Overview

overview

10

Static

static

1

233c0db3af...6e.exe

windows7-x64

10

233c0db3af...6e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    233c0db3afe81ec0b12859e9ed2ad96e

  • Size

    2.0MB

  • Sample

    231231-b5248aaca3

  • MD5

    233c0db3afe81ec0b12859e9ed2ad96e

  • SHA1

    b6186ca1301c5b05910013a62d08d01751c74e3e

  • SHA256

    6c0b8d19ccb66f0fbe99c4882d620a3bc5c95a78e67a8fc7f69918c404bfd4a0

  • SHA512

    7ae6a481002fb5036a9415a5d45c5f506787e712a61783ce25d991c11b831fbdd14d17eca92b29a2c6466d31928ada8959ff426bf2b601955f986f9fccf6585a

  • SSDEEP

    49152:RHRk1X5GhWaMRWWxVAe25ZoyJk3d4iGm44ut:dmGbh7uyJkiivI

Score
10/10
bitratzgratpersistencerattrojan

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

postal-23.ioomoo.xyz:8443

Attributes
  • communication_password

    614e4e7b4355c278293c859711213dfa

  • tor_process

    tor

Targets

    • Target

      233c0db3afe81ec0b12859e9ed2ad96e

    • Size

      2.0MB

    • MD5

      233c0db3afe81ec0b12859e9ed2ad96e

    • SHA1

      b6186ca1301c5b05910013a62d08d01751c74e3e

    • SHA256

      6c0b8d19ccb66f0fbe99c4882d620a3bc5c95a78e67a8fc7f69918c404bfd4a0

    • SHA512

      7ae6a481002fb5036a9415a5d45c5f506787e712a61783ce25d991c11b831fbdd14d17eca92b29a2c6466d31928ada8959ff426bf2b601955f986f9fccf6585a

    • SSDEEP

      49152:RHRk1X5GhWaMRWWxVAe25ZoyJk3d4iGm44ut:dmGbh7uyJkiivI

    Score
    10/10
    bitratzgratpersistencerattrojan

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

      trojanbitrat

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks