Overview

overview

10

Static

static

3

537d313f3d...49.exe

windows7-x64

10

537d313f3d...49.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    537d313f3dfe75d7a9d4f36f80cce049

  • Size

    1.8MB

  • Sample

    240111-peeg5agcg6

  • MD5

    537d313f3dfe75d7a9d4f36f80cce049

  • SHA1

    a9d34d4ef62afbeed8f74c18c212e2c1d4c3f7cb

  • SHA256

    6d7fac5d7bfe833eb0756a174ceb9ea8280cd3f9858215924284af1b559bd81f

  • SHA512

    c4b698a6058f935c1db07ac92ae5e39a2e90f9e07d536ab2b6045ca539115bd1f5c7088f51d12a9edaab76befc41b0e8584a2cef4c1f906366d0a09687bbea9c

  • SSDEEP

    49152:pAESWFubG04k1ImcRlJtquEwR/r28SJ4tIMBegTbV:MZGXk12nt5Fr28Sqt7UgTbV

Score
10/10
bitratzgratrattrojanupx

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

eter102.dvrlists.com:3050

Attributes
  • communication_password

    fea0f7015af40ae69a386f06f28a8d31

  • tor_process

    tor

Targets

    • Target

      537d313f3dfe75d7a9d4f36f80cce049

    • Size

      1.8MB

    • MD5

      537d313f3dfe75d7a9d4f36f80cce049

    • SHA1

      a9d34d4ef62afbeed8f74c18c212e2c1d4c3f7cb

    • SHA256

      6d7fac5d7bfe833eb0756a174ceb9ea8280cd3f9858215924284af1b559bd81f

    • SHA512

      c4b698a6058f935c1db07ac92ae5e39a2e90f9e07d536ab2b6045ca539115bd1f5c7088f51d12a9edaab76befc41b0e8584a2cef4c1f906366d0a09687bbea9c

    • SSDEEP

      49152:pAESWFubG04k1ImcRlJtquEwR/r28SJ4tIMBegTbV:MZGXk12nt5Fr28Sqt7UgTbV

    Score
    10/10
    zgratratbitrattrojanupx

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

      trojanbitrat

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks