bitrat

General

Target

6b1bd2bb379d1a4e929ba32100b6acd3_JaffaCakes118
Size

174KB
Sample

240523-qwkadadb97
MD5

6b1bd2bb379d1a4e929ba32100b6acd3
SHA1

7e575b77c856c49495f3cf3d3dc6b3340facb99b
SHA256

8d44a736975543b4f5c40296fb1c1a2e42700861d95704fd224d42d73d475d78
SHA512

8e8d033bb29dbc9b36278285a4e8655e54add7a51570b3e132cb1e0992e3753eb353eb6787cc9fcb56e2f4e79f382050063eea0cf949d9a9151c9c5eed2f8cd8
SSDEEP

3072:YPGsB7XNuFhSJ1RwrzDJoqpJlKhAeQfpIYEDapZ2Ti87w3b+46UB:YPPNzTUzDJ/jqQxIhmr2TiBT

Score

10^/10

Malware Config

Targets

- Target
  
  6b1bd2bb379d1a4e929ba32100b6acd3_JaffaCakes118
- Size
  
  174KB
- MD5
  
  6b1bd2bb379d1a4e929ba32100b6acd3
- SHA1
  
  7e575b77c856c49495f3cf3d3dc6b3340facb99b
- SHA256
  
  8d44a736975543b4f5c40296fb1c1a2e42700861d95704fd224d42d73d475d78
- SHA512
  
  8e8d033bb29dbc9b36278285a4e8655e54add7a51570b3e132cb1e0992e3753eb353eb6787cc9fcb56e2f4e79f382050063eea0cf949d9a9151c9c5eed2f8cd8
- SSDEEP
  
  3072:YPGsB7XNuFhSJ1RwrzDJoqpJlKhAeQfpIYEDapZ2Ti87w3b+46UB:YPPNzTUzDJ/jqQxIhmr2TiBT
Score

10^/10

bitrat evasion execution persistence trojan
- BitRAT
  BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
  trojan bitrat
- BitRAT payload
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Turns off Windows Defender SpyNet reporting
  evasion
- Windows security bypass
  evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2