bitrat | 11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e | Triage

Sharing

General

Target

SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe
Size

3.8MB
Sample

230317-2d749scc6w
MD5

86000b0a976dc4a377b2e5192fe30445
SHA1

ad29b138883d7906f8d6e75f2e5f60e5285d4a56
SHA256

11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e
SHA512

4d0be7661db756cee78c7fbbb91705574b5bb82552230277d59b14a2225f84209597473c165243594ef7d335b3f48475d92b48af21092d04320e91ac452e9c19
SSDEEP

98304:nUyJF2oYGCLxnJ7rzdIzYsuvqqW07LslsPTU:nUbn5zSzYhqqW0ns8U

Score

10^/10

bitrat trojan

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

74.201.28.92:3569

Attributes

communication_password
148b191cf4e80b549e1b1a4444f2bdf6
tor_process
tor

Targets

- Target
  
  SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe
- Size
  
  3.8MB
- MD5
  
  86000b0a976dc4a377b2e5192fe30445
- SHA1
  
  ad29b138883d7906f8d6e75f2e5f60e5285d4a56
- SHA256
  
  11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e
- SHA512
  
  4d0be7661db756cee78c7fbbb91705574b5bb82552230277d59b14a2225f84209597473c165243594ef7d335b3f48475d92b48af21092d04320e91ac452e9c19
- SSDEEP
  
  98304:nUyJF2oYGCLxnJ7rzdIzYsuvqqW07LslsPTU:nUbn5zSzYhqqW0ns8U
Score

10^/10

bitrat trojan
- BitRAT
  BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
  trojan bitrat
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

behavioral2