bitrat | 2026-07-02_025b3c95498e8dff1d21e807c47be6fe_bitrat_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos

General

Target
2026-07-02_025b3c95498e8dff1d21e807c47be6fe_bitrat_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos
Size 7.8MB
Sample260702-22dkkacz7m
SHA256 7d5ed450cc0d92be8be16ad549e7901642f1def632fd26bad2c6280bffd0251f
MD5 025b3c95498e8dff1d21e807c47be6fe
SHA1 3af46f0a6e3f0dbcddc6df95cd8af9043f76640b
SHA512 f4ec6da37327f1e0dbdb8b7581e59c25ad49b49fce5f0a57f77cc67b2375f39f0976bc681dfe1da0b2f078c298fa741ed3aa6aed0d97ee2fd715ecb8c5bd2299
SSDEEP 196608:P4zhn+Vjekxwhzav1yo31CPwDv3uFZjeg2EeJUO9WLQkDxtw3iFFrS6XOfTV73c:Qzh6ekxwZ6v1CPwDv3uFteg2EeJUO9Wq
TLSH
T1C886D011B5958C6BD5561278CAEFB33B223CFA600B23C7C367506A394E73AC13E65B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan bitrat

Malware Config

Extracted

Family

bitrat

Version

1.34

C2

wsec6nyzwgdwl33brnss72r6itx3lxtldugullkxqakre3bymruazzyd.onion:80

Attributes

communication_password
944a53e776fade026ee3a640880a00f3
install_dir
xx
install_file
xxxx.exe
tor_process
video

Signatures

Family: BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

Custom signature

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-02_025b3c95498e8dff1d21e807c47be6fe_bitrat_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos

File Explorer

2026-07-02_025b3c95498e8dff1d21e807c47be6fe_bitrat_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos

.exe 7.8MB

2026-07-02_025b3c95498e8dff1d21e807c47be6fe_bitrat_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos

SHA256 7d5ed450cc0d92be8be16ad549e7901642f1def632fd26bad2c6280bffd0251f
MD5 025b3c95498e8dff1d21e807c47be6fe
SHA1 3af46f0a6e3f0dbcddc6df95cd8af9043f76640b
SHA512 f4ec6da37327f1e0dbdb8b7581e59c25ad49b49fce5f0a57f77cc67b2375f39f0976bc681dfe1da0b2f078c298fa741ed3aa6aed0d97ee2fd715ecb8c5bd2299
SSDEEP 196608:P4zhn+Vjekxwhzav1yo31CPwDv3uFZjeg2EeJUO9WLQkDxtw3iFFrS6XOfTV73c:Qzh6ekxwZ6v1CPwDv3uFteg2EeJUO9Wq
TLSH
T1C886D011B5958C6BD5561278CAEFB33B223CFA600B23C7C367506A394E73AC13E65B16
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX dump on OEP (original entry point)
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

2662633

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

688KB

Virtual Size

687KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

72KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4.0MB

Virtual Size

4.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

147KB

Virtual Size

146KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=30, id=241, version=40116,

count=199, id=243, version=40116,

count=36, id=242, version=40116,

count=6, id=199, version=41118,

count=28, id=259, version=24123,

count=359, id=260, productName=VS2019 v16.8.3 build 29335, version=29335,

count=10, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=92, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=4, id=208, version=65501,

count=1, id=209, version=65501,

count=3, id=203, version=65501,

count=581, id=1, productName=Unmarked objects,

count=2, id=261, version=23013,

count=5, id=206, version=65501,

count=42, id=260, version=24123,

count=133, id=261, version=24123,

count=138, id=265, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

2026-07-02_025b3c95498e8dff1d21e807c47be6fe_bitrat_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos

generic