General

  • Target

    JaffaCakes118_cb359b177605b936f7fdffa64869bdf9

  • Size

    3.0MB

  • Sample

    250109-sgsz3svlhr

  • MD5

    cb359b177605b936f7fdffa64869bdf9

  • SHA1

    3bc1d96db28a34908ecd012802c2116e7059215b

  • SHA256

    969c3fd429a58baf7cd7c95375a80c0d6335df32cf6107205e1ce82526bae511

  • SHA512

    06bc02dee019574c661010eb3172903cb0df8241f5415b48712dbba6175e9d2d81db5563d8514766ee86c25b3645fa59d26e0849a1f121bcaf4c48d2a6b39ad5

  • SSDEEP

    49152:eE286xT68bljvXaC9bfawTmKxJpHzhy7bitFYXOpXZvkje1x0ST6ZVKqKo6:eE286x2Abhra6mWJlzhynitlXZvkje1x

Score
10/10

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

dothra.duckdns.org:6703

Attributes
  • communication_password

    653bb8a00acdfd76c124918115156da1

  • tor_process

    tor

Targets

    • Target

      JaffaCakes118_cb359b177605b936f7fdffa64869bdf9

    • Size

      3.0MB

    • MD5

      cb359b177605b936f7fdffa64869bdf9

    • SHA1

      3bc1d96db28a34908ecd012802c2116e7059215b

    • SHA256

      969c3fd429a58baf7cd7c95375a80c0d6335df32cf6107205e1ce82526bae511

    • SHA512

      06bc02dee019574c661010eb3172903cb0df8241f5415b48712dbba6175e9d2d81db5563d8514766ee86c25b3645fa59d26e0849a1f121bcaf4c48d2a6b39ad5

    • SSDEEP

      49152:eE286xT68bljvXaC9bfawTmKxJpHzhy7bitFYXOpXZvkje1x0ST6ZVKqKo6:eE286x2Abhra6mWJlzhynitlXZvkje1x

    Score
    10/10
    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    • Bitrat family

    • Loads dropped DLL

    • Target

      $PLUGINSDIR/djxkzboezod.dll

    • Size

      20KB

    • MD5

      eeda791c434b928af71754cab0af6d83

    • SHA1

      16e667ab08125cc9a8b3f1fb7c9b2bac70729c06

    • SHA256

      863bece4d142934ffc1136b2eb98938d5865e4f31608a6392ed91575bee6667a

    • SHA512

      0fcc9e14a04047b8a4681bcca0de688391981da7269bdbe3d76dc8f74f2ed29d07eeb4c6dca78d4e3b7b91ace1be6b8a80de4a47f8206f6b9d7c3ba2b784d79d

    • SSDEEP

      384:vRWjYF3F4+t6WonZZ1bWHZ+NmsNK24DBb6XCtO:vkjUV5wZlS4mjfx6ytO

    Score
    10/10
    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    • Bitrat family

MITRE ATT&CK Enterprise v15

Tasks