Overview

overview

10

Static

static

1

bc0374c212...be.exe

windows7-x64

10

bc0374c212...be.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bc0374c212e401d5f220df5657a980fc40fc210af0a7c34dd8d43556d8b2a4be.zip

  • Size

    2.0MB

  • Sample

    230321-rwhbfsba43

  • MD5

    eceee4a9799ff19459a7d56b11b0943a

  • SHA1

    1796c21dbf30f424b112a5491417960a0f85cba8

  • SHA256

    80759ff047a1cb48b8d87d7ed2e7d8e608322242c7b18f5f6d646de7c4740ecf

  • SHA512

    854cf552fd8a02e4dbcfa229350aa021589b774b7ddb1873925a45fc0cc996d187f7e1193d8ce5330584fb9c4fd2e297d411d4e4c0d4bbd055fb579c30bca438

  • SSDEEP

    49152:TcjFEuPiFu9xF2L+IX37BaP6E7JZSQhoatay21vzu:TeysxF2nX3I6/QhoiF21vC

Score
10/10
bitratpersistencetrojan

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

pradeepprabhu705.hopto.org:312

Attributes
  • communication_password

    827ccb0eea8a706c4c34a16891f84e7b

  • tor_process

    tor

Targets

    • Target

      bc0374c212e401d5f220df5657a980fc40fc210af0a7c34dd8d43556d8b2a4be.exe

    • Size

      2.1MB

    • MD5

      bf35c2910d407f1cf330f465a793dc1b

    • SHA1

      306324e8b2cc82f09c7b0f56cde008337b8f5205

    • SHA256

      bc0374c212e401d5f220df5657a980fc40fc210af0a7c34dd8d43556d8b2a4be

    • SHA512

      6fb5fa5ab36acbcf9726426b31ec843b3f8d277047e8d1d51136a91628dd3e0d2c99e6809578ab83f0cc5bb67706462b5653ce00943c7b168d010ce7faab9094

    • SSDEEP

      49152:UrpxN1w5b1QvE4mnVA93py1abMy+mUIuEMyN5KvG8aM6TyHIzkY:Ijw5K4A93paabwtIuEMyN2G8fRY

    Score
    10/10
    bitratpersistencetrojan

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

      trojanbitrat

    • Modifies WinLogon for persistence

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks