bitrat | ad9c52c23d4c83a4abec9b576be98ab13f13b5f5c08199dc49e951978f03c5ea

General

Target
BitRAT 1.38.7z
Size 31.7MB
Sample260504-nvdebsh19s
SHA256 ad9c52c23d4c83a4abec9b576be98ab13f13b5f5c08199dc49e951978f03c5ea
MD5 f3f64786d233e0ba8a8925bacd97c2b6
SHA1 6526a70a94bb77e828e7b11ff3fd70fc6bf15a13
SHA512 cfddea87559191afd599e64aeefac5a7ad3ec20d2eb23899573df3039ff435a01725af8111af707873b4e8e210245ed0641bc735a8ffe7eb61468de1da9db740
SSDEEP 786432:nBCI8NUf1dxXtzxotEinGWMfm9hrczbZOYE/UPEHHKlv:YIbRXjsn9hrcPZOnUMH+
TLSH
T1907733854A4E6674C7ECAD2E1F35E7BC0C416FE64E939063202FD6A7C51983D437A23A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

favorali.duckdns.org:2331

Attributes

communication_password
81dc9bdb52d04dc20036dbd8313ed055
tor_process
tor

Targets

- Target
  Builder/stub.bin
- Size 3.8MB
- SHA256 8b424e81e72bead6c3067c2988c62d52fd7456ceda8a6eb8f09fa9d884274c62
- MD5 c29fa8ea072936ccff2cd6825ba3498d
- SHA1 73fdff8f9d5b45291fb33ada577782f1241c11d2
- SHA512 4182b9c00bca0d0b69607c84314c596ef87371d55054fc0457fc8b9a08fde539ab795238f12ef88c767df1e894101fbb4e9181f75a75e4075a027d6d0266cb11
- SSDEEP 98304:d77Pmq33rE/JDLPWZADUGer7B6iY74M/TmlwXVZ4FB:5+R/eZADUXR
- TLSH
  T17706CF02FA46C562D2170230E96E77BA053CF9354B2085C3B3946E6C59B66D17A3BF3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery bitrat trojan
- Family: BitRAT
  BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
  trojan bitrat
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  Builder/stub_tor.bin
- Size 7.8MB
- SHA256 dd3a0d0fbe4007ab704f4e01c234d9d13079606082d1084b59cc44bad7a8d030
- MD5 3518b55c1396096e585efc60c11c9fca
- SHA1 542348021850a96abbe5c207927ba6113d2b811c
- SHA512 7c5cc18d8610e44b5c7e0a92ae9b4771745189b2cd1b53f07365776169fb6bbd7f0bc3677146df220ece68e9d126aa3382875bd8886183611953bfcbb9171af1
- SSDEEP 196608:oIRcbH4jSteTGvrxwhzav1yo31CPwDv3uFZjeg2EeJUO9WLQkDxtw3iFFrS6XOf:odHsfurxwZ6v1CPwDv3uFteg2EeJUO9E
- TLSH
  T16586D011B5958C6BD5565238CAEFB33B223CF6600B23C7C367506A394E73AC13E66B16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery bitrat trojan
- Family: BitRAT
  BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
  trojan bitrat
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3 behavioral4

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: BitRAT

Suspicious use of NtSetInformationThreadHideFromDebugger

Family: BitRAT

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4