Overview

overview

10

Static

static

3

05974e24da...03.exe

windows7-x64

10

05974e24da...03.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    05974e24da4b47fd0f50c4a2ed6ce903

  • Size

    5.2MB

  • Sample

    231229-2degysgfe2

  • MD5

    05974e24da4b47fd0f50c4a2ed6ce903

  • SHA1

    69f14454515f4144138d0663949bcf58ad6f0d37

  • SHA256

    02c442a053f2fd4ba4bf43394b159ef010591131ef6661f3559e85d1f91de52a

  • SHA512

    2a816b2277bca7881aa0019b692ed988c97d47b8ae1411766211020fff0d168c6fbdc796f4d14b77e7c5c8ce17a1082cc27e3f124fbc0c88b015f33a76985888

  • SSDEEP

    98304:gx25ckdlbJxwdFX4eJpxPozuyrJBpDGDJNPCkGWgYzVjfLkH+kJoaep:go5TzH+X4eJ2FGNtVGVURp

Score
10/10
bitratzgratrattrojanupx

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

omeno.duckdns.org:5867

Attributes
  • communication_password

    81dc9bdb52d04dc20036dbd8313ed055

  • tor_process

    tor

Targets

    • Target

      05974e24da4b47fd0f50c4a2ed6ce903

    • Size

      5.2MB

    • MD5

      05974e24da4b47fd0f50c4a2ed6ce903

    • SHA1

      69f14454515f4144138d0663949bcf58ad6f0d37

    • SHA256

      02c442a053f2fd4ba4bf43394b159ef010591131ef6661f3559e85d1f91de52a

    • SHA512

      2a816b2277bca7881aa0019b692ed988c97d47b8ae1411766211020fff0d168c6fbdc796f4d14b77e7c5c8ce17a1082cc27e3f124fbc0c88b015f33a76985888

    • SSDEEP

      98304:gx25ckdlbJxwdFX4eJpxPozuyrJBpDGDJNPCkGWgYzVjfLkH+kJoaep:go5TzH+X4eJ2FGNtVGVURp

    Score
    10/10
    bitratzgratrattrojanupx

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

      trojanbitrat

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks