Overview

overview

10

Static

static

3

jbitrt.exe

windows7-x64

10

jbitrt.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    jbitrt.exe

  • Size

    350.0MB

  • Sample

    230805-3shnlafc36

  • MD5

    ebc87e9cf7540ad79716397271c11e7e

  • SHA1

    e4901173b21c903171ef7d83a92c3609ec434fd6

  • SHA256

    3ac3647f6d46ddd5220e483a90d09442b440a01bd66ec95c117ad3d3e018def8

  • SHA512

    5dcb19389e90bf69047e94b616f843983e3852df0a59eabbdb2d682265dd4ad16b36f60b8b15d8d611824ce25faef4ef8029bc402ec6b87dc4d911db30d800cc

  • SSDEEP

    24576:vH9nvaEW1gTI9khgN36kdSG4nGQ5mYeA+igGNTH1YaA0TvD3H1Aza8LN1LV:f9xW1gTI9G0lS7t5mY2ig+yaDvD3CZ

Score
10/10
bitrattrojanupx

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

backu4734.duckdns.org:7904

Attributes
  • communication_password

    202cb962ac59075b964b07152d234b70

  • tor_process

    tor

Targets

    • Target

      jbitrt.exe

    • Size

      350.0MB

    • MD5

      ebc87e9cf7540ad79716397271c11e7e

    • SHA1

      e4901173b21c903171ef7d83a92c3609ec434fd6

    • SHA256

      3ac3647f6d46ddd5220e483a90d09442b440a01bd66ec95c117ad3d3e018def8

    • SHA512

      5dcb19389e90bf69047e94b616f843983e3852df0a59eabbdb2d682265dd4ad16b36f60b8b15d8d611824ce25faef4ef8029bc402ec6b87dc4d911db30d800cc

    • SSDEEP

      24576:vH9nvaEW1gTI9khgN36kdSG4nGQ5mYeA+igGNTH1YaA0TvD3H1Aza8LN1LV:f9xW1gTI9G0lS7t5mY2ig+yaDvD3CZ

    Score
    10/10
    bitrattrojanupx

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

      trojanbitrat

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks