bitrat | d151ec74b0a409363d9401eeb348efaa[.]bin

General

Target
d151ec74b0a409363d9401eeb348efaa.bin
Size 7.8MB
Sample240409-q5bplagf55
SHA256 def365ca4816c8d33a32a6ccf7632a875c77672c2c148d6720e8b26f66e5eec6
MD5 d151ec74b0a409363d9401eeb348efaa
SHA1 36aefe3ff9c3f0d0318288259b2b7473855972fd
SHA512 053d850ef72a40d11735f927bf17f6df542eba622895c3a61c9294d79037c67330dfe7a6b81ec50e3a2bd8612504bdbf81161aae7925be8e2612c752725022ec
SSDEEP 196608:LIRcbH4jSteTGvzxwhzav1yo31CPwDv3uFZjeg2EeJUO9WLQkDxtw3iFFrS6XOf:LdHsfuzxwZ6v1CPwDv3uFteg2EeJUO9E
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

bitrat

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

tcki6mrrcnrt33qy52viv7m64y6hepkv646nnzglrkbgytyt6b2hdrid.onion:80

Attributes

communication_password
827ccb0eea8a706c4c34a16891f84e7b
tor_process
dllhost

Signatures

Bitrat family
bitrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d151ec74b0a409363d9401eeb348efaa.bin

File Explorer

d151ec74b0a409363d9401eeb348efaa.bin

.exe 7.8MB

d151ec74b0a409363d9401eeb348efaa.bin

IMPHASH 2b817dc1b1849c6a436f0647be7673e0
SHA256 def365ca4816c8d33a32a6ccf7632a875c77672c2c148d6720e8b26f66e5eec6
MD5 d151ec74b0a409363d9401eeb348efaa
SHA1 36aefe3ff9c3f0d0318288259b2b7473855972fd
SHA512 053d850ef72a40d11735f927bf17f6df542eba622895c3a61c9294d79037c67330dfe7a6b81ec50e3a2bd8612504bdbf81161aae7925be8e2612c752725022ec
SSDEEP 196608:LIRcbH4jSteTGvzxwhzav1yo31CPwDv3uFZjeg2EeJUO9WLQkDxtw3iFFrS6XOf:LdHsfuzxwZ6v1CPwDv3uFteg2EeJUO9E
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

2660178

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

HeapFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx HeapSize PostQueuedCompletionStatus FormatMessageW GetLastError SetEvent TlsAlloc HeapReAlloc CloseHandle RaiseException HeapAlloc DecodePointer HeapDestroy LocalFree DeleteCriticalSection GetProcessHeap WideCharToMultiByte TlsFree FormatMessageA CreateEventA GetCurrentProcess GetSystemTimes GetTickCount64 GetProcessTimes SetWaitableTimer TlsSetValue SetLastError CreateWaitableTimerW WaitForMultipleObjects InitializeCriticalSectionAndSpinCount GetQueuedCompletionStatus WaitForSingleObject GetModuleHandleA CreateEventW MultiByteToWideChar TerminateThread QueueUserAPC GetProcAddress VerSetConditionMask SleepEx VerifyVersionInfoW TlsGetValue GetSystemTimeAsFileTime CreateIoCompletionPort CreateDirectoryW ReadFile SizeofResource QueryDosDeviceW GetVolumeInformationW FindFirstFileW WriteProcessMemory FindFirstFileExW SetPriorityClass VirtualFree GetFullPathNameW FindNextFileW lstrlenW WriteFile Wow64DisableWow64FsRedirection GetSystemDefaultUILanguage GetDiskFreeSpaceW VirtualAlloc TerminateProcess GetDriveTypeA GetModuleFileNameW GetUserDefaultLocaleName GetProcessId K32GetModuleFileNameExW GetProductInfo Thread32Next GetTempPathW CreateMutexW Thread32First FindClose GetLocaleInfoW CreateFileW GetFileAttributesW GetCurrentThreadId GetVersionExW K32GetProcessImageFileNameW SuspendThread GetSystemDirectoryW ResumeThread lstrcatA OpenProcess SetFileAttributesW GetLogicalDriveStringsW CreateToolhelp32Snapshot Sleep CopyFileA Process32NextW K32GetProcessMemoryInfo CreateFileA GetCurrentThread LoadLibraryA LockResource GlobalAlloc Process32FirstW GlobalFree GetNativeSystemInfo GetSystemInfo LoadLibraryW FindResourceExW LoadResource FindResourceW SetFileAttributesA GetThreadContext GetPriorityClass GlobalLock VirtualAllocEx MoveFileExW GetFileSize ExitProcess ReadProcessMemory GetComputerNameW FindFirstStreamW GetCurrentProcessId SystemTimeToFileTime GlobalMemoryStatusEx CreateProcessW GetModuleHandleW WinExec CreateRemoteThread QueryFullProcessImageNameW CreateProcessA DebugBreak SetThreadContext FindNextStreamW GetTickCount GlobalUnlock GetDriveTypeW GetFileTime OpenThread GetExitCodeProcess Beep CreatePipe PeekNamedPipe GetStartupInfoA lstrcpyA CreateThread CreateTimerQueueTimer VirtualProtect GetCommandLineW DeviceIoControl GetEnvironmentVariableW GetExitCodeThread FreeLibrary IsDebuggerPresent CreateTimerQueue EncodePointer TryEnterCriticalSection DuplicateHandle WaitForSingleObjectEx QueryPerformanceCounter QueryPerformanceFrequency GetFileAttributesExW GetFileInformationByHandle SetEndOfFile SetFilePointerEx AreFileApisANSI GetStringTypeW GetCPInfo CompareStringW LCMapStringW OutputDebugStringW InitializeCriticalSection GetSystemDirectoryA VerifyVersionInfoA ExpandEnvironmentStringsA GetStdHandle GetFileType ResetEvent ReleaseSemaphore OpenEventA GetLogicalProcessorInformation GetCurrentDirectoryW DeleteFileW RemoveDirectoryW CreateDirectoryExW GetFileSizeEx SwitchToFiber DeleteFiber CreateFiber ConvertFiberToThread ConvertThreadToFiber GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW GetSystemTime InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx RegisterWaitForSingleObject GetThreadTimes FreeLibraryAndExitThread LoadLibraryExW SignalObjectAndWait SwitchToThread SetThreadPriority GetThreadPriority ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask UnregisterWait UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW RtlUnwind SetConsoleCtrlHandler ExitThread GetModuleHandleExW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetModuleFileNameA WriteConsoleW SetEnvironmentVariableA GetACP GetConsoleCP GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers SetStdHandle GetTimeZoneInformation FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW VirtualQuery LoadLibraryExA

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

688KB

Virtual Size

687KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

72KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4.0MB

Virtual Size

4.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

147KB

Virtual Size

146KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=30, id=241, version=40116,

count=199, id=243, version=40116,

count=36, id=242, version=40116,

count=6, id=199, version=41118,

count=28, id=259, version=24123,

count=359, id=260, productName=VS2019 v16.8.3 build 29335, version=29335,

count=10, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=92, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=4, id=208, version=65501,

count=1, id=209, version=65501,

count=3, id=203, version=65501,

count=581, id=1, productName=Unmarked objects,

count=2, id=261, version=23013,

count=5, id=206, version=65501,

count=42, id=260, version=24123,

count=133, id=261, version=24123,

count=138, id=265, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

d151ec74b0a409363d9401eeb348efaa.bin

kernel32

generic