Overview

overview

10

Static

static

1

446215913d...77.exe

windows7-x64

10

446215913d...77.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    446215913dd436aae1317ad90bf75677.exe

  • Size

    4.2MB

  • Sample

    230311-mxtcwsbb6t

  • MD5

    446215913dd436aae1317ad90bf75677

  • SHA1

    6f9c887f3fe17b16045fd2fa2d754c744447a4d2

  • SHA256

    4bbf8447f25f44cabc87e9e20bf6594475f999a58e86c76bbad265d1db9bd513

  • SHA512

    dd1b3f89efb92245640289b43ceedbf3bb562578286966d3a72bd03ff145f36054788353d39804489174c6f9018624820f54cad560394be7cf09f5127188acb3

  • SSDEEP

    98304:scyyd+oHduCY3f3rFQtAjgyzZdGxHeqWF0KfgOjCH:sAswQFQtLUGFeqlm

Score
10/10
bitratredlineinfostealerspywaretrojan

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

185.246.220.122:1488

Attributes
  • communication_password

    81dc9bdb52d04dc20036dbd8313ed055

  • tor_process

    tor

Extracted

Family

redline

C2

185.246.220.122:7164

Attributes
  • auth_value

    bc36aaf1c6447fa611401422deaa29dd

Targets

    • Target

      446215913dd436aae1317ad90bf75677.exe

    • Size

      4.2MB

    • MD5

      446215913dd436aae1317ad90bf75677

    • SHA1

      6f9c887f3fe17b16045fd2fa2d754c744447a4d2

    • SHA256

      4bbf8447f25f44cabc87e9e20bf6594475f999a58e86c76bbad265d1db9bd513

    • SHA512

      dd1b3f89efb92245640289b43ceedbf3bb562578286966d3a72bd03ff145f36054788353d39804489174c6f9018624820f54cad560394be7cf09f5127188acb3

    • SSDEEP

      98304:scyyd+oHduCY3f3rFQtAjgyzZdGxHeqWF0KfgOjCH:sAswQFQtLUGFeqlm

    Score
    10/10
    bitratredlineinfostealerspywaretrojan

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

      trojanbitrat

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks