Overview

overview

10

Static

static

3

4910d6a232...9a.exe

windows7-x64

10

4910d6a232...9a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4910d6a23280578ab838476ea8bfdc9a.exe

  • Size

    2.3MB

  • Sample

    240107-ye9gyadgc9

  • MD5

    4910d6a23280578ab838476ea8bfdc9a

  • SHA1

    7075d8998729640a7adb8f9ddfacba408bdf3109

  • SHA256

    6d9ae2b15c6995be94b84f2a1d86fc8945594215678711318c88a447263a201e

  • SHA512

    f1942ff2e88a1f627c28011cc1bfbb54dfd3de70d7566e459eb1c88221c6be139161bbef137e814be78351e25d4c477afc101c4a46dae36247dbdc50bb8b50fa

  • SSDEEP

    49152:gv2T1elN3tjmR35wgI46vntTd2sIDzh3emlFAlPTmow+VM:tBYN9SDwu6xIs4zhOmbAlPo+2

Score
10/10
bitratpersistencetrojanupx

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

jairoandresotalvarorend.linkpc.net:9082

Attributes
  • communication_password

    bfdba24ee3d61f0260c4dc1034c3ee43

  • install_dir

    sophosavsdefender

  • install_file

    sophosavsdefender.exe

  • tor_process

    tor

Targets

    • Target

      4910d6a23280578ab838476ea8bfdc9a.exe

    • Size

      2.3MB

    • MD5

      4910d6a23280578ab838476ea8bfdc9a

    • SHA1

      7075d8998729640a7adb8f9ddfacba408bdf3109

    • SHA256

      6d9ae2b15c6995be94b84f2a1d86fc8945594215678711318c88a447263a201e

    • SHA512

      f1942ff2e88a1f627c28011cc1bfbb54dfd3de70d7566e459eb1c88221c6be139161bbef137e814be78351e25d4c477afc101c4a46dae36247dbdc50bb8b50fa

    • SSDEEP

      49152:gv2T1elN3tjmR35wgI46vntTd2sIDzh3emlFAlPTmow+VM:tBYN9SDwu6xIs4zhOmbAlPo+2

    Score
    10/10
    bitratpersistencetrojanupx

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

      trojanbitrat

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks