
  trojan bitrat
- Adds Run key to start application
  persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

bitratpersistencetrojan