bitrat

Resubmissions

21-08-2023 15:40

230821-s39vqadh37 10

11-08-2023 19:23

230811-x36khsac6w 10

Sharing

Copy URL

Twitter E-mail

General

Target

Predictor V6.3.2.rar
Size

5.0MB
Sample

230811-x36khsac6w
MD5

4a04ee283860e4ec720766353ab2721a
SHA1

0673fb606de3a7764f2169f82ba1d1b7e2557dc4
SHA256

bdb39f248d0cd06c086b5e38a8120fa4feb9208a4236f32b23e601a4037be416
SHA512

88c6035b7351135f4c661db6a954448707debe9dcb57a79d7ea274892c28334cd7c981d83d3811f844edf1cace0b56e94300905bd39cabc2e86605b78e1bea59
SSDEEP

98304:icn5BIMWY6xaTB5L/s8M4H1NjvpBUDvJBEcRm57Infg0d8lyUCwOYD:F5rL6xaTc01NjhBUDvAd8n9d1NwFD

Score

10^/10

bitrat trojan

Malware Config

Extracted

Family

bitrat

Version

1.38

185.157.162.126:443

Attributes

communication_password
a76d949640a165da25ccfe9a8fd82c8a
tor_process
tor

Targets

- Target
  
  Predictor V6.3/Predictor V6.3.9.exe
- Size
  
  658KB
- MD5
  
  ab63396cb0774ac41107b7b112f81d5a
- SHA1
  
  f5dc67429147e886b01413472496576a2ee34075
- SHA256
  
  9a43c57f3e98bd69789e8ccbeef2c1b6b5a3b1d06d63257bb4bd58dffa23689d
- SHA512
  
  2121961ae2b154ba941af6937d0522505ec7e323094fb2edc7058194ae958bcf866bbbc7842924236b8635917800d0708eaabff6112f131f496189bb6e021699
- SSDEEP
  
  12288:BKwp3N7HPqUeL31VI1kR8BgrsEofzwHJem7OzwHJe0IhfiZ:swp97HyUeLFVIuRCgrsEorwpemIwpels
Score

10^/10

bitrat trojan
- BitRAT
  BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
  trojan bitrat
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  Predictor V6.3/api-ms-win-core-file-l1-2-0.dll
- Size
  
  18KB
- MD5
  
  49c3ffd47257dbcb67a6be9ee112ba7f
- SHA1
  
  04669214375b25e2dc8a3635484e6eeb206bc4eb
- SHA256
  
  322d963d2a2aefd784e99697c59d494853d69bed8efd4b445f59292930a6b165
- SHA512
  
  bda5e6c669b04aaed89538a982ef430cef389237c6c1d670819a22b2a20bf3c22aef5cb4e73ef7837cbbd89d870693899f97cb538122059c885f4b19b7860a98
- SSDEEP
  
  384:aW1hWF5OZkum0GftpBjjNWm3S0ZlmTof1:JKoViqi1
Score

1^/10
behavioral3 behavioral4
- Target
  
  Predictor V6.3/api-ms-win-core-file-l2-1-0.dll
- Size
  
  18KB
- MD5
  
  bfffa7117fd9b1622c66d949bac3f1d7
- SHA1
  
  402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2
- SHA256
  
  1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e
- SHA512
  
  b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f
- SSDEEP
  
  384:eVrW1hWbvm0GftpBjzH4m3S9gTlUK3dsl:eVuAViaB/6sl
Score

1^/10
behavioral5 behavioral6
- Target
  
  Predictor V6.3/api-ms-win-core-localization-l1-2-0.dll
- Size
  
  20KB
- MD5
  
  588bd2a8e0152e0918742c1a69038f1d
- SHA1
  
  9874398548891f6a08fc06437996f84eb7495783
- SHA256
  
  a07cc878ab5595aacd4ab229a6794513f897bd7ad14bcec353793379146b2094
- SHA512
  
  32ffe64c697f94c4db641ab3e20b0f522cf3eba9863164f1f6271d2f32529250292a16be95f32d852480bd1b59b8b0554c1e7fd7c7a336f56c048f4f56e4d62f
- SSDEEP
  
  384:XOMw3zdp3bwjGjue9/0jCRrndb6kW1hW85OZkum0GftpBjcqEm3Shupl4aRGWa:XOMwBprwjGjue9/0jCRrndb0noVialbj
Score

1^/10
behavioral7 behavioral8
- Target
  
  Predictor V6.3/api-ms-win-core-processthreads-l1-1-1.dll
- Size
  
  18KB
- MD5
  
  d699333637db92d319661286df7cc39e
- SHA1
  
  0bffb9ed366853e7019452644d26e8e8f236241b
- SHA256
  
  fe760614903e6d46a1be508dccb65cf6929d792a1db2c365fc937f2a8a240504
- SHA512
  
  6fa9ff0e45f803faf3eb9908e810a492f6f971cb96d58c06f408980ab40cba138b52d853aa0e3c68474053690dfafa1817f4b4c8fb728d613696b6c516fa0f51
- SSDEEP
  
  384:dtUDfIeFrW1hWC5OZkum0GftpBjVzm3Sx56lgCoha6LDF:dteFuJoVijz1HB
Score

1^/10
behavioral10 behavioral9
- Target
  
  Predictor V6.3/api-ms-win-core-synch-l1-2-0.dll
- Size
  
  18KB
- MD5
  
  47388f3966e732706054fe3d530ed0dc
- SHA1
  
  a9aebbbb73b7b846b051325d7572f2398f5986ee
- SHA256
  
  59c14541107f5f2b94bbf8686efee862d20114bcc9828d279de7bf664d721132
- SHA512
  
  cce1fc5bcf0951b6a76d456249997b427735e874b650e5b50b3d278621bf99e39c4fc7fee081330f20762f797be1b1c048cb057967ec7699c9546657b3e248ee
- SSDEEP
  
  192:ntZ3mW1hWig+49Cjdks/nGfe4pBjSYS6XXL6bW5RKTt3E2sVWQ4GWUFsqnajkZtu:ntZ3mW1hWA4wm0GftpBjbLZm3SElmTop
Score

3^/10
behavioral11 behavioral12
- Target
  
  Predictor V6.3/api-ms-win-core-timezone-l1-1-0.dll
- Size
  
  18KB
- MD5
  
  f62b66f451f2daa8410ad62d453fa0a2
- SHA1
  
  4bf13db65943e708690d6256d7ddd421cc1cc72b
- SHA256
  
  48eb5b52227b6fb5be70cb34009c8da68356b62f3e707db56af957338ba82720
- SHA512
  
  d64c2a72adf40bd451341552e7e6958779de3054b0cf676b876c3ba7b86147aecba051ac08adc0c3bfb2779109f87dca706c43de3ce36e05af0ddee02bbbf419
- SSDEEP
  
  192:bW1hWipu7jCjdks/nGfe4pBjSYpGQjW5RKTt3E2sVWQ4GWqsegPBOqnajd2si3Ed:bW1hWJam0GftpBjEm3SPZlMELmA
Score

1^/10
behavioral13 behavioral14
- Target
  
  Predictor V6.3/api-ms-win-crt-conio-l1-1-0.dll
- Size
  
  19KB
- MD5
  
  6c88d0006cf852f2d8462dfa4e9ca8d1
- SHA1
  
  49002b58cb0df2ee8d868dec335133cf225657df
- SHA256
  
  d5960c7356e8ab97d0ad77738e18c80433da277671a6e89a943c7f7257ff3663
- SHA512
  
  d081843374a43d2e9b33904d4334d49383df04ee7143a8b49600841ece844eff4e8e36b4b5966737ac931ed0350f202270e043f7003bf2748c5418d5e21c2a27
- SSDEEP
  
  384:J1W1hWA5OZkum0GftpBjNuCm3Sbsl4aRGWDk:JM7oViKCPpt
Score

3^/10
behavioral15 behavioral16
- Target
  
  Predictor V6.3/api-ms-win-crt-convert-l1-1-0.dll
- Size
  
  22KB
- MD5
  
  d53637eab49fe1fe1bd45d12f8e69c1f
- SHA1
  
  c84e41fdcc4ca89a76ae683cb390a9b86500d3ca
- SHA256
  
  83678f181f46fe77f8afe08bfc48aebb0b4154ad45b2efe9bfadc907313f6087
- SHA512
  
  94d43da0e2035220e38e4022c429a9c049d6a355a9cb4695ad4e0e01d6583530917f3b785ea6cd2592fdd7b280b9df95946243e395a60dc58ec0c94627832aeb
- SSDEEP
  
  192:VpdkKBcyhW1hWBeI2WksSrCjdks/nGfe4pBjSYs//rvvW5RKTt3E2sVWQ4GWdziZ:/uyhW1hWk3szm0GftpBjsum3SiclPXOA
Score

1^/10
behavioral17 behavioral18
- Target
  
  Predictor V6.3/api-ms-win-crt-environment-l1-1-0.dll
- Size
  
  18KB
- MD5
  
  c712515d052a385991d30b9c6afc767f
- SHA1
  
  9a4818897251cacb7fe1c6fe1be3e854985186ad
- SHA256
  
  f7c6c7ea22edd2f8bd07aa5b33cbce862ef1dcdc2226eb130e0018e02ff91dc1
- SHA512
  
  b7d1e22a169c3869aa7c7c749925a031e8bdd94c2531c6ffe9dae3b3cd9a2ee1409ca26824c4e720be859de3d4b2af637dd60308c023b4774d47afe13284dcd2
- SSDEEP
  
  192:sfW1hWiQcvHCjdks/nGfe4pBjSY6Na3sAW5RKTt3E2sVWQ4GWIjcyqnaj/6g6dqd:sfW1hWPQim0GftpBjzim3StltFpn
Score

1^/10
behavioral19 behavioral20
- Target
  
  Predictor V6.3/api-ms-win-crt-filesystem-l1-1-0.dll
- Size
  
  20KB
- MD5
  
  f0d507de92851a8c0404ac78c383c5cd
- SHA1
  
  78fa03c89ea12ff93fa499c38673039cc2d55d40
- SHA256
  
  610332203d29ab218359e291401bf091bb1db1a6d7ed98ab9a7a9942384b8e27
- SHA512
  
  a65c9129ee07864f568c651800f6366bca5313ba400814792b5cc9aa769c057f357b5055988c414e88a6cd87186b6746724a43848f96a389a13e347ef5064551
- SSDEEP
  
  384:Mq6nWm5CZW1hW6am0GftpBjToIm3S7ltFps:R6nWm5CIcViCIk
Score

3^/10
behavioral21 behavioral22
- Target
  
  Predictor V6.3/api-ms-win-crt-heap-l1-1-0.dll
- Size
  
  19KB
- MD5
  
  f9e20dd3b07766307fccf463ab26e3ca
- SHA1
  
  60b4cf246c5f414fc1cd12f506c41a1043d473ee
- SHA256
  
  af47aebe065af2f045a19f20ec7e54a6e73c0c3e9a5108a63095a7232b75381a
- SHA512
  
  13c43eee9c93c9f252087cb397ff2d6b087b1dc92a47ba5493297f080e91b7c39ee5665d6bdc1a80e7320e2b085541fc798a3469b1f249b05dee26bbbb6ab706
- SSDEEP
  
  384:0Y3eBW1hWeXRm0GftpBjI6xIm3S006lD16hU:EQzVi66xI+
Score

3^/10
behavioral23 behavioral24
- Target
  
  Predictor V6.3/api-ms-win-crt-locale-l1-1-0.dll
- Size
  
  18KB
- MD5
  
  ab206f2943977256ca3a59e5961e3a4f
- SHA1
  
  9c1df49a8dbdc8496ac6057f886f5c17b2c39e3e
- SHA256
  
  b3b6ee98aca14cf5bc9f3bc7897bc23934bf85fc4bc25b7506fe4cd9a767047a
- SHA512
  
  baccc304b091a087b2300c10f6d18be414abb4c1575274c327104aabb5fdf975ba26a86e423fda6befb5d7564effac0c138eb1bad2d2e226131e4963c7aac5bd
- SSDEEP
  
  192:eW1hWmL+49Cjdks/nGfe4pBjSbRIdnV7IGW5RKTt3E2sVWQ4OWVZsqnajkZtTT2N:eW1hWJ4wm0GftpBjpnVMLm3SDlmToDr
Score

1^/10
behavioral25 behavioral26
- Target
  
  Predictor V6.3/api-ms-win-crt-math-l1-1-0.dll
- Size
  
  27KB
- MD5
  
  4dd7a61590d07500704e7e775255cb00
- SHA1
  
  8b35ec4676bd96c2c4508dc5f98ca471b22deed7
- SHA256
  
  a25d0654deb0cea1aef189ba2174d0f13bdf52f098d3a9ec36d15e4bfb30c499
- SHA512
  
  1086801260624cf395bf971c9fd671abddcd441ccc6a6eac55f277ccfbab752c82cb1709c8140de7b4b977397a31da6c9c8b693ae92264eb23960c8b1e0993bd
- SSDEEP
  
  384:SQUbM4Oe59Ckb1hgmLNW1hWzXRm0GftpBjDm3SBulJr6:SRMq59Bb1jEAViFla2
Score

3^/10
behavioral27 behavioral28
- Target
  
  Predictor V6.3/api-ms-win-crt-multibyte-l1-1-0.dll
- Size
  
  26KB
- MD5
  
  4e033cfee32edf6be7847e80a5114894
- SHA1
  
  91eef52c557aefd0fde27e8df4e3c3b7f99862f2
- SHA256
  
  dff24441df89a02dde1cd984e4d3820845bafdff105458ed10d510126117115b
- SHA512
  
  e1f3d98959d68ef3d7e86ac4cb3dbdf92a34fcfd1bf0e0db45db66c65af0162ab02926dc5d98c6fc4a759a6010026ee26a9021c67c0190da941a04b783055318
- SSDEEP
  
  384:my+Kr6aLPmIHJI6/CpG3t2G3t4odXLNW1hWOQim0GftpBjk8Cm3SqlM7:mZKrZPmIHJI6aDfVim8Cr
Score

1^/10
behavioral29 behavioral30
- Target
  
  Predictor V6.3/api-ms-win-crt-private-l1-1-0.dll
- Size
  
  69KB
- MD5
  
  50740f0bc326f0637c4166698298d218
- SHA1
  
  0c33cfe40edd278a692c2e73e941184fd24286d9
- SHA256
  
  adbb658dd1cbecaca7cc1322b51976f30b36ccf0a751f3bad1f29d350b192c9c
- SHA512
  
  f1331ab1d52fb681f51546168e9736e2f6163e0706955e85ac9e4544d575d50e6eacd90ea3e49cb8b69da34fe0b621b04661f0b6f09f7ce8ceca50308c263d03
- SSDEEP
  
  1536:W7bLPuDe5c4bFe2JyhcvxXWpD7d3334BkZn3P9IVlqHh:WyDe5c4bFe2JyhcvxXWpD7d3334BkZnB
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Targets

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32