bitrat | 2132-33-0x0000000000290000-0x000000000065E000-memory[.]dmp

General

Target
2132-33-0x0000000000290000-0x000000000065E000-memory.dmp
Size 3.8MB
Sample240512-ebg4qsab62
SHA256 a85f3ec36c57dc3c0ed5b3666ded7132b0f3e55bdd161ed97068e3b25cac80c2
MD5 de31c9c1311178f0a92df1279fab1d11
SHA1 d662c9c7ee87a09dc0c584d14fa488e347742860
SHA512 54caa42f77dcb5f58ed980c5bab8f14bfb40ffd6024e3b5aad9f7b6221bb8376e3ae3e392c52134645b2c2495aaf0189b97f3c6ca6b6bfbe54a5f159c52d9cc4
SSDEEP 98304:PbAK0afhYr1pgiD5D6OAGcyH/Co8/80HO3FB:n21e6d6OAaX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

bitrat

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

MyBtrpub.dynuddns.com:8889

Attributes

communication_password
cba52b50d9cf77a308a6bedcd075f95e
tor_process
tor

Signatures

Bitrat family
bitrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2132-33-0x0000000000290000-0x000000000065E000-memory.dmp

File Explorer

2132-33-0x0000000000290000-0x000000000065E000-memory.dmp

.exe 3.8MB

2132-33-0x0000000000290000-0x000000000065E000-memory.dmp

SHA256 a85f3ec36c57dc3c0ed5b3666ded7132b0f3e55bdd161ed97068e3b25cac80c2
MD5 de31c9c1311178f0a92df1279fab1d11
SHA1 d662c9c7ee87a09dc0c584d14fa488e347742860
SHA512 54caa42f77dcb5f58ed980c5bab8f14bfb40ffd6024e3b5aad9f7b6221bb8376e3ae3e392c52134645b2c2495aaf0189b97f3c6ca6b6bfbe54a5f159c52d9cc4
SSDEEP 98304:PbAK0afhYr1pgiD5D6OAGcyH/Co8/80HO3FB:n21e6d6OAaX
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

2663560

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

687KB

Virtual Size

686KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

72KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

146KB

Virtual Size

146KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=30, id=241, version=40116,

count=199, id=243, version=40116,

count=36, id=242, version=40116,

count=6, id=199, version=41118,

count=28, id=259, version=24123,

count=359, id=260, productName=VS2019 v16.8.3 build 29335, version=29335,

count=10, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=92, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=4, id=208, version=65501,

count=1, id=209, version=65501,

count=3, id=203, version=65501,

count=581, id=1, productName=Unmarked objects,

count=2, id=261, version=23013,

count=5, id=206, version=65501,

count=42, id=260, version=24123,

count=133, id=261, version=24123,

count=138, id=265, version=24215,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

2132-33-0x0000000000290000-0x000000000065E000-memory.dmp

generic