bitrat | 9c6bda87c91a4bb5b1a70a76d7fe4486_JaffaCakes118

General

Target
9c6bda87c91a4bb5b1a70a76d7fe4486_JaffaCakes118
Size 3.8MB
Sample240403-bwcszaca32
SHA256 8a82d9904985c9779c317052ad31585aacdf6b745b88a5ec3a8bcb697a8e9a8d
MD5 9c6bda87c91a4bb5b1a70a76d7fe4486
SHA1 1732841f6f297ee0e596e36252c799922acc74ad
SHA512 e959b556796c9d5c152a38ab94398c5c4b23522ee2c991d7587484f7899582da485aacff67bb3e4e47d47c99f6a4d235f4ab5c05de4d41880b8d55ddef4b71ec
SSDEEP 98304:877Pmq33rE/JDLPWZADUGer7B6iY74M/ZmlwXVZaFB:K+R/eZADUXR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

bitrat

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

103.133.110.241:3390

Attributes

communication_password
e10adc3949ba59abbe56e057f20f883e
tor_process
tor

Signatures

Bitrat family
bitrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9c6bda87c91a4bb5b1a70a76d7fe4486_JaffaCakes118

File Explorer

9c6bda87c91a4bb5b1a70a76d7fe4486_JaffaCakes118

.exe 3.8MB

9c6bda87c91a4bb5b1a70a76d7fe4486_JaffaCakes118

IMPHASH 71955ccbbcbb24efa9f89785e7cce225
SHA256 8a82d9904985c9779c317052ad31585aacdf6b745b88a5ec3a8bcb697a8e9a8d
MD5 9c6bda87c91a4bb5b1a70a76d7fe4486
SHA1 1732841f6f297ee0e596e36252c799922acc74ad
SHA512 e959b556796c9d5c152a38ab94398c5c4b23522ee2c991d7587484f7899582da485aacff67bb3e4e47d47c99f6a4d235f4ab5c05de4d41880b8d55ddef4b71ec
SSDEEP 98304:877Pmq33rE/JDLPWZADUGer7B6iY74M/ZmlwXVZaFB:K+R/eZADUXR
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

2663560

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

HeapFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx HeapSize PostQueuedCompletionStatus FormatMessageW GetLastError SetEvent TlsAlloc HeapReAlloc CloseHandle RaiseException HeapAlloc DecodePointer HeapDestroy LocalFree DeleteCriticalSection GetProcessHeap WideCharToMultiByte TlsFree FormatMessageA CreateEventA GetCurrentProcess GetSystemTimes GetTickCount64 GetProcessTimes SetWaitableTimer TlsSetValue SetLastError CreateWaitableTimerW WaitForMultipleObjects InitializeCriticalSectionAndSpinCount GetQueuedCompletionStatus WaitForSingleObject GetModuleHandleA CreateEventW MultiByteToWideChar TerminateThread QueueUserAPC GetProcAddress VerSetConditionMask SleepEx VerifyVersionInfoW TlsGetValue GetSystemTimeAsFileTime CreateIoCompletionPort CreateDirectoryW ReadFile SizeofResource QueryDosDeviceW GetVolumeInformationW FindFirstFileW WriteProcessMemory FindFirstFileExW SetPriorityClass VirtualFree GetFullPathNameW FindNextFileW lstrlenW WriteFile Wow64DisableWow64FsRedirection GetSystemDefaultUILanguage GetDiskFreeSpaceW VirtualAlloc TerminateProcess GetDriveTypeA GetModuleFileNameW GetUserDefaultLocaleName GetProcessId K32GetModuleFileNameExW GetProductInfo Thread32Next GetTempPathW CreateMutexW Thread32First FindClose GetLocaleInfoW CreateFileW GetFileAttributesW GetCurrentThreadId GetVersionExW K32GetProcessImageFileNameW SuspendThread GetSystemDirectoryW ResumeThread lstrcatA OpenProcess SetFileAttributesW GetLogicalDriveStringsW CreateToolhelp32Snapshot Sleep CopyFileA Process32NextW K32GetProcessMemoryInfo CreateFileA GetCurrentThread LoadLibraryA LockResource GlobalAlloc Process32FirstW GlobalFree GetNativeSystemInfo GetSystemInfo LoadLibraryW FindResourceExW LoadResource FindResourceW SetFileAttributesA GetThreadContext GetPriorityClass GlobalLock VirtualAllocEx MoveFileExW GetFileSize ExitProcess ReadProcessMemory GetComputerNameW FindFirstStreamW GetCurrentProcessId SystemTimeToFileTime GlobalMemoryStatusEx CreateProcessW GetModuleHandleW WinExec CreateRemoteThread QueryFullProcessImageNameW CreateProcessA DebugBreak SetThreadContext FindNextStreamW GetTickCount GlobalUnlock GetDriveTypeW GetFileTime OpenThread GetExitCodeProcess Beep CreatePipe PeekNamedPipe GetStartupInfoA lstrcpyA CreateThread CreateTimerQueueTimer VirtualProtect GetCommandLineW DeviceIoControl GetEnvironmentVariableW GetExitCodeThread FreeLibrary IsDebuggerPresent CreateTimerQueue EncodePointer TryEnterCriticalSection DuplicateHandle WaitForSingleObjectEx QueryPerformanceCounter GetFileAttributesExW GetFileInformationByHandle SetEndOfFile SetFilePointerEx AreFileApisANSI GetStringTypeW GetCPInfo CompareStringW LCMapStringW OutputDebugStringW InitializeCriticalSection GetSystemDirectoryA VerifyVersionInfoA ExpandEnvironmentStringsA GetStdHandle GetFileType ResetEvent ReleaseSemaphore OpenEventA GetLogicalProcessorInformation GetCurrentDirectoryW DeleteFileW RemoveDirectoryW CreateDirectoryExW GetFileSizeEx SwitchToFiber DeleteFiber CreateFiber ConvertFiberToThread ConvertThreadToFiber GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW GetSystemTime InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx RegisterWaitForSingleObject GetThreadTimes FreeLibraryAndExitThread LoadLibraryExW SignalObjectAndWait SwitchToThread SetThreadPriority GetThreadPriority ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask UnregisterWait UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW RtlUnwind SetConsoleCtrlHandler ExitThread GetModuleHandleExW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetModuleFileNameA WriteConsoleW SetEnvironmentVariableA GetACP GetConsoleCP GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers SetStdHandle GetTimeZoneInformation FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW VirtualQuery LoadLibraryExA

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

687KB

Virtual Size

686KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

72KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

146KB

Virtual Size

146KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=30, id=241, version=40116,

count=199, id=243, version=40116,

count=36, id=242, version=40116,

count=6, id=199, version=41118,

count=28, id=259, version=24123,

count=359, id=260, productName=VS2019 v16.8.3 build 29335, version=29335,

count=10, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=92, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=4, id=208, version=65501,

count=1, id=209, version=65501,

count=3, id=203, version=65501,

count=581, id=1, productName=Unmarked objects,

count=2, id=261, version=23013,

count=5, id=206, version=65501,

count=42, id=260, version=24123,

count=133, id=261, version=24123,

count=138, id=265, version=24215,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

9c6bda87c91a4bb5b1a70a76d7fe4486_JaffaCakes118

kernel32

generic