Resubmissions
17-04-2024 14:47
240417-r6de9acg59 1017-04-2024 14:47
240417-r6ctqaec2s 1017-04-2024 14:47
240417-r6az5acg56 1017-04-2024 14:47
240417-r6apcseb9z 1017-04-2024 14:47
240417-r59gascg54 1015-04-2024 13:15
240415-qhmtcahe7v 1010-04-2024 08:18
240410-j7smkacd9y 1010-04-2024 08:18
240410-j7r12ahc48 1010-04-2024 08:18
240410-j7q4qshc46 1010-04-2024 08:17
240410-j6pvaahc28 10Behavioral task
behavioral1
Sample
b960516dbba002bdd037ada7f1b06a5b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b960516dbba002bdd037ada7f1b06a5b.exe
Resource
win10v2004-20231215-en
General
-
Target
b960516dbba002bdd037ada7f1b06a5b
-
Size
7.2MB
-
MD5
b960516dbba002bdd037ada7f1b06a5b
-
SHA1
e1e1332833b253cb3a012a1ee98f73bab2a912d1
-
SHA256
7e362d3f43b007df435a0f3ec47c3a84851b56c3ff77875399d94ae32783ad7a
-
SHA512
cb026ef01582506af21a03c4894e91d46bafe21ab909c915dbb6bc5de78ce959c24cb538cc74efedac2698315100031df660969ae2052328b10db2ac9612c948
-
SSDEEP
196608:WSiMHV9Zxwhzav1yo31CPwDv3uFZjeg2EeJUO9WLQkDxtw3iFFrS6XOfTV73c+:WSiMHV9ZxwZ6v1CPwDv3uFteg2EeJUOl
Malware Config
Extracted
bitrat
1.32
lvyowbbwycqoqwjmpmnpfyhzdcvxthuuabmcsocjamvzfgwzdat5wwid.onion:80
-
communication_password
31f943bd559a10ccec7dc2356aba02aa
-
install_dir
System
-
install_file
system32.exe
-
tor_process
system32
Signatures
-
Bitrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b960516dbba002bdd037ada7f1b06a5b
Files
-
b960516dbba002bdd037ada7f1b06a5b.exe windows:5 windows x86 arch:x86
ad1e28b0d11176e35c63a9e8943a3c26
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
HeapSize
PostQueuedCompletionStatus
FormatMessageW
GetLastError
SetEvent
TlsAlloc
HeapReAlloc
CloseHandle
RaiseException
HeapAlloc
DecodePointer
HeapDestroy
LocalFree
DeleteCriticalSection
GetProcessHeap
WideCharToMultiByte
TlsFree
FormatMessageA
CreateEventA
GetCurrentProcess
GetSystemTimes
GetTickCount64
GetProcessTimes
SetWaitableTimer
TlsSetValue
SetLastError
CreateWaitableTimerW
WaitForMultipleObjects
InitializeCriticalSectionAndSpinCount
GetQueuedCompletionStatus
WaitForSingleObject
GetModuleHandleA
CreateEventW
MultiByteToWideChar
TerminateThread
QueueUserAPC
GetProcAddress
VerSetConditionMask
SleepEx
VerifyVersionInfoW
TlsGetValue
GetSystemTimeAsFileTime
CreateIoCompletionPort
CreateDirectoryW
ReadFile
SizeofResource
QueryDosDeviceW
GetVolumeInformationW
FindFirstFileW
WriteProcessMemory
FindFirstFileExW
SetPriorityClass
VirtualFree
GetFullPathNameW
FindNextFileW
lstrlenW
Wow64DisableWow64FsRedirection
GetSystemDefaultUILanguage
GetDiskFreeSpaceW
VirtualAlloc
TerminateProcess
GetModuleFileNameW
GetUserDefaultLocaleName
GetProcessId
K32GetModuleFileNameExW
GetProductInfo
Thread32Next
GetTempPathW
CreateMutexW
Thread32First
FindClose
GetLocaleInfoW
CreateFileW
GetFileAttributesW
GetVersionExW
K32GetProcessImageFileNameW
SuspendThread
GetSystemDirectoryW
ResumeThread
lstrcatA
OpenProcess
GetLogicalDriveStringsW
CreateToolhelp32Snapshot
Sleep
Process32NextW
K32GetProcessMemoryInfo
CreateFileA
GetCurrentThread
LoadLibraryA
LockResource
GlobalAlloc
Process32FirstW
GlobalFree
GetNativeSystemInfo
GetSystemInfo
FindResourceExW
LoadResource
FindResourceW
GetThreadContext
GetPriorityClass
GlobalLock
VirtualAllocEx
MoveFileExW
GetFileSize
ExitProcess
ReadProcessMemory
GetComputerNameW
FindFirstStreamW
GetCurrentProcessId
SystemTimeToFileTime
GlobalMemoryStatusEx
CreateProcessW
WinExec
QueryFullProcessImageNameW
CreateProcessA
DebugBreak
SetThreadContext
FindNextStreamW
GetTickCount
GlobalUnlock
GetDriveTypeW
GetFileTime
OpenThread
GetExitCodeProcess
Beep
WriteFile
CreatePipe
PeekNamedPipe
GetStartupInfoA
SetThreadPriority
GetCurrentThreadId
lstrcpyA
CreateThread
CreateTimerQueueTimer
VirtualProtect
GetCommandLineW
DeviceIoControl
GetExitCodeThread
LoadLibraryW
GetModuleHandleW
FreeLibrary
IsDebuggerPresent
CreateTimerQueue
EncodePointer
TryEnterCriticalSection
DuplicateHandle
WaitForSingleObjectEx
QueryPerformanceCounter
QueryPerformanceFrequency
GetFileAttributesExW
GetFileInformationByHandle
SetEndOfFile
SetFilePointerEx
AreFileApisANSI
GetStringTypeW
GetCPInfo
CompareStringW
LCMapStringW
OutputDebugStringW
ResetEvent
ReleaseSemaphore
OpenEventA
GetLogicalProcessorInformation
GetCurrentDirectoryW
DeleteFileW
RemoveDirectoryW
CreateDirectoryExW
GetFileSizeEx
GetFileType
GetStdHandle
GetSystemTime
InitializeCriticalSection
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RegisterWaitForSingleObject
GetThreadTimes
FreeLibraryAndExitThread
LoadLibraryExW
SignalObjectAndWait
SwitchToThread
GetThreadPriority
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
UnregisterWait
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
RtlUnwind
SetConsoleCtrlHandler
ExitThread
GetModuleHandleExW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetModuleFileNameA
WriteConsoleW
SetEnvironmentVariableA
GetACP
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetStdHandle
GetTimeZoneInformation
ReadConsoleW
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
VirtualQuery
LoadLibraryExA
Sections
.text Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 594KB - Virtual size: 594KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 69KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4.0MB - Virtual size: 4.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 122KB - Virtual size: 121KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ