Overview

overview

10

Static

static

3

76563f561f...fa.exe

windows7-x64

10

76563f561f...fa.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    76563f561fd009f9ec176320657feafa

  • Size

    1.5MB

  • Sample

    240126-enejdadgd7

  • MD5

    76563f561fd009f9ec176320657feafa

  • SHA1

    2f962b8a65165945c3582a49d9a410537abbc964

  • SHA256

    92fc50fbd75a13621c3d64e1ded8617c4c9f92072010f0735d050c06ba73d995

  • SHA512

    91f6dbf03f60382bdb6e3a2acb9d9b3e985abd23e2d74b1dff1b4a4c487791e7d7c068a85804e92eb67cfaecb4c33da8dbcf953c7f39204e819f1a71e9e3072e

  • SSDEEP

    24576:PKaLfALjE7E29i/dB2MJwdLN+93CyfFrwb3RtD5VwlngfdqcKn:jLfALjufc/6yIh2SyfNwbhtD5+lnW6n

Score
10/10
bitrattrojanupx

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

212.192.246.250:4480

Attributes
  • communication_password

    a86d0c9f7960056a9056c953ba47a617

  • tor_process

    tor

Targets

    • Target

      76563f561fd009f9ec176320657feafa

    • Size

      1.5MB

    • MD5

      76563f561fd009f9ec176320657feafa

    • SHA1

      2f962b8a65165945c3582a49d9a410537abbc964

    • SHA256

      92fc50fbd75a13621c3d64e1ded8617c4c9f92072010f0735d050c06ba73d995

    • SHA512

      91f6dbf03f60382bdb6e3a2acb9d9b3e985abd23e2d74b1dff1b4a4c487791e7d7c068a85804e92eb67cfaecb4c33da8dbcf953c7f39204e819f1a71e9e3072e

    • SSDEEP

      24576:PKaLfALjE7E29i/dB2MJwdLN+93CyfFrwb3RtD5VwlngfdqcKn:jLfALjufc/6yIh2SyfNwbhtD5+lnW6n

    Score
    10/10
    bitrattrojanupx

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

      trojanbitrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Uses the VBS compiler for execution

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scripting

1
T1064

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Scripting

1
T1064

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks