Overview

overview

10

Static

static

10

0f5f21c677...be.exe

windows7-x64

10

0f5f21c677...be.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0f5f21c67715e3fb4587eae4b07e1ebe.exe

  • Size

    3.8MB

  • Sample

    230428-fcwh7adg9y

  • MD5

    0f5f21c67715e3fb4587eae4b07e1ebe

  • SHA1

    a9a6c464a3a4ef2c48991bbc3fa922a8768ece08

  • SHA256

    9793f3fe8e7f7653e9a89870e83514862813e1122cec46936c2a96d7e42ba070

  • SHA512

    3c64f503fe8ca6a47bcccb937bb4195f7d8afb956cc1a545425a6c238f27aacc5bdacf42ce6165ba5a2a305ba8301fa77aa130e98fa87538530be2fb3ed85c54

  • SSDEEP

    98304:d77Pmq33rE/JDLPWZADUGer7B6iY74M/WmlwXVZ4FB:5+R/eZADUXR

Score
10/10
bitrattrojan

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

apk.theworkpc.com:4920

Attributes
  • communication_password

    32c93a52f919c37c05b22825e5a57a4a

  • tor_process

    tor

Targets

    • Target

      0f5f21c67715e3fb4587eae4b07e1ebe.exe

    • Size

      3.8MB

    • MD5

      0f5f21c67715e3fb4587eae4b07e1ebe

    • SHA1

      a9a6c464a3a4ef2c48991bbc3fa922a8768ece08

    • SHA256

      9793f3fe8e7f7653e9a89870e83514862813e1122cec46936c2a96d7e42ba070

    • SHA512

      3c64f503fe8ca6a47bcccb937bb4195f7d8afb956cc1a545425a6c238f27aacc5bdacf42ce6165ba5a2a305ba8301fa77aa130e98fa87538530be2fb3ed85c54

    • SSDEEP

      98304:d77Pmq33rE/JDLPWZADUGer7B6iY74M/WmlwXVZ4FB:5+R/eZADUXR

    Score
    10/10
    bitrattrojan

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

      trojanbitrat

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks