Overview

overview

10

Static

static

10

6ec74da213...97.exe

windows7-x64

10

Resubmissions

11/04/2024, 07:23

240411-h79qeaee7710

11/04/2024, 07:22

240411-h7ha6aee6510

11/04/2024, 07:22

240411-h7g1dshf5x10

11/04/2024, 07:22

240411-h7gdvsee6310

11/04/2024, 07:22

240411-h7fsbshf5w10

07/04/2024, 08:58

240407-kxh6tahg7510

07/04/2024, 07:55

240407-jr6jgsgd3z10

07/04/2024, 07:54

240407-jrz2psgh2810

07/04/2024, 07:54

240407-jrvf8agd3w10

07/04/2024, 07:51

240407-jqb89agg7610

Sharing

Copy URL Twitter E-mail

General

  • Target
    6ec74da2134bd56250ca32be04b9b697
  • Size 7.8MB
  • Sample240407-jqb89agg76
  • SHA256 1ab1a15e1e4a19c7d77a01f00de5d401bc7ab0ffaa33c332788aadeeedddc386
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
bitratpersistencetrojanupx

Malware Config

Targets

    • Target
      6ec74da2134bd56250ca32be04b9b697
    • Size 7.8MB
    • SHA256 1ab1a15e1e4a19c7d77a01f00de5d401bc7ab0ffaa33c332788aadeeedddc386
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    bitratpersistencetrojanupx

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

      trojanbitrat

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks