Overview

overview

10

Static

static

3

5d36a8d835...da.exe

windows7-x64

10

5d36a8d835...da.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5d36a8d835a2207213efed20ee9294da

  • Size

    2.8MB

  • Sample

    240115-qs1syshfa7

  • MD5

    5d36a8d835a2207213efed20ee9294da

  • SHA1

    8a02634c5040755f24cb7bbaf8f4b1577b49761c

  • SHA256

    44648da1ebbf8ed242e9f93b9b8cbe9e035246f245b6b3b22534931725c42499

  • SHA512

    858c52d462fda710b2652dcef4ef5dd9756a6c1bb0633a7f306690c3070f2adce3ccab7623d6f1334420c7f39421c420c7d4c0178bb1893a0d8d0c4f3afcea15

  • SSDEEP

    24576:zQWYepR87h9dgxDq7FzGeeVhTilIqSCdzKPQkaxgA1Zk4OYIExiPInVxw+zyWnM1:5YN7jdg8keeVFmEQ5g5rEgAnV+rWp8

Score
10/10
bitrattrojanupx

Malware Config

Extracted

Family

bitrat

Version

1.33

C2

xpert.dyndns.biz:2224

Attributes
  • communication_password

    194dd40edef1873b88c241057bb55f1b

  • tor_process

    tor

Targets

    • Target

      5d36a8d835a2207213efed20ee9294da

    • Size

      2.8MB

    • MD5

      5d36a8d835a2207213efed20ee9294da

    • SHA1

      8a02634c5040755f24cb7bbaf8f4b1577b49761c

    • SHA256

      44648da1ebbf8ed242e9f93b9b8cbe9e035246f245b6b3b22534931725c42499

    • SHA512

      858c52d462fda710b2652dcef4ef5dd9756a6c1bb0633a7f306690c3070f2adce3ccab7623d6f1334420c7f39421c420c7d4c0178bb1893a0d8d0c4f3afcea15

    • SSDEEP

      24576:zQWYepR87h9dgxDq7FzGeeVhTilIqSCdzKPQkaxgA1Zk4OYIExiPInVxw+zyWnM1:5YN7jdg8keeVFmEQ5g5rEgAnV+rWp8

    Score
    10/10
    bitrattrojanupx

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

      trojanbitrat

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks