bitrat | 7e362d3f43b007df435a0f3ec47c3a84851b56c3ff77875399d94ae32783ad7a

Target

b960516dbba002bdd037ada7f1b06a5b
Size

7.2MB
Sample

240307-w4hdmsae35
MD5

b960516dbba002bdd037ada7f1b06a5b
SHA1

e1e1332833b253cb3a012a1ee98f73bab2a912d1
SHA256

7e362d3f43b007df435a0f3ec47c3a84851b56c3ff77875399d94ae32783ad7a
SHA512

cb026ef01582506af21a03c4894e91d46bafe21ab909c915dbb6bc5de78ce959c24cb538cc74efedac2698315100031df660969ae2052328b10db2ac9612c948
SSDEEP

196608:WSiMHV9Zxwhzav1yo31CPwDv3uFZjeg2EeJUO9WLQkDxtw3iFFrS6XOfTV73c+:WSiMHV9ZxwZ6v1CPwDv3uFteg2EeJUOl

Score

10^/10

Malware Config

Extracted

Family

bitrat

Version

1.32

lvyowbbwycqoqwjmpmnpfyhzdcvxthuuabmcsocjamvzfgwzdat5wwid.onion:80

Attributes

communication_password
31f943bd559a10ccec7dc2356aba02aa
install_dir
System
install_file
system32.exe
tor_process
system32

Targets

- Target
  
  b960516dbba002bdd037ada7f1b06a5b
- Size
  
  7.2MB
- MD5
  
  b960516dbba002bdd037ada7f1b06a5b
- SHA1
  
  e1e1332833b253cb3a012a1ee98f73bab2a912d1
- SHA256
  
  7e362d3f43b007df435a0f3ec47c3a84851b56c3ff77875399d94ae32783ad7a
- SHA512
  
  cb026ef01582506af21a03c4894e91d46bafe21ab909c915dbb6bc5de78ce959c24cb538cc74efedac2698315100031df660969ae2052328b10db2ac9612c948
- SSDEEP
  
  196608:WSiMHV9Zxwhzav1yo31CPwDv3uFZjeg2EeJUO9WLQkDxtw3iFFrS6XOfTV73c+:WSiMHV9ZxwZ6v1CPwDv3uFteg2EeJUOl
Score

7^/10

persistence upx
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Targets

ACProtect 1.3x - 1.4x DLL software

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

UPX packed file

Adds Run key to start application

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2