Overview

overview

10

Static

static

3

c63582cc8c...f3.exe

windows7-x64

10

c63582cc8c...f3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c63582cc8c24d69e4bb0829e71f395f3

  • Size

    2.5MB

  • Sample

    240313-sqw34agd5t

  • MD5

    c63582cc8c24d69e4bb0829e71f395f3

  • SHA1

    b789bcd4020aa3bd35ad11a2fbe023772b98a648

  • SHA256

    79f721fce9ff531d55a30dca577a8c55790d9a5b88158654e1daee60e4ed014a

  • SHA512

    170c288927099f254a16ad52155e1ebba2067bab3e8b9e771a81b9946ce3c854ff7275b74911ab8e111e32efd667bcd2359aca3effca41d59447fa57df3beaad

  • SSDEEP

    49152:zb30Hlkz8scuXSG6sIr4ulgbRYfbSVfbpQxLK/SejMqzMgJKl:JoBuXL6sIUueFYfb0f1hMqQgUl

Score
10/10
bitratpersistencetrojanupx

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

jairoandresotalvarorend.linkpc.net:9084

Attributes
  • communication_password

    bfdba24ee3d61f0260c4dc1034c3ee43

  • install_dir

    winlogomdefenerec

  • install_file

    winlogomdefenerec.exe

  • tor_process

    tor

Targets

    • Target

      c63582cc8c24d69e4bb0829e71f395f3

    • Size

      2.5MB

    • MD5

      c63582cc8c24d69e4bb0829e71f395f3

    • SHA1

      b789bcd4020aa3bd35ad11a2fbe023772b98a648

    • SHA256

      79f721fce9ff531d55a30dca577a8c55790d9a5b88158654e1daee60e4ed014a

    • SHA512

      170c288927099f254a16ad52155e1ebba2067bab3e8b9e771a81b9946ce3c854ff7275b74911ab8e111e32efd667bcd2359aca3effca41d59447fa57df3beaad

    • SSDEEP

      49152:zb30Hlkz8scuXSG6sIr4ulgbRYfbSVfbpQxLK/SejMqzMgJKl:JoBuXL6sIUueFYfb0f1hMqQgUl

    Score
    10/10
    bitratpersistencetrojanupx

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

      trojanbitrat

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks