Overview

overview

10

Static

static

10

9793f3fe8e...70.exe

windows7-x64

10

9793f3fe8e...70.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9793f3fe8e7f7653e9a89870e83514862813e1122cec46936c2a96d7e42ba070.zip

  • Size

    1.8MB

  • Sample

    230502-zrbbcaec8s

  • MD5

    b48a466100134f9fcb82fdc89e7eb895

  • SHA1

    8eb833966ce576e7af84ada2048643bdde08afff

  • SHA256

    ff6195dd37a9f1433607b151631aa2b0e7105bfc6cba50e23be2d42e6667dbdc

  • SHA512

    0923b3d3dda04a36605cfbed92f1b68ff15b09ef2d2cf7c79368dc9eedf55d6c0104c45a47370af56f6495113e8c670e45d2f2e9dabafd305c2e334716a81201

  • SSDEEP

    49152:n+PzPa2nJZ0/fRKUSvXrxxW195TIY8beRBy2HJmqT8L5BT2:n+a2nkCvtxW19514zqT8Lb2

Score
10/10
bitrattrojan

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

apk.theworkpc.com:4920

Attributes
  • communication_password

    32c93a52f919c37c05b22825e5a57a4a

  • tor_process

    tor

Targets

    • Target

      9793f3fe8e7f7653e9a89870e83514862813e1122cec46936c2a96d7e42ba070.exe

    • Size

      3.8MB

    • MD5

      0f5f21c67715e3fb4587eae4b07e1ebe

    • SHA1

      a9a6c464a3a4ef2c48991bbc3fa922a8768ece08

    • SHA256

      9793f3fe8e7f7653e9a89870e83514862813e1122cec46936c2a96d7e42ba070

    • SHA512

      3c64f503fe8ca6a47bcccb937bb4195f7d8afb956cc1a545425a6c238f27aacc5bdacf42ce6165ba5a2a305ba8301fa77aa130e98fa87538530be2fb3ed85c54

    • SSDEEP

      98304:d77Pmq33rE/JDLPWZADUGer7B6iY74M/WmlwXVZ4FB:5+R/eZADUXR

    Score
    10/10
    bitrattrojan

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

      trojanbitrat

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks