Overview

overview

10

Static

static

3

40f3e277da...JC.exe

windows7-x64

10

40f3e277da...JC.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    40f3e277da7a04b58913ba390827cfd51b318f40768c58f81361b832096ce1ef_JC.exe

  • Size

    7.8MB

  • Sample

    231011-ng8nbabe6z

  • MD5

    b8d03a02e654dfc840f21297b8dc99b2

  • SHA1

    615aced62a15e9a1733bfb2c390ba83f024bbbd7

  • SHA256

    40f3e277da7a04b58913ba390827cfd51b318f40768c58f81361b832096ce1ef

  • SHA512

    5f9b459df94dac7dc17f90a8dc53d968c3c0e2fc5c41b107ece1683621ef887d8f01abeec04ec0d9beb87fd11c54f39d71c7ec5c2502ec1db68ffacd018c4194

  • SSDEEP

    196608:KUYuomDLdUgXNjeOoUoB/mZMnsDJKB4o+uBxKd8c:TzoQLd0O6B7c0BTLjbc

Score
10/10
bitrattrojan

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

bitnow7005.duckdns.org:7005

Attributes
  • communication_password

    827ccb0eea8a706c4c34a16891f84e7b

  • tor_process

    tor

Targets

    • Target

      40f3e277da7a04b58913ba390827cfd51b318f40768c58f81361b832096ce1ef_JC.exe

    • Size

      7.8MB

    • MD5

      b8d03a02e654dfc840f21297b8dc99b2

    • SHA1

      615aced62a15e9a1733bfb2c390ba83f024bbbd7

    • SHA256

      40f3e277da7a04b58913ba390827cfd51b318f40768c58f81361b832096ce1ef

    • SHA512

      5f9b459df94dac7dc17f90a8dc53d968c3c0e2fc5c41b107ece1683621ef887d8f01abeec04ec0d9beb87fd11c54f39d71c7ec5c2502ec1db68ffacd018c4194

    • SSDEEP

      196608:KUYuomDLdUgXNjeOoUoB/mZMnsDJKB4o+uBxKd8c:TzoQLd0O6B7c0BTLjbc

    Score
    10/10
    bitrattrojan

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

      trojanbitrat

    • Executes dropped EXE

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks