Behavioral task
behavioral1
Sample
cca94f664ac1a51d2eb9162383a0f2d4c034ce4eebd24192bc8e13b833605fca.exe
Resource
win7-20230220-en
General
-
Target
cca94f664ac1a51d2eb9162383a0f2d4c034ce4eebd24192bc8e13b833605fca.zip
-
Size
1.8MB
-
MD5
028cf2d6a37e3a9086523781c53dde07
-
SHA1
0f7d91f9aa1395ba7cad8266cf76ff13201735d2
-
SHA256
e00029b423008250734ef47a4b8b54c630d3ad75688f5dc9dcd036f4e38d9cfb
-
SHA512
527779fd93bb29f321e1efc1813054392f570295d6970c122f44a333c8f203ee75f1b8bec030f4a17776d5199f5d834a9b355e1a8c2e41981fc6a61c30914c96
-
SSDEEP
49152:9u2be88ACUaewYsQ3bSdawQcLyiyPlrYGp3/6:nhDcNiSmcLyiuR6
Malware Config
Extracted
bitrat
1.38
185.246.220.122:1488
-
communication_password
81dc9bdb52d04dc20036dbd8313ed055
-
tor_process
tor
Signatures
-
Bitrat family
Files
-
cca94f664ac1a51d2eb9162383a0f2d4c034ce4eebd24192bc8e13b833605fca.zip.zip
Password: infected
-
cca94f664ac1a51d2eb9162383a0f2d4c034ce4eebd24192bc8e13b833605fca.exe.exe windows x86
Password: infected
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 2.9MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 687KB - Virtual size: 686KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 72KB - Virtual size: 103KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 146KB - Virtual size: 146KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ