Overview

overview

10

Static

static

10

7a0723aff0...fd.exe

windows7-x64

10

7a0723aff0...fd.exe

windows10-2004-x64

10

$TEMP/bibs...RE.dll

windows7-x64

1

$TEMP/bibs...RE.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7a0723aff075673ef855b4e615207dfd

  • Size

    3.6MB

  • Sample

    240127-mtn9rsccgl

  • MD5

    7a0723aff075673ef855b4e615207dfd

  • SHA1

    aa3c1654b4abefe9831f6b60866253b4b8436fe0

  • SHA256

    3cc446d6a658ce7bdf67387d6df73888b2f5ea0a3955f2c11ebdeaec4d589517

  • SHA512

    344444ca7d681f86f0707e5e788c7d20dadbcf8c69cc5afd8a5136e78848737003e5f8320356bd25d0773fb90e3ec0fe2c55d32e6923e43640b6ce204c4ade7c

  • SSDEEP

    98304:XTjwlh++gsHbQN/muXMxx2FKPv2QXMojZ5nYu3zSXYwREF0aQ:XTjKz7gF42kWQXMIjnYu+ow7J

Score
10/10
bitratblisterloadertrojan

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

139.28.219.45:443

Attributes
  • communication_password

    a76d949640a165da25ccfe9a8fd82c8a

  • tor_process

    tor

Targets

    • Target

      7a0723aff075673ef855b4e615207dfd

    • Size

      3.6MB

    • MD5

      7a0723aff075673ef855b4e615207dfd

    • SHA1

      aa3c1654b4abefe9831f6b60866253b4b8436fe0

    • SHA256

      3cc446d6a658ce7bdf67387d6df73888b2f5ea0a3955f2c11ebdeaec4d589517

    • SHA512

      344444ca7d681f86f0707e5e788c7d20dadbcf8c69cc5afd8a5136e78848737003e5f8320356bd25d0773fb90e3ec0fe2c55d32e6923e43640b6ce204c4ade7c

    • SSDEEP

      98304:XTjwlh++gsHbQN/muXMxx2FKPv2QXMojZ5nYu3zSXYwREF0aQ:XTjKz7gF42kWQXMIjnYu+ow7J

    Score
    10/10
    bitratblisterloadertrojan

    • BLISTER

      BLISTER is a downloader used to deliver other malware families.

      loaderblister

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

      trojanbitrat

    • Detect Blister loader x32

      loader

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $TEMP/bibs_work/WMVCORE.DLL

    • Size

      4.9MB

    • MD5

      88fba76c3a7eb0f785903de05fb0bd06

    • SHA1

      35f452a43a838cbad695d596b2cad144cc115074

    • SHA256

      8c981acb2673fa80fa39aa2ba9b1916cb9866b5e8f9ec1cc98bc7fed36b49c61

    • SHA512

      f0bfb7e85de0834c3a3a8448ba4d218d28608b3634bed24590a30e91acb51632b01b09f3734547bca383c8d69a8e4c754337fa7d44a274c458fca04d21c29876

    • SSDEEP

      98304:LXIbjOdRTNhVNwb64wmsBtA8x2nKXp8SXUMjR7VOMRf2TYwTkZ0032:jI4T9N/esBO62KSSXU0FVOM8Uwz

    Score
    1/10
    behavioral3behavioral4

MITRE ATT&CK Matrix ATT&CK v13

Tasks