Overview

overview

10

Static

static

10

Stub_tor.exe

windows7-x64

10

Stub_tor.exe

windows10-1703-x64

10

Stub_tor.exe

windows10-2004-x64

10

Resubmissions

03-03-2023 16:38

230303-t5hdxsad82 10

03-03-2023 16:34

230303-t3b45aad68 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Stub_tor.exe

  • Size

    7.8MB

  • Sample

    230303-t3b45aad68

  • MD5

    c897b92d4619272fac887350bd38ec9b

  • SHA1

    82374b547a841c1a04a0d29c0b6a1b339e4b625d

  • SHA256

    bac43b74a0269d4f14098d8f8a51e07d14999cc393ab85a82e933ada1dffe82a

  • SHA512

    1dfeb407e3206bcea7a576d859ab6f994b56252b6c570ea08eef667bdc827b927884b899bec058b1da70a224f53cc11d580cc25c3835d0e2aabd965bd02ef47b

  • SSDEEP

    196608:oIRcbH4jSteTGvFxwhzav1yo31CPwDv3uFZjeg2EeJUO9WLQkDxtw3iFFrS6XOf:odHsfuFxwZ6v1CPwDv3uFteg2EeJUO9E

Score
10/10
bitrattrojanupx

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

ewmkjdfvkp7fnlx43r4oykku2fgmrrhcr6ulpmndnsnwck2hiyvazlad.onion:1235

Attributes
  • communication_password

    81dc9bdb52d04dc20036dbd8313ed055

  • tor_process

    tor

Targets

    • Target

      Stub_tor.exe

    • Size

      7.8MB

    • MD5

      c897b92d4619272fac887350bd38ec9b

    • SHA1

      82374b547a841c1a04a0d29c0b6a1b339e4b625d

    • SHA256

      bac43b74a0269d4f14098d8f8a51e07d14999cc393ab85a82e933ada1dffe82a

    • SHA512

      1dfeb407e3206bcea7a576d859ab6f994b56252b6c570ea08eef667bdc827b927884b899bec058b1da70a224f53cc11d580cc25c3835d0e2aabd965bd02ef47b

    • SSDEEP

      196608:oIRcbH4jSteTGvFxwhzav1yo31CPwDv3uFZjeg2EeJUO9WLQkDxtw3iFFrS6XOf:odHsfuFxwZ6v1CPwDv3uFteg2EeJUO9E

    Score
    10/10
    bitrattrojanupx

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

      trojanbitrat

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks