bitrat

General

Target

Documento_Orslgroup_S.R.L_09_2023.xls
Size

100KB
Sample

230918-krvbwsaf36
MD5

c678822324d3db11afb66ad4dc9a5bb8
SHA1

db82a3d3de0b0d90cc302e903e18dd9d2fb684c4
SHA256

d77795d4563d03c0ec79533ac468580fa94ae26a54b5e14e34c3d6bdf9ae51b0
SHA512

7a753d605ee1e5e14d3dbf0a67feb80c8fee21c0bdc7cba36298eead743b541e65d5d4d3f25124ec8d4ad54c38744f244bb721f7c0edb76d1a3441c0d291d03e
SSDEEP

3072:BrxEtjPOtioVjDGUU1qfDlaGGx+cL2QnA9tJE2zuxq+fr9wBLa71ba2ryLTHeYD:pxEtjPOtioVjDGUU1qfDlavx+W2QnAnF

Score

10^/10

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

185.225.75.68:3569

Attributes

communication_password
0edcbe7d888380c49e7d1dcf67b6ea6e
tor_process
tor

Targets

- Target
  
  Documento_Orslgroup_S.R.L_09_2023.xls
- Size
  
  100KB
- MD5
  
  c678822324d3db11afb66ad4dc9a5bb8
- SHA1
  
  db82a3d3de0b0d90cc302e903e18dd9d2fb684c4
- SHA256
  
  d77795d4563d03c0ec79533ac468580fa94ae26a54b5e14e34c3d6bdf9ae51b0
- SHA512
  
  7a753d605ee1e5e14d3dbf0a67feb80c8fee21c0bdc7cba36298eead743b541e65d5d4d3f25124ec8d4ad54c38744f244bb721f7c0edb76d1a3441c0d291d03e
- SSDEEP
  
  3072:BrxEtjPOtioVjDGUU1qfDlaGGx+cL2QnA9tJE2zuxq+fr9wBLa71ba2ryLTHeYD:pxEtjPOtioVjDGUU1qfDlavx+W2QnAnF
Score

10^/10

bitrat xenarmor collection password recovery spyware stealer trojan upx
- BitRAT
  BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
  trojan bitrat
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- XenArmor Suite
  XenArmor is as suite of password recovery tools for various application.
  recovery password xenarmor
- Blocklisted process makes network request
- Downloads MZ/PE file
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Accesses Microsoft Outlook accounts
  collection
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2