General

  • Target

    a1e30c275232ebe20659a9541f2a8af8cc1b1a9c46d88c91bd0fc37ca2fb1d07

  • Size

    9.7MB

  • Sample

    221130-tattgadf34

  • MD5

    e0866df50713533e04728b04a5286de9

  • SHA1

    8ea1239123bf01d9c610662b7f511e6dc967dd7f

  • SHA256

    a1e30c275232ebe20659a9541f2a8af8cc1b1a9c46d88c91bd0fc37ca2fb1d07

  • SHA512

    5f0f4b77e6da798cccf7beec865e1b2c964448d45c048d66193c95de93381a561b50f673de8cd8ecc6bc33d672cf9ee57a180fd2edfe26ecaef447babf27c9f9

  • SSDEEP

    196608:SX8+4u9dvKX5onopXD/WVrTm5x6nW40Z5io98N2HBMADiYfNogmNmAiHNv:SX595KX5zpXLKrTLPE0U8o+AD3MmAiHN

Score
10/10

Malware Config

Extracted

Family

bitrat

Version

1.34

C2

logonapplication.ddns.net:4016

Attributes
  • communication_password

    c4ca4238a0b923820dcc509a6f75849b

  • tor_process

    tor

Targets

    • Target

      a1e30c275232ebe20659a9541f2a8af8cc1b1a9c46d88c91bd0fc37ca2fb1d07

    • Size

      9.7MB

    • MD5

      e0866df50713533e04728b04a5286de9

    • SHA1

      8ea1239123bf01d9c610662b7f511e6dc967dd7f

    • SHA256

      a1e30c275232ebe20659a9541f2a8af8cc1b1a9c46d88c91bd0fc37ca2fb1d07

    • SHA512

      5f0f4b77e6da798cccf7beec865e1b2c964448d45c048d66193c95de93381a561b50f673de8cd8ecc6bc33d672cf9ee57a180fd2edfe26ecaef447babf27c9f9

    • SSDEEP

      196608:SX8+4u9dvKX5onopXD/WVrTm5x6nW40Z5io98N2HBMADiYfNogmNmAiHNv:SX595KX5zpXLKrTLPE0U8o+AD3MmAiHN

    Score
    10/10
    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    • Looks for VirtualBox Guest Additions in registry

    • Executes dropped EXE

    • Looks for VMWare Tools registry key

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks