bitrat | 8524d39271ec09d851920db4036d9dafe4f61f5cbd44d81322c9ec29ef1aadc2

Resubmissions

26/04/2024, 06:45

240426-hh76aaba6t10

26/04/2024, 06:44

26/04/2024, 06:44

26/04/2024, 06:44

26/04/2024, 06:44

25/04/2024, 13:09

Sharing

Copy URL Twitter E-mail

General

Target
8524d39271ec09d851920db4036d9dafe4f61f5cbd44d81322c9ec29ef1aadc2
Size 11.7MB
Sample240426-hhylvaba94
SHA256 8524d39271ec09d851920db4036d9dafe4f61f5cbd44d81322c9ec29ef1aadc2
MD5 aad57aa4be27a48ebfe54e35f8bf31d9
SHA1 cec3a059f103e163e6bfd0cbaa446045add97a89
SHA512 423ecb0e593e7e862ba6a6f6d04937fdde737d5373620a61918522d348c25a39c40e0909e7e5dd4c52b5f546e6f15751a27d8820db0f1a10b98db25103d757b1
SSDEEP 196608:YN4reUU8Lxwhzav1yo31CPwDv3uFZjeg2EeJUO9WLQx6xtw3iFFrS6X/fTV73c:YN4reUPLxwZ6v1CPwDv3uFteg2EeJUOy
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

bitrat

Malware Config

Extracted

Family

bitrat

Version

1.31

Signatures

BitRAT payload 1 IoCs

resource	yara_rule
sample	family_bitrat

Bitrat family
bitrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8524d39271ec09d851920db4036d9dafe4f61f5cbd44d81322c9ec29ef1aadc2

File Explorer

8524d39271ec09d851920db4036d9dafe4f61f5cbd44d81322c9ec29ef1aadc2

.exe 11.7MB

8524d39271ec09d851920db4036d9dafe4f61f5cbd44d81322c9ec29ef1aadc2

IMPHASH 2c27451b4fc4c5cc786ad323e38a118e
SHA256 8524d39271ec09d851920db4036d9dafe4f61f5cbd44d81322c9ec29ef1aadc2
MD5 aad57aa4be27a48ebfe54e35f8bf31d9
SHA1 cec3a059f103e163e6bfd0cbaa446045add97a89
SHA512 423ecb0e593e7e862ba6a6f6d04937fdde737d5373620a61918522d348c25a39c40e0909e7e5dd4c52b5f546e6f15751a27d8820db0f1a10b98db25103d757b1
SSDEEP 196608:YN4reUU8Lxwhzav1yo31CPwDv3uFZjeg2EeJUO9WLQx6xtw3iFFrS6X/fTV73c:YN4reUPLxwZ6v1CPwDv3uFteg2EeJUOy
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

BitRAT payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2133141

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

HeapFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx HeapSize PostQueuedCompletionStatus FormatMessageW GetLastError SetEvent TlsAlloc HeapReAlloc CloseHandle RaiseException HeapAlloc DecodePointer HeapDestroy LocalFree DeleteCriticalSection GetProcessHeap WideCharToMultiByte TlsFree FormatMessageA CreateEventA GetCurrentProcess GetSystemTimes GetTickCount64 GetProcessTimes SetWaitableTimer TlsSetValue SetLastError CreateWaitableTimerW WaitForMultipleObjects InitializeCriticalSectionAndSpinCount GetQueuedCompletionStatus WaitForSingleObject GetModuleHandleA CreateEventW MultiByteToWideChar TerminateThread QueueUserAPC GetProcAddress VerSetConditionMask SleepEx VerifyVersionInfoW TlsGetValue GetSystemTimeAsFileTime CreateIoCompletionPort CreateDirectoryW ReadFile SizeofResource QueryDosDeviceW GetVolumeInformationW FindFirstFileW WriteProcessMemory FindFirstFileExW SetPriorityClass VirtualFree GetFullPathNameW FindNextFileW lstrlenW Wow64DisableWow64FsRedirection GetSystemDefaultUILanguage GetDiskFreeSpaceW VirtualAlloc TerminateProcess GetModuleFileNameW GetUserDefaultLocaleName GetProcessId K32GetModuleFileNameExW GetProductInfo Thread32Next GetTempPathW CreateMutexW Thread32First FindClose GetLocaleInfoW CreateFileW GetFileAttributesW GetVersionExW K32GetProcessImageFileNameW SuspendThread GetSystemDirectoryW ResumeThread lstrcatA OpenProcess GetLogicalDriveStringsW CreateToolhelp32Snapshot Sleep Process32NextW K32GetProcessMemoryInfo CreateFileA GetCurrentThread LoadLibraryA LockResource GlobalAlloc Process32FirstW GlobalFree GetNativeSystemInfo GetSystemInfo FindResourceExW LoadResource FindResourceW GetThreadContext GetPriorityClass GlobalLock VirtualAllocEx MoveFileExW GetFileSize ExitProcess ReadProcessMemory GetComputerNameW FindFirstStreamW GetCurrentProcessId SystemTimeToFileTime GlobalMemoryStatusEx CreateProcessW WinExec QueryFullProcessImageNameW CreateProcessA DebugBreak SetThreadContext FindNextStreamW GetTickCount GlobalUnlock GetDriveTypeW GetFileTime OpenThread GetExitCodeProcess Beep WriteFile CreatePipe PeekNamedPipe GetStartupInfoA SetThreadPriority GetCurrentThreadId lstrcpyA CreateThread CreateTimerQueueTimer VirtualProtect GetCommandLineW DeviceIoControl VirtualAllocExNuma GetModuleHandleW IsDebuggerPresent CheckRemoteDebuggerPresent CreateTimerQueue EncodePointer TryEnterCriticalSection DuplicateHandle WaitForSingleObjectEx GetExitCodeThread QueryPerformanceCounter QueryPerformanceFrequency GetFileAttributesExW GetFileInformationByHandle SetEndOfFile SetFilePointerEx AreFileApisANSI GetStringTypeW GetCPInfo CompareStringW LCMapStringW OutputDebugStringW ResetEvent ReleaseSemaphore OpenEventA GetLogicalProcessorInformation GetCurrentDirectoryW DeleteFileW RemoveDirectoryW CreateDirectoryExW GetFileSizeEx GetFileType GetStdHandle GetSystemTime InitializeCriticalSection InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx RegisterWaitForSingleObject GetThreadTimes FreeLibrary FreeLibraryAndExitThread LoadLibraryExW LoadLibraryW SignalObjectAndWait SwitchToThread GetThreadPriority ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask UnregisterWait UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW RtlUnwind SetConsoleCtrlHandler ExitThread GetModuleHandleExW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetModuleFileNameA WriteConsoleW SetEnvironmentVariableA GetACP GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleCP GetConsoleMode SetStdHandle GetTimeZoneInformation ReadConsoleW FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW VirtualQuery LoadLibraryExA

Name

.text

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

596KB

Virtual Size

596KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

704KB

Virtual Size

704KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4.0MB

Virtual Size

4.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

gu_idata

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

gu_rsrcs

Size

4.0MB

Virtual Size

4.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

8524d39271ec09d851920db4036d9dafe4f61f5cbd44d81322c9ec29ef1aadc2

kernel32

generic