MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0a3572f48d77e2fc47735dedb2bdc2592ed3b0f60bcc88f30afe184aa545f080. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BitRAT


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0a3572f48d77e2fc47735dedb2bdc2592ed3b0f60bcc88f30afe184aa545f080
SHA3-384 hash: 5a605602f456d8466d0a8df4a34774baba25e9418c5c878b120664907f9e0ae6585c6a5d9d490c91c02d562c718141e1
SHA1 hash: fc46a50a38738208f67294e3a283782864d0ed04
MD5 hash: 2566ee6169d8c8be07d673be7819aa9d
humanhash: high-bacon-april-early
File name:2566ee6169d8c8be07d673be7819aa9d.exe
Download: download sample
Signature BitRAT
Create hunting rule
File size:5'106'741 bytes
First seen:2021-03-02 17:51:50 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash d6ac9616587efac71db41aa72947d988 (6 x BitRAT, 1 x QuasarRAT)
ssdeep 98304:YuWNQ0kKDhLa1xecuMJWJ4qnP6x0V2ucdIlpzJwkUk:diQ0Nirvk2qSxHyzJwkv
Threatray 110 similar samples on MalwareBazaar
TLSH 7836D023AE049FE0EA4309F50A469949BA40741DD49FFD8768859608D23F9C7F4FF7A8
Reporter abuse_ch
Tags:BitRAT exe RAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
220
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
2566ee6169d8c8be07d673be7819aa9d.exe
Verdict:
Malicious activity
Analysis date:
2021-03-02 18:47:11 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/cf2832f5-3205-4367-8e27-1258899fc70a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
BitRAT
Create hunting rule
Link:
https://www.capesandbox.com/analysis/121103/
Detection(s):
Win.Malware.Johnnie-9835561-0
Create hunting rule

Win.Trojan.Johnnie-9835771-0
Create hunting rule

Win.Trojan.Johnnie-9835772-0
Create hunting rule

Win.Trojan.Johnnie-9835779-0
Create hunting rule

Win.Trojan.Johnnie-9835874-0
Create hunting rule

Win.Trojan.Johnnie-9835876-0
Create hunting rule

Win.Trojan.Johnnie-9836216-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Creating a file in the %AppData% subdirectories
Unauthorized injection to a recently created process
Setting a global event handler
Connection attempt
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Setting a global event handler for the keyboard
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
BitRAT Xmrig
Create hunting rule
Detection:
malicious
Classification:
troj.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/624481
Signature
Contain functionality to detect virtual machines
Contains functionality to hide a thread from the debugger
Contains functionality to inject code into remote processes
Creates files in alternative data streams (ADS)
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected BitRAT
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 361238 Sample: rWqmXnEB3b.exe Startdate: 02/03/2021 Architecture: WINDOWS Score: 100 33 Multi AV Scanner detection for submitted file 2->33 35 Yara detected BitRAT 2->35 37 Yara detected Xmrig cryptocurrency miner 2->37 39 2 other signatures 2->39 6 rWqmXnEB3b.exe 1 2 2->6         started        10 Dfghjm.exe.exe 2->10         started        12 Dfghjm.exe.exe 2->12         started        process3 file4 23 C:\Users\user\AppData\...\Dfghjm.exe.exe, PE32 6->23 dropped 41 Detected unpacking (changes PE section rights) 6->41 43 Detected unpacking (overwrites its own PE header) 6->43 45 Contain functionality to detect virtual machines 6->45 47 Contains functionality to hide a thread from the debugger 6->47 14 rWqmXnEB3b.exe 1 3 6->14         started        49 Multi AV Scanner detection for dropped file 10->49 51 Machine Learning detection for dropped file 10->51 53 Contains functionality to inject code into remote processes 10->53 19 Dfghjm.exe.exe 10->19         started        55 Injects a PE file into a foreign processes 12->55 21 Dfghjm.exe.exe 12->21         started        signatures5 process6 dnsIp7 27 185.157.161.223, 1973, 49715, 49717 OBE-EUROPEObenetworkEuropeSE Sweden 14->27 25 C:\Users\user\AppData\Local:02-03-2021, ASCII 14->25 dropped 29 Creates files in alternative data streams (ADS) 14->29 31 Hides threads from debuggers 14->31 file8 signatures9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0a3572f48d77e2fc47735dedb2bdc2592ed3b0f60bcc88f30afe184aa545f080/
Threat name:
Win32.Trojan.Strictor
Create hunting rule
Status:
Malicious
First seen:
2021-03-02 17:52:15 UTC
AV detection:
22 of 48 (45.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bi2xf5eno7rpyr3tlxw3fpoclexnhmhwbpgir4yk7ymevjkf6caa._file
Verdict:
malicious
Similar samples:
16d2779eb519c6c58ac8e4b95595737f9f71f37bf214d6220036abf0fe7908b6
BitRAT
360dc7aa2889b1ed05b553eccab73348de2fae89cd7742e64422712298b670ca
BitRAT
5dfd85a1c9a3b450d9aa14d3ea0a6bac9db88623004e5e6d7b40e7ab3b17cd31
BitRAT
68087284713cf5b3080650a0f37fa67db5eff1b18c7cac032e0fa0c19752c118
BitRAT
6c2a2251861a6d2701814843fadac940cf4d34db9f446f0698352fd866b31739
BitRAT
7277f1d3ddf844d18b2b0f95b620c8617736ad6703234fee2cb46299590180fe
BitRAT
c18ee8f785af2b2aef01668ea83662281cb236af6b6405c65e01281635b20696
BitRAT
c482ebed5672bdbc0cca51b79bbb7babaa82a678142d981a7dd009ad813c20d7
BitRAT
d3f760c70906806de0a9911ab24a5824b3bfb8b3df312829c11c44fc85fa1dc8
BitRAT
db7619d7304cbb9c7ad4bf8c74836f241aecac1fda067f3ffadadf7ee6d44930
BitRAT
+ 100 additional samples on MalwareBazaar
Result
Malware family:
bitrat
Create hunting rule
Score:
  10/10
Tags:
family:bitrat persistence trojan
Link:
https://tria.ge/reports/210302-je769av3aj/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
BitRAT
BitRAT Payload
Unpacked files
SH256 hash:
3be01497e9717bd92ee2dfec465dfa0db4423e62c8f25a2f6f9718dd99d8f0d7
MD5 hash:
30af0b59c78f5abc44365eb2db883249
SHA1 hash:
9543604e8ccc4ec0d0ee7acf851b4c8ea3ea06bf
Link:
https://www.unpac.me/results/d7da4108-480e-45c8-8506-cc0ce892cb5c/
SH256 hash:
0a3572f48d77e2fc47735dedb2bdc2592ed3b0f60bcc88f30afe184aa545f080
MD5 hash:
2566ee6169d8c8be07d673be7819aa9d
SHA1 hash:
fc46a50a38738208f67294e3a283782864d0ed04
Link:
https://www.unpac.me/results/d7da4108-480e-45c8-8506-cc0ce892cb5c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0a3572f48d77e2fc47735dedb2bdc2592ed3b0f60bcc88f30afe184aa545f080

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Email_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Email in files like avemaria
Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:MALWARE_Win_BitRAT
Create hunting rule
Author:ditekSHen
Description:Detects BitRAT RAT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

BitRAT

Executable exe 0a3572f48d77e2fc47735dedb2bdc2592ed3b0f60bcc88f30afe184aa545f080

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/121103/
  
URLhaus
https://urlhaus.abuse.ch/url/1031102/
  
Delivery method
Distributed via web download

Comments