Overview

overview

10

Static

static

10

1e72db5619...bf.exe

windows7-x64

10

1e72db5619...bf.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1e72db56197eb1a502a0af1f0648d1bf

  • Size

    3.8MB

  • Sample

    231225-ppalxsdch3

  • MD5

    1e72db56197eb1a502a0af1f0648d1bf

  • SHA1

    7f8f1108dd48724d0026c748e1a0958e449573fa

  • SHA256

    3dc477c663c3dd49496a4fcf7f0448b372d854e12c64067e5f289a1b5063d020

  • SHA512

    106975a8abdafb82e689b6efc5c5439bb59923d7833497d3e0dbf55ddd52ea13398a20363dfb42d2a97de3510cf228df9c835ef9b5466cae94187b97bd5f8a9c

  • SSDEEP

    98304:X77Pmq33rE/JDLPWZADUGer7B6iY74M/1mlwXVZ:f+R/eZADUXR

Score
10/10
bitrattrojan

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

80.209.229.141:4898

Attributes
  • communication_password

    202cb962ac59075b964b07152d234b70

  • tor_process

    tor

Targets

    • Target

      1e72db56197eb1a502a0af1f0648d1bf

    • Size

      3.8MB

    • MD5

      1e72db56197eb1a502a0af1f0648d1bf

    • SHA1

      7f8f1108dd48724d0026c748e1a0958e449573fa

    • SHA256

      3dc477c663c3dd49496a4fcf7f0448b372d854e12c64067e5f289a1b5063d020

    • SHA512

      106975a8abdafb82e689b6efc5c5439bb59923d7833497d3e0dbf55ddd52ea13398a20363dfb42d2a97de3510cf228df9c835ef9b5466cae94187b97bd5f8a9c

    • SSDEEP

      98304:X77Pmq33rE/JDLPWZADUGer7B6iY74M/1mlwXVZ:f+R/eZADUXR

    Score
    10/10
    bitrattrojan

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

      trojanbitrat

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks