General

  • Target

    c0f1f20287896ff8a866a98497ed8123_JaffaCakes118

  • Size

    4.6MB

  • Sample

    240825-rxwv8sygla

  • MD5

    c0f1f20287896ff8a866a98497ed8123

  • SHA1

    c566997f3fd2a9a2c6a5b5d96d3c1f7e81d65f36

  • SHA256

    36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019

  • SHA512

    d1d867fdc84502f98901e006e803337abfee7c58b172913813132fdf9d8d125bb1ae304f35789ee3c836240344a81e3bbb132a024c9b03bb6a77550678228c76

  • SSDEEP

    98304:Yi1FnwzTuf1TUBnuYlj+C6oes5+Pc+3PT1+Ai5ruELIUV0pIgKiNUn7MZT7pb:THnC8NUplvfesAE+3PBvQuEsU392xP

Malware Config

Extracted

Family

bitrat

Version

1.34

C2

logonapplication.ddns.net:4010

Attributes
  • communication_password

    c4ca4238a0b923820dcc509a6f75849b

  • tor_process

    tor

Targets

    • Target

      c0f1f20287896ff8a866a98497ed8123_JaffaCakes118

    • Size

      4.6MB

    • MD5

      c0f1f20287896ff8a866a98497ed8123

    • SHA1

      c566997f3fd2a9a2c6a5b5d96d3c1f7e81d65f36

    • SHA256

      36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019

    • SHA512

      d1d867fdc84502f98901e006e803337abfee7c58b172913813132fdf9d8d125bb1ae304f35789ee3c836240344a81e3bbb132a024c9b03bb6a77550678228c76

    • SSDEEP

      98304:Yi1FnwzTuf1TUBnuYlj+C6oes5+Pc+3PT1+Ai5ruELIUV0pIgKiNUn7MZT7pb:THnC8NUplvfesAE+3PBvQuEsU392xP

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    • Looks for VirtualBox Guest Additions in registry

    • Looks for VMWare Tools registry key

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Uses the VBS compiler for execution

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks