bitrat | a7613e5c267e7f270918ef87fcb1e45c

General

Target
a7613e5c267e7f270918ef87fcb1e45c
Size 7.8MB
Sample240417-r7nmlsec7w
SHA256 1b9c4646b8840ef2d2a24603ffa2efa695ee29002c0057d4ba558080f2c485b6
MD5 a7613e5c267e7f270918ef87fcb1e45c
SHA1 5ce965496ce1d9eea2d78548854bd486c11329d1
SHA512 19888cf9937c44770dff47027ada8ef8eaa46cc849717ec0fb46bb32d07434b3b851efa708decd2fa18c07333cc247d35e03d71fbd386caea839bf44cdd7c0d2
SSDEEP 196608:LIRcbH4jSteTGvCxwhzav1yo31CPwDv3uFZjeg2EeJUO9WLQkDxtw3iFFrS6XOf:LdHsfuCxwZ6v1CPwDv3uFteg2EeJUO9E
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

bitrat

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

4napo6g3cp6av4hmxmwzi5lyojpfk3i2kl2tpssb2wvidqsa3kzo6eyd.onion:80

Attributes

communication_password
e10adc3949ba59abbe56e057f20f883e
install_dir
windir
install_file
win32.exe
tor_process
windows32

Signatures

Bitrat family
bitrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a7613e5c267e7f270918ef87fcb1e45c

File Explorer

a7613e5c267e7f270918ef87fcb1e45c

.exe 7.8MB

a7613e5c267e7f270918ef87fcb1e45c

IMPHASH 2b817dc1b1849c6a436f0647be7673e0
SHA256 1b9c4646b8840ef2d2a24603ffa2efa695ee29002c0057d4ba558080f2c485b6
MD5 a7613e5c267e7f270918ef87fcb1e45c
SHA1 5ce965496ce1d9eea2d78548854bd486c11329d1
SHA512 19888cf9937c44770dff47027ada8ef8eaa46cc849717ec0fb46bb32d07434b3b851efa708decd2fa18c07333cc247d35e03d71fbd386caea839bf44cdd7c0d2
SSDEEP 196608:LIRcbH4jSteTGvCxwhzav1yo31CPwDv3uFZjeg2EeJUO9WLQkDxtw3iFFrS6XOf:LdHsfuCxwZ6v1CPwDv3uFteg2EeJUO9E
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

2660178

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

HeapFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx HeapSize PostQueuedCompletionStatus FormatMessageW GetLastError SetEvent TlsAlloc HeapReAlloc CloseHandle RaiseException HeapAlloc DecodePointer HeapDestroy LocalFree DeleteCriticalSection GetProcessHeap WideCharToMultiByte TlsFree FormatMessageA CreateEventA GetCurrentProcess GetSystemTimes GetTickCount64 GetProcessTimes SetWaitableTimer TlsSetValue SetLastError CreateWaitableTimerW WaitForMultipleObjects InitializeCriticalSectionAndSpinCount GetQueuedCompletionStatus WaitForSingleObject GetModuleHandleA CreateEventW MultiByteToWideChar TerminateThread QueueUserAPC GetProcAddress VerSetConditionMask SleepEx VerifyVersionInfoW TlsGetValue GetSystemTimeAsFileTime CreateIoCompletionPort CreateDirectoryW ReadFile SizeofResource QueryDosDeviceW GetVolumeInformationW FindFirstFileW WriteProcessMemory FindFirstFileExW SetPriorityClass VirtualFree GetFullPathNameW FindNextFileW lstrlenW WriteFile Wow64DisableWow64FsRedirection GetSystemDefaultUILanguage GetDiskFreeSpaceW VirtualAlloc TerminateProcess GetDriveTypeA GetModuleFileNameW GetUserDefaultLocaleName GetProcessId K32GetModuleFileNameExW GetProductInfo Thread32Next GetTempPathW CreateMutexW Thread32First FindClose GetLocaleInfoW CreateFileW GetFileAttributesW GetCurrentThreadId GetVersionExW K32GetProcessImageFileNameW SuspendThread GetSystemDirectoryW ResumeThread lstrcatA OpenProcess SetFileAttributesW GetLogicalDriveStringsW CreateToolhelp32Snapshot Sleep CopyFileA Process32NextW K32GetProcessMemoryInfo CreateFileA GetCurrentThread LoadLibraryA LockResource GlobalAlloc Process32FirstW GlobalFree GetNativeSystemInfo GetSystemInfo LoadLibraryW FindResourceExW LoadResource FindResourceW SetFileAttributesA GetThreadContext GetPriorityClass GlobalLock VirtualAllocEx MoveFileExW GetFileSize ExitProcess ReadProcessMemory GetComputerNameW FindFirstStreamW GetCurrentProcessId SystemTimeToFileTime GlobalMemoryStatusEx CreateProcessW GetModuleHandleW WinExec CreateRemoteThread QueryFullProcessImageNameW CreateProcessA DebugBreak SetThreadContext FindNextStreamW GetTickCount GlobalUnlock GetDriveTypeW GetFileTime OpenThread GetExitCodeProcess Beep CreatePipe PeekNamedPipe GetStartupInfoA lstrcpyA CreateThread CreateTimerQueueTimer VirtualProtect GetCommandLineW DeviceIoControl GetEnvironmentVariableW GetExitCodeThread FreeLibrary IsDebuggerPresent CreateTimerQueue EncodePointer TryEnterCriticalSection DuplicateHandle WaitForSingleObjectEx QueryPerformanceCounter QueryPerformanceFrequency GetFileAttributesExW GetFileInformationByHandle SetEndOfFile SetFilePointerEx AreFileApisANSI GetStringTypeW GetCPInfo CompareStringW LCMapStringW OutputDebugStringW InitializeCriticalSection GetSystemDirectoryA VerifyVersionInfoA ExpandEnvironmentStringsA GetStdHandle GetFileType ResetEvent ReleaseSemaphore OpenEventA GetLogicalProcessorInformation GetCurrentDirectoryW DeleteFileW RemoveDirectoryW CreateDirectoryExW GetFileSizeEx SwitchToFiber DeleteFiber CreateFiber ConvertFiberToThread ConvertThreadToFiber GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW GetSystemTime InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx RegisterWaitForSingleObject GetThreadTimes FreeLibraryAndExitThread LoadLibraryExW SignalObjectAndWait SwitchToThread SetThreadPriority GetThreadPriority ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask UnregisterWait UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW RtlUnwind SetConsoleCtrlHandler ExitThread GetModuleHandleExW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetModuleFileNameA WriteConsoleW SetEnvironmentVariableA GetACP GetConsoleCP GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers SetStdHandle GetTimeZoneInformation FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW VirtualQuery LoadLibraryExA

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

688KB

Virtual Size

687KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

72KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4.0MB

Virtual Size

4.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

147KB

Virtual Size

146KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=30, id=241, version=40116,

count=199, id=243, version=40116,

count=36, id=242, version=40116,

count=6, id=199, version=41118,

count=28, id=259, version=24123,

count=359, id=260, productName=VS2019 v16.8.3 build 29335, version=29335,

count=10, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=92, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=4, id=208, version=65501,

count=1, id=209, version=65501,

count=3, id=203, version=65501,

count=581, id=1, productName=Unmarked objects,

count=2, id=261, version=23013,

count=5, id=206, version=65501,

count=42, id=260, version=24123,

count=133, id=261, version=24123,

count=138, id=265, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,

Resubmissions

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

a7613e5c267e7f270918ef87fcb1e45c

kernel32

generic