bitrat | 0a99a8953769de42b0a9673ed1e8003793b5228a225f4b8a5d7a3f2c80fb1146N

General

Target
0a99a8953769de42b0a9673ed1e8003793b5228a225f4b8a5d7a3f2c80fb1146N
Size 7.8MB
Sample240920-lx49qa1bpp
SHA256 0a99a8953769de42b0a9673ed1e8003793b5228a225f4b8a5d7a3f2c80fb1146
MD5 5d7a6871f5d94d0283ffd09ce9a10e50
SHA1 d9b4e1aa67f2cfb503d879452fa0852ba7284590
SHA512 db0e33d9c363c5fec6c538d1e1f4e985026d72eb0326d85a06f8f3b2e8a0b801c63f1e9d06133f0c3c2d5b0cacac7bef2180d58b31decd7e2a9ec7bbc650908f
SSDEEP 196608:CWx+Kdiqx6F9lxwhzav1yo31CPwDv3uFZjeg2EeJUO9WLQkDxtw3iFFrS6XOfTV4:CWxVdiX/xwZ6v1CPwDv3uFteg2EeJUOf
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

bitrat

Malware Config

Extracted

Family

bitrat

Version

1.35

C2

hijy62t5b43fhu3dblgep4drtoqjpfi7jgxqaectce2verypcui3qbad.onion:80

Attributes

communication_password
202cb962ac59075b964b07152d234b70
install_dir
mucro
install_file
micro.exe
tor_process
mschostw

Signatures

Bitrat family
bitrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0a99a8953769de42b0a9673ed1e8003793b5228a225f4b8a5d7a3f2c80fb1146N

File Explorer

0a99a8953769de42b0a9673ed1e8003793b5228a225f4b8a5d7a3f2c80fb1146N

.exe 7.8MB

0a99a8953769de42b0a9673ed1e8003793b5228a225f4b8a5d7a3f2c80fb1146N

IMPHASH 2b817dc1b1849c6a436f0647be7673e0
SHA256 0a99a8953769de42b0a9673ed1e8003793b5228a225f4b8a5d7a3f2c80fb1146
MD5 5d7a6871f5d94d0283ffd09ce9a10e50
SHA1 d9b4e1aa67f2cfb503d879452fa0852ba7284590
SHA512 db0e33d9c363c5fec6c538d1e1f4e985026d72eb0326d85a06f8f3b2e8a0b801c63f1e9d06133f0c3c2d5b0cacac7bef2180d58b31decd7e2a9ec7bbc650908f
SSDEEP 196608:CWx+Kdiqx6F9lxwhzav1yo31CPwDv3uFZjeg2EeJUO9WLQkDxtw3iFFrS6XOfTV4:CWxVdiX/xwZ6v1CPwDv3uFteg2EeJUOf
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

2662837

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

HeapFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx HeapSize PostQueuedCompletionStatus FormatMessageW GetLastError SetEvent TlsAlloc HeapReAlloc CloseHandle RaiseException HeapAlloc DecodePointer HeapDestroy LocalFree DeleteCriticalSection GetProcessHeap WideCharToMultiByte TlsFree FormatMessageA CreateEventA GetCurrentProcess GetSystemTimes GetTickCount64 GetProcessTimes SetWaitableTimer TlsSetValue SetLastError CreateWaitableTimerW WaitForMultipleObjects InitializeCriticalSectionAndSpinCount GetQueuedCompletionStatus WaitForSingleObject GetModuleHandleA CreateEventW MultiByteToWideChar TerminateThread QueueUserAPC GetProcAddress VerSetConditionMask SleepEx VerifyVersionInfoW TlsGetValue GetSystemTimeAsFileTime CreateIoCompletionPort CreateDirectoryW ReadFile SizeofResource QueryDosDeviceW GetVolumeInformationW FindFirstFileW WriteProcessMemory FindFirstFileExW SetPriorityClass VirtualFree GetFullPathNameW FindNextFileW lstrlenW WriteFile Wow64DisableWow64FsRedirection GetSystemDefaultUILanguage GetDiskFreeSpaceW VirtualAlloc TerminateProcess GetDriveTypeA GetModuleFileNameW GetUserDefaultLocaleName GetProcessId K32GetModuleFileNameExW GetProductInfo Thread32Next GetTempPathW CreateMutexW Thread32First FindClose GetLocaleInfoW CreateFileW GetFileAttributesW GetCurrentThreadId GetVersionExW K32GetProcessImageFileNameW SuspendThread GetSystemDirectoryW ResumeThread lstrcatA OpenProcess SetFileAttributesW GetLogicalDriveStringsW CreateToolhelp32Snapshot Sleep CopyFileA Process32NextW K32GetProcessMemoryInfo CreateFileA GetCurrentThread LoadLibraryA LockResource GlobalAlloc Process32FirstW GlobalFree GetNativeSystemInfo GetSystemInfo LoadLibraryW FindResourceExW LoadResource FindResourceW SetFileAttributesA GetThreadContext GetPriorityClass GlobalLock VirtualAllocEx MoveFileExW GetFileSize ExitProcess ReadProcessMemory GetComputerNameW FindFirstStreamW GetCurrentProcessId SystemTimeToFileTime GlobalMemoryStatusEx CreateProcessW GetModuleHandleW WinExec CreateRemoteThread QueryFullProcessImageNameW CreateProcessA DebugBreak SetThreadContext FindNextStreamW GetTickCount GlobalUnlock GetDriveTypeW GetFileTime OpenThread GetExitCodeProcess Beep CreatePipe PeekNamedPipe GetStartupInfoA lstrcpyA CreateThread CreateTimerQueueTimer VirtualProtect GetCommandLineW DeviceIoControl GetEnvironmentVariableW GetExitCodeThread FreeLibrary IsDebuggerPresent CreateTimerQueue EncodePointer TryEnterCriticalSection DuplicateHandle WaitForSingleObjectEx QueryPerformanceCounter QueryPerformanceFrequency GetFileAttributesExW GetFileInformationByHandle SetEndOfFile SetFilePointerEx AreFileApisANSI GetStringTypeW GetCPInfo CompareStringW LCMapStringW OutputDebugStringW InitializeCriticalSection GetSystemDirectoryA VerifyVersionInfoA ExpandEnvironmentStringsA GetStdHandle GetFileType ResetEvent ReleaseSemaphore OpenEventA GetLogicalProcessorInformation GetCurrentDirectoryW DeleteFileW RemoveDirectoryW CreateDirectoryExW GetFileSizeEx SwitchToFiber DeleteFiber CreateFiber ConvertFiberToThread ConvertThreadToFiber GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW GetSystemTime InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx RegisterWaitForSingleObject GetThreadTimes FreeLibraryAndExitThread LoadLibraryExW SignalObjectAndWait SwitchToThread SetThreadPriority GetThreadPriority ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask UnregisterWait UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW RtlUnwind SetConsoleCtrlHandler ExitThread GetModuleHandleExW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetModuleFileNameA WriteConsoleW SetEnvironmentVariableA GetACP GetConsoleCP GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers SetStdHandle GetTimeZoneInformation FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW VirtualQuery LoadLibraryExA

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

688KB

Virtual Size

687KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

72KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4.0MB

Virtual Size

4.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

147KB

Virtual Size

146KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=30, id=241, version=40116,

count=199, id=243, version=40116,

count=36, id=242, version=40116,

count=6, id=199, version=41118,

count=28, id=259, version=24123,

count=359, id=260, productName=VS2019 v16.8.3 build 29335, version=29335,

count=10, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=92, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=4, id=208, version=65501,

count=1, id=209, version=65501,

count=3, id=203, version=65501,

count=581, id=1, productName=Unmarked objects,

count=2, id=261, version=23013,

count=5, id=206, version=65501,

count=42, id=260, version=24123,

count=133, id=261, version=24123,

count=138, id=265, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

0a99a8953769de42b0a9673ed1e8003793b5228a225f4b8a5d7a3f2c80fb1146N

kernel32

generic