Overview

overview

10

Static

static

ERA.exe

windows7-x64

10

ERA.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    AC12C1EEEF2E9CBB8AACF3063EB3A74ADB192D3093D8674DA3EE555B74605F09

  • Size

    1.4MB

  • Sample

    221213-2qb8csgf29

  • MD5

    923ce3442c8f7e0429282079d977b407

  • SHA1

    100a60a5c0f95c4d03165181e2ea3839b0c1ca3e

  • SHA256

    ac12c1eeef2e9cbb8aacf3063eb3a74adb192d3093d8674da3ee555b74605f09

  • SHA512

    3644d90dff5eb96cb59026c4c87241a81041ef79d7529e37e6d182f87289e547e52990d28d6eccf22f7f1900242648c03f8e593eda1dfc1a7b2e68f87e530446

  • SSDEEP

    12288:UuIa+LnuIlkjgAEysB96kF2SW0BONQe/m3mY6Fap4kruadYaeLw2Ylg:vZ4uIlkjgAEvB5cjnEUap4kya6RxYi

Score
10/10
bitratmodiloaderpersistencetrojanupx

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

winery.nsupdate.info:5877

Attributes
  • communication_password

    e5ff7c52fb3501484ea7ca8641803415

  • tor_process

    tor

Targets

    • Target

      ERA.EXE

    • Size

      886KB

    • MD5

      aa462529d2aeac2d47d599794e6aa197

    • SHA1

      deb061568a3feda4c8a2c19aba853da89d96c3a3

    • SHA256

      4a0fc5341e04f28dcef70ca4c6370233993e887baeeab0d507a94a129a0421c6

    • SHA512

      6378787105600b1d2aaf7dae995d434f389fc85735c777cb25540082fae52a456c32782030ba02bea54d5fd1ba2841803171848eef440d8c55d4c41d73b72d77

    • SSDEEP

      12288:quIa+LnuIlkjgAEysB96kF2SW0BONQe/m3mY6Fap4kruadYaeLw2Ylg:tZ4uIlkjgAEvB5cjnEUap4kya6RxYi

    Score
    10/10
    modiloadertrojanbitratpersistenceupx

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

      trojanbitrat

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks