bitrat | 06d6b59370b81465d251350a03de3feaab89609860a8efdca761f42b89e48b33

General

Target
2026-07-19_25720a540ea375c355c2ee41e714d9a8_amadey_bitrat_coinminer_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_smoke-loader_stop
Size 12.8MB
Sample260720-b5yf2abz2m
SHA256 06d6b59370b81465d251350a03de3feaab89609860a8efdca761f42b89e48b33
MD5 25720a540ea375c355c2ee41e714d9a8
SHA1 67b42717dd4201dcedb9f2c225b97fd62256e3d1
SHA512 8347d9490f65586884e3af2cdf77c0a9ef2fb6397b1c2add4837b3988b8103d4fe32c96898a9c6330145b6b33c80bc4d24cc2775ab6d5d7c8907eeb4012d0a68
SSDEEP 196608:4JIreZADQW4VDBGUn01j/A6zf9Tnowq1N5NxbsixMbVW72hSqJyV2IiRG/x7laqr:IIreJWkBuSE9UNPxLMpzJ+2v8Qv
TLSH
T187D61212BA428562D1574530D92F7FBA207CB63A0F2188D3B3846EA819716D1BB37F77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

stealslegion.duckdns.org:7878

Attributes

communication_password
a221f9cd0ad561fce7c1e01ddd25b391
install_dir
error_list
install_file
svchost
tor_process
tor

Targets

- Target
  2026-07-19_25720a540ea375c355c2ee41e714d9a8_amadey_bitrat_coinminer_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_smoke-loader_stop
- Size 12.8MB
- SHA256 06d6b59370b81465d251350a03de3feaab89609860a8efdca761f42b89e48b33
- MD5 25720a540ea375c355c2ee41e714d9a8
- SHA1 67b42717dd4201dcedb9f2c225b97fd62256e3d1
- SHA512 8347d9490f65586884e3af2cdf77c0a9ef2fb6397b1c2add4837b3988b8103d4fe32c96898a9c6330145b6b33c80bc4d24cc2775ab6d5d7c8907eeb4012d0a68
- SSDEEP 196608:4JIreZADQW4VDBGUn01j/A6zf9Tnowq1N5NxbsixMbVW72hSqJyV2IiRG/x7laqr:IIreJWkBuSE9UNPxLMpzJ+2v8Qv
- TLSH
  T187D61212BA428562D1574530D92F7FBA207CB63A0F2188D3B3846EA819716D1BB37F77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery bitrat trojan vmprotect
- Family: BitRAT
  BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
  trojan bitrat
- Detects executables packed with VMProtect.
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: BitRAT

Detects executables packed with VMProtect.

VMProtect packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2