Overview

overview

10

Static

static

10

689b09ec2b...13.exe

windows7-x64

10

689b09ec2b...13.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    689b09ec2bc8c7cb409b82787af1a513.exe

  • Size

    3.8MB

  • Sample

    230106-tf9rwach2t

  • MD5

    689b09ec2bc8c7cb409b82787af1a513

  • SHA1

    0f48a2ef8ef361a9e40bc40961b6a9cdea48ce12

  • SHA256

    b2f6f43c297769f8b5d5780f1342fe4a433a97955d8b76b7756bd9ceea2ca6e5

  • SHA512

    549b8057a8cf6600cdf7e91616625779fae9c6878118e3063cda860f1568867e4629731b34b6172676458dd81e3e90ba03d1aa657a0a098a939cdb59257a50fa

  • SSDEEP

    98304:d77Pmq33rE/JDLPWZADUGer7B6iY74M/4mlwXVZ4FB:5+R/eZADUXR

Score
10/10
bitratpersistencetrojan

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

bevdona.theworkpc.com:5574

Attributes
  • communication_password

    81dc9bdb52d04dc20036dbd8313ed055

  • install_dir

    Install path

  • install_file

    Install name

  • tor_process

    tor

Targets

    • Target

      689b09ec2bc8c7cb409b82787af1a513.exe

    • Size

      3.8MB

    • MD5

      689b09ec2bc8c7cb409b82787af1a513

    • SHA1

      0f48a2ef8ef361a9e40bc40961b6a9cdea48ce12

    • SHA256

      b2f6f43c297769f8b5d5780f1342fe4a433a97955d8b76b7756bd9ceea2ca6e5

    • SHA512

      549b8057a8cf6600cdf7e91616625779fae9c6878118e3063cda860f1568867e4629731b34b6172676458dd81e3e90ba03d1aa657a0a098a939cdb59257a50fa

    • SSDEEP

      98304:d77Pmq33rE/JDLPWZADUGer7B6iY74M/4mlwXVZ4FB:5+R/eZADUXR

    Score
    10/10
    bitratpersistencetrojan

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

      trojanbitrat

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks