bitrat | f3aaf224ffeaa26e00a6395a3b0a80b5_JaffaCakes118

General

Target
f3aaf224ffeaa26e00a6395a3b0a80b5_JaffaCakes118
Size 1.4MB
Sample240416-rmw39acb36
SHA256 f1041f8beb103e1f63fa8d5234ed3b5a55a37d1c675755040dbb08836c210a90
MD5 f3aaf224ffeaa26e00a6395a3b0a80b5
SHA1 0bd9bb2e64578afd1a818a92e37177a01cae68e6
SHA512 ea25d8c9b6f34dd46981cec5627ddd1f48270da0d1d4dc3debf16d68311aaafaff8b7c6e373e3f056c996c6dca2f559e551b6d6d78765614f7803c2b54570326
SSDEEP 24576:UndRKZCy2BrhCeU2i2cJijFbCBTPmiY05tJMSQp5ysA7Yg1nLkz1xKWf:uXDFBU2iIBb0xY/6sUYYi
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

upx bitrat

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

8.208.27.150:4550

Attributes

communication_password
9996535e07258a7bbfd8b132435c5962
tor_process
tor

Signatures

Bitrat family
bitrat

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
f3aaf224ffeaa26e00a6395a3b0a80b5_JaffaCakes118
unpack001/out.upx

File Explorer

f3aaf224ffeaa26e00a6395a3b0a80b5_JaffaCakes118

.exe 1.4MB
out.upx

.exe 3.8MB

f3aaf224ffeaa26e00a6395a3b0a80b5_JaffaCakes118

SHA256 f1041f8beb103e1f63fa8d5234ed3b5a55a37d1c675755040dbb08836c210a90
MD5 f3aaf224ffeaa26e00a6395a3b0a80b5
SHA1 0bd9bb2e64578afd1a818a92e37177a01cae68e6
SHA512 ea25d8c9b6f34dd46981cec5627ddd1f48270da0d1d4dc3debf16d68311aaafaff8b7c6e373e3f056c996c6dca2f559e551b6d6d78765614f7803c2b54570326
SSDEEP 24576:UndRKZCy2BrhCeU2i2cJijFbCBTPmiY05tJMSQp5ysA7Yg1nLkz1xKWf:uXDFBU2iIBb0xY/6sUYYi
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

4073264

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

generic

count=30, id=241, version=40116,

count=199, id=243, version=40116,

count=36, id=242, version=40116,

count=6, id=199, version=41118,

count=28, id=259, version=24123,

count=359, id=260, productName=VS2019 v16.8.3 build 29335, version=29335,

count=10, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=92, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=4, id=208, version=65501,

count=1, id=209, version=65501,

count=3, id=203, version=65501,

count=581, id=1, productName=Unmarked objects,

count=2, id=261, version=23013,

count=5, id=206, version=65501,

count=42, id=260, version=24123,

count=133, id=261, version=24123,

count=138, id=265, version=24215,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,

out.upx

SHA256 722db593b7b65e61b05370b66fa871b5853a51e1b97e40f32956f5db6064ea13
MD5 8a7d73f0a171c9fa31bc22e8416f6349
SHA1 e7dbc11f99a3989a7fa2f1aa82dade7425a1ac9d
SHA512 e72f049f33569fd73724212d29a470cf1856c230e4262630a6c6779755f03c2c34b45325bcb05ca1fbe0edd63b97b6f32bc0edbb2e29b17c166095f02364f4de
SSDEEP 98304:m77Pmq33rE/JDLPWZADUGer7B6iY74M/TmlwXVZ:Y+R/eZADUXR
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

2663560

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

687KB

Virtual Size

686KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

72KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

146KB

Virtual Size

146KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=30, id=241, version=40116,

count=199, id=243, version=40116,

count=36, id=242, version=40116,

count=6, id=199, version=41118,

count=28, id=259, version=24123,

count=359, id=260, productName=VS2019 v16.8.3 build 29335, version=29335,

count=10, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=92, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=4, id=208, version=65501,

count=1, id=209, version=65501,

count=3, id=203, version=65501,

count=581, id=1, productName=Unmarked objects,

count=2, id=261, version=23013,

count=5, id=206, version=65501,

count=42, id=260, version=24123,

count=133, id=261, version=24123,

count=138, id=265, version=24215,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

f3aaf224ffeaa26e00a6395a3b0a80b5_JaffaCakes118

generic

out.upx

generic