03b9dd8b1e16ad5c2a605ad6b18493a7.bin
- SHA256 00ec62acc47ff0297165650e13074aa49207441ee32d6718e72c87ea3e5b817e
Password
infected
Behavioral task
behavioral1
Sample
06f5ae2998205719e3541415641a8afc2f5d6877b50c860df066e0e95c7ed3f3.exe
Resource
win7-20240221-en
windows7-x64
10 signatures
1200 seconds
Behavioral task
behavioral2
Sample
06f5ae2998205719e3541415641a8afc2f5d6877b50c860df066e0e95c7ed3f3.exe
Resource
win10-20240404-en
windows10-1703-x64
11 signatures
1200 seconds
Behavioral task
behavioral3
Sample
06f5ae2998205719e3541415641a8afc2f5d6877b50c860df066e0e95c7ed3f3.exe
Resource
win10v2004-20240319-en
windows10-2004-x64
12 signatures
1200 seconds
Behavioral task
behavioral4
Sample
06f5ae2998205719e3541415641a8afc2f5d6877b50c860df066e0e95c7ed3f3.exe
Resource
win11-20240214-en
windows11-21h2-x64
11 signatures
1200 seconds
General
- Target 03b9dd8b1e16ad5c2a605ad6b18493a7.bin
- Size 4.8MB
- Sample240409-qb91asba2y
- SHA256 00ec62acc47ff0297165650e13074aa49207441ee32d6718e72c87ea3e5b817e
- MD5 109700d193697797637b4ced2afdb74e
- SHA1 3dde85662d63d2cd05b5ff0fac343154d95c0dc8
- SHA512 5033980fbebb1306ae39be2bd4b79f79b79789480f9b6d1e3f307610bd581030ea790ca6e0c35ab93d6b00f3b67b66e7c6584c9a4b09cd14b0eb3bea8b028a10
- SSDEEP 98304:TNeeFxfl8Q0AR5sJi9zF10BOja0eLjuW3xZW+fUZyDKPjl0AMPP+W:fN0q5hV0BOjYju4k+fKwnPPv
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
bitrat
Version
-
1.38
C2
-
tcki6mrrcnrt33qy52viv7m64y6hepkv646nnzglrkbgytyt6b2hdrid.onion:80
Attributes
-
communication_password
827ccb0eea8a706c4c34a16891f84e7b
-
tor_process
dllhost
Signatures
- Bitrat family
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/06f5ae2998205719e3541415641a8afc2f5d6877b50c860df066e0e95c7ed3f3.bin
File Explorer
-
03b9dd8b1e16ad5c2a605ad6b18493a7.bin.zip 4.8MB
-
06f5ae2998205719e3541415641a8afc2f5d6877b50c860df066e0e95c7ed3f3.bin.exe 7.8MB
06f5ae2998205719e3541415641a8afc2f5d6877b50c860df066e0e95c7ed3f3.bin
- IMPHASH 2b817dc1b1849c6a436f0647be7673e0
- SHA256 06f5ae2998205719e3541415641a8afc2f5d6877b50c860df066e0e95c7ed3f3
- MD5 03b9dd8b1e16ad5c2a605ad6b18493a7
- SHA1 725f4473d8e09a8a9fcad2e8900dfb74623d4f18
- SHA512 8c5c077bd7575483b3601221b77e5b49b9acb7181fe73173dd5879cd19b6d517b5f2454390884ea87490da72cb2e37b5d476132f96415a68b209ce740c7b1c4f
- SSDEEP 196608:LIRcbH4jSteTGvwxwhzav1yo31CPwDv3uFZjeg2EeJUO9WLQkDxtw3iFFrS6XOf:LdHsfuwxwZ6v1CPwDv3uFteg2EeJUO9E
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
1
Major OS version
5
Entry point
2660178
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
HeapFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
HeapSize
PostQueuedCompletionStatus
FormatMessageW
GetLastError
SetEvent
TlsAlloc
HeapReAlloc
CloseHandle
RaiseException
HeapAlloc
DecodePointer
HeapDestroy
LocalFree
DeleteCriticalSection
GetProcessHeap
WideCharToMultiByte
TlsFree
FormatMessageA
CreateEventA
GetCurrentProcess
GetSystemTimes
GetTickCount64
GetProcessTimes
SetWaitableTimer
TlsSetValue
SetLastError
CreateWaitableTimerW
WaitForMultipleObjects
InitializeCriticalSectionAndSpinCount
GetQueuedCompletionStatus
WaitForSingleObject
GetModuleHandleA
CreateEventW
MultiByteToWideChar
TerminateThread
QueueUserAPC
GetProcAddress
VerSetConditionMask
SleepEx
VerifyVersionInfoW
TlsGetValue
GetSystemTimeAsFileTime
CreateIoCompletionPort
CreateDirectoryW
ReadFile
SizeofResource
QueryDosDeviceW
GetVolumeInformationW
FindFirstFileW
WriteProcessMemory
FindFirstFileExW
SetPriorityClass
VirtualFree
GetFullPathNameW
FindNextFileW
lstrlenW
WriteFile
Wow64DisableWow64FsRedirection
GetSystemDefaultUILanguage
GetDiskFreeSpaceW
VirtualAlloc
TerminateProcess
GetDriveTypeA
GetModuleFileNameW
GetUserDefaultLocaleName
GetProcessId
K32GetModuleFileNameExW
GetProductInfo
Thread32Next
GetTempPathW
CreateMutexW
Thread32First
FindClose
GetLocaleInfoW
CreateFileW
GetFileAttributesW
GetCurrentThreadId
GetVersionExW
K32GetProcessImageFileNameW
SuspendThread
GetSystemDirectoryW
ResumeThread
lstrcatA
OpenProcess
SetFileAttributesW
GetLogicalDriveStringsW
CreateToolhelp32Snapshot
Sleep
CopyFileA
Process32NextW
K32GetProcessMemoryInfo
CreateFileA
GetCurrentThread
LoadLibraryA
LockResource
GlobalAlloc
Process32FirstW
GlobalFree
GetNativeSystemInfo
GetSystemInfo
LoadLibraryW
FindResourceExW
LoadResource
FindResourceW
SetFileAttributesA
GetThreadContext
GetPriorityClass
GlobalLock
VirtualAllocEx
MoveFileExW
GetFileSize
ExitProcess
ReadProcessMemory
GetComputerNameW
FindFirstStreamW
GetCurrentProcessId
SystemTimeToFileTime
GlobalMemoryStatusEx
CreateProcessW
GetModuleHandleW
WinExec
CreateRemoteThread
QueryFullProcessImageNameW
CreateProcessA
DebugBreak
SetThreadContext
FindNextStreamW
GetTickCount
GlobalUnlock
GetDriveTypeW
GetFileTime
OpenThread
GetExitCodeProcess
Beep
CreatePipe
PeekNamedPipe
GetStartupInfoA
lstrcpyA
CreateThread
CreateTimerQueueTimer
VirtualProtect
GetCommandLineW
DeviceIoControl
GetEnvironmentVariableW
GetExitCodeThread
FreeLibrary
IsDebuggerPresent
CreateTimerQueue
EncodePointer
TryEnterCriticalSection
DuplicateHandle
WaitForSingleObjectEx
QueryPerformanceCounter
QueryPerformanceFrequency
GetFileAttributesExW
GetFileInformationByHandle
SetEndOfFile
SetFilePointerEx
AreFileApisANSI
GetStringTypeW
GetCPInfo
CompareStringW
LCMapStringW
OutputDebugStringW
InitializeCriticalSection
GetSystemDirectoryA
VerifyVersionInfoA
ExpandEnvironmentStringsA
GetStdHandle
GetFileType
ResetEvent
ReleaseSemaphore
OpenEventA
GetLogicalProcessorInformation
GetCurrentDirectoryW
DeleteFileW
RemoveDirectoryW
CreateDirectoryExW
GetFileSizeEx
SwitchToFiber
DeleteFiber
CreateFiber
ConvertFiberToThread
ConvertThreadToFiber
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
GetSystemTime
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RegisterWaitForSingleObject
GetThreadTimes
FreeLibraryAndExitThread
LoadLibraryExW
SignalObjectAndWait
SwitchToThread
SetThreadPriority
GetThreadPriority
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
UnregisterWait
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
RtlUnwind
SetConsoleCtrlHandler
ExitThread
GetModuleHandleExW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetModuleFileNameA
WriteConsoleW
SetEnvironmentVariableA
GetACP
GetConsoleCP
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
SetStdHandle
GetTimeZoneInformation
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
VirtualQuery
LoadLibraryExA
Name
.text
Size
2.9MB
Virtual Size
2.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
688KB
Virtual Size
687KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
72KB
Virtual Size
103KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4.0MB
Virtual Size
4.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
147KB
Virtual Size
146KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=30, id=241, version=40116,
count=199, id=243, version=40116,
count=36, id=242, version=40116,
count=6, id=199, version=41118,
count=28, id=259, version=24123,
count=359, id=260, productName=VS2019 v16.8.3 build 29335, version=29335,
count=10, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,
count=92, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,
count=4, id=208, version=65501,
count=1, id=209, version=65501,
count=3, id=203, version=65501,
count=581, id=1, productName=Unmarked objects,
count=2, id=261, version=23013,
count=5, id=206, version=65501,
count=42, id=260, version=24123,
count=133, id=261, version=24123,
count=138, id=265, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,