Overview

overview

10

Static

static

10

df20cc74cd...6b.exe

windows10-2004-x64

1

df20cc74cd...6b.exe

windows11-21h2-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    df20cc74cd008944030f842ebe4baf375ff71d26df59e9f83c7f82d1d5cb0d6b.zip
  • Size 4.8MB
  • Sample260531-d9vl2sbs8k
  • SHA256 b808b7c94054eacf412524a2cfcda484fb8433e00b890c8e2201756f5e5eb20a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
upxtrojanbitrat

Malware Config

Extracted

Family

  • bitrat

Version

  • 1.35

C2

  • 5hns6h36ajegjhwaupeq3zuasr3vlkh43fxrbftkreuljice2nxdewqd.onion:80

Attributes
  • communication_password

    1e553be118546a9eae0f52103e13514f

  • install_dir

    N2kGVS9LXo

  • install_file

    qm7OteHStq.exe

  • tor_process

    Windows Tab

Signatures

  • Family: BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat
  • Detect suspicious telegram bot 1 IoCs

    Detect suspicious telegram bot.

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • df20cc74cd008944030f842ebe4baf375ff71d26df59e9f83c7f82d1d5cb0d6b.zip
    .zip 4.8MB
  • df20cc74cd008944030f842ebe4baf375ff71d26df59e9f83c7f82d1d5cb0d6b
    .exe 12.0MB

df20cc74cd008944030f842ebe4baf375ff71d26df59e9f83c7f82d1d5cb0d6b.zip

  • SHA256 b808b7c94054eacf412524a2cfcda484fb8433e00b890c8e2201756f5e5eb20a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected