Overview

overview

10

Static

static

3

51d11fe38b...19.exe

windows7-x64

10

51d11fe38b...19.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    51d11fe38b54b9b7968ffba3da87b319

  • Size

    1.7MB

  • Sample

    240110-2mgcxaaeb2

  • MD5

    51d11fe38b54b9b7968ffba3da87b319

  • SHA1

    691963d26a4390d2fe0b3e51e4085b7dd17a692c

  • SHA256

    8d3637cd959d0ea44c713b76b6ad46614b8f91a58398cad0f5929cf179cf9e80

  • SHA512

    a398aea2958466245c7fe314c911b03a81df3b03684efe43eb12ada012322945e4f402322d2d1d8b0119602ccc6dd088fc7a7fc77e1411e9ea1a1f59c37cac3d

  • SSDEEP

    24576:LnUVXZQoEVesE6IcY4DCrmBW9M6LbDFUPi9Uu64l6CCV6qvPjLJ+vSCyvtVKYnFI:zoieJhiumBL2k0YcqvX0Tyvt8Yv

Score
10/10
bitrattrojanupx

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

185.157.161.53:97

Attributes
  • communication_password

    56f5d64777d37a2cec5a87a5061a35b4

  • tor_process

    tor

Targets

    • Target

      51d11fe38b54b9b7968ffba3da87b319

    • Size

      1.7MB

    • MD5

      51d11fe38b54b9b7968ffba3da87b319

    • SHA1

      691963d26a4390d2fe0b3e51e4085b7dd17a692c

    • SHA256

      8d3637cd959d0ea44c713b76b6ad46614b8f91a58398cad0f5929cf179cf9e80

    • SHA512

      a398aea2958466245c7fe314c911b03a81df3b03684efe43eb12ada012322945e4f402322d2d1d8b0119602ccc6dd088fc7a7fc77e1411e9ea1a1f59c37cac3d

    • SSDEEP

      24576:LnUVXZQoEVesE6IcY4DCrmBW9M6LbDFUPi9Uu64l6CCV6qvPjLJ+vSCyvtVKYnFI:zoieJhiumBL2k0YcqvX0Tyvt8Yv

    Score
    10/10
    bitrattrojanupx

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

      trojanbitrat

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks