Overview

overview

10

Static

static

10

218a11b0eb...e3.exe

windows7-x64

10

218a11b0eb...e3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    218a11b0ebb032e06663fea721602ed9307a945e21ca1678604cc307194f7ee3

  • Size

    3.8MB

  • Sample

    240229-kshdqabh6s

  • MD5

    5f2724b584f36fe5e1b402e61086b985

  • SHA1

    d574214fee95515ffeedcf3c1a8c4422551793fa

  • SHA256

    218a11b0ebb032e06663fea721602ed9307a945e21ca1678604cc307194f7ee3

  • SHA512

    2b2cf763fa3e8b3630cea4cf701ae699dfc48672a3b060ea936034ca926082a139a517e05450d7b37ccd60e78e2df2b8a343d73f62f0c729f0d1efd15952fae0

  • SSDEEP

    98304:d77Pmq33rE/JDLPWZADUGer7B6iY74M/wmlwXVZ4FB:5+R/eZADUXR

Score
10/10
bitratpersistencetrojan

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

onlyforbit.blogdns.net:1100

Attributes
  • communication_password

    2a27b8144ac02f67687f76782a3b5d8f

  • install_dir

    bitorrent3.8

  • install_file

    bitorrents3.8.exe

  • tor_process

    tor

Targets

    • Target

      218a11b0ebb032e06663fea721602ed9307a945e21ca1678604cc307194f7ee3

    • Size

      3.8MB

    • MD5

      5f2724b584f36fe5e1b402e61086b985

    • SHA1

      d574214fee95515ffeedcf3c1a8c4422551793fa

    • SHA256

      218a11b0ebb032e06663fea721602ed9307a945e21ca1678604cc307194f7ee3

    • SHA512

      2b2cf763fa3e8b3630cea4cf701ae699dfc48672a3b060ea936034ca926082a139a517e05450d7b37ccd60e78e2df2b8a343d73f62f0c729f0d1efd15952fae0

    • SSDEEP

      98304:d77Pmq33rE/JDLPWZADUGer7B6iY74M/wmlwXVZ4FB:5+R/eZADUXR

    Score
    10/10
    bitratpersistencetrojan

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

      trojanbitrat

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks