Overview

overview

10

Static

static

3

955ac34a2a...42.exe

windows7-x64

10

955ac34a2a...42.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    955ac34a2a20fd96b038376ec0ed5142

  • Size

    1.7MB

  • Sample

    240206-ytldnafbb8

  • MD5

    955ac34a2a20fd96b038376ec0ed5142

  • SHA1

    d38a1ba30cd2711ffb46fa72bdaf0f29cb7d1964

  • SHA256

    18b96a50da281d031e2ce58c2143a9c1bf4868c710bbcc61b7d147038b449e2b

  • SHA512

    5d2de60a4529a4ae49448ecd30ee688f5d5367d33bb900eb7edb9bd8d7a1743063b8f004843c9351e4a4a92becfd2264a9e5ab3fbdbb3fbedb3940c3024441bd

  • SSDEEP

    24576:ufNb0+uSi+JZxvZZHUqDBUP+OeEQIehk8BylYTiKjX8aHEYn0NLG8drnJviDEAoL:Oi+JZplKP+OeIO5CUgLG9DWKDEb

Score
10/10
bitrattrojanupx

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

eewe.ddns.net:2880

Attributes
  • communication_password

    b18aba2f7c3bf981f4caba4a41e6b205

  • tor_process

    tor

Targets

    • Target

      955ac34a2a20fd96b038376ec0ed5142

    • Size

      1.7MB

    • MD5

      955ac34a2a20fd96b038376ec0ed5142

    • SHA1

      d38a1ba30cd2711ffb46fa72bdaf0f29cb7d1964

    • SHA256

      18b96a50da281d031e2ce58c2143a9c1bf4868c710bbcc61b7d147038b449e2b

    • SHA512

      5d2de60a4529a4ae49448ecd30ee688f5d5367d33bb900eb7edb9bd8d7a1743063b8f004843c9351e4a4a92becfd2264a9e5ab3fbdbb3fbedb3940c3024441bd

    • SSDEEP

      24576:ufNb0+uSi+JZxvZZHUqDBUP+OeEQIehk8BylYTiKjX8aHEYn0NLG8drnJviDEAoL:Oi+JZplKP+OeIO5CUgLG9DWKDEb

    Score
    10/10
    bitrattrojanupx

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

      trojanbitrat

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks