Overview

overview

10

Static

static

1

Untitled.jpg

windows7-x64

10

Untitled.jpg

windows10-2004-x64

4

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Untitled.jpg

  • Size

    97KB

  • Sample

    250305-bdakwsvks5

  • MD5

    7c47e57cb3745c79d363b7bdbb5a39d6

  • SHA1

    572e084821f5e1393869b1dd35065d1f0140e2f4

  • SHA256

    b5232d6b3e84b3d3da8c6e07fa5438b3ad5bc73c620b3c6769117009216339a2

  • SHA512

    8c4f106b9d63c7deca71b0618dd97dbb0fe9f4d7c4c3aa559338061e87cefc76ca29cc3a3db3c244aeb7e17c930939906f86caec03f3c02ab8d35e8eb0bfd706

  • SSDEEP

    3072:Q35vPGIPuOx0XD5EKlIgNdBvQv3AAeSzPS:m5XGuID5EcpW3U66

Score
10/10
bitratdiscoverytrojan

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

current-necessity.at.ply.gg:49446

Attributes
  • communication_password

    c5e4e64cc9384fda09aa232c1811af0e

  • install_dir

    MsSystemDriver

  • install_file

    MsMpEng.exe

  • tor_process

    tor

Targets

    • Target

      Untitled.jpg

    • Size

      97KB

    • MD5

      7c47e57cb3745c79d363b7bdbb5a39d6

    • SHA1

      572e084821f5e1393869b1dd35065d1f0140e2f4

    • SHA256

      b5232d6b3e84b3d3da8c6e07fa5438b3ad5bc73c620b3c6769117009216339a2

    • SHA512

      8c4f106b9d63c7deca71b0618dd97dbb0fe9f4d7c4c3aa559338061e87cefc76ca29cc3a3db3c244aeb7e17c930939906f86caec03f3c02ab8d35e8eb0bfd706

    • SSDEEP

      3072:Q35vPGIPuOx0XD5EKlIgNdBvQv3AAeSzPS:m5XGuID5EcpW3U66

    Score
    10/10
    bitratdiscoverytrojan

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

      trojanbitrat

    • Bitrat family

      bitrat

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks