MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0bff04505ca79f054fe406fd08cc7289462df2e3a16cd878e4bea7b7b1fdc670. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BitRAT


Vendor detections: 10


Intelligence 10 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0bff04505ca79f054fe406fd08cc7289462df2e3a16cd878e4bea7b7b1fdc670
SHA3-384 hash: aa7aeedcd7f8f179f4429536a43ab32e081189a50b5f4d439a2cc9a1effe7bf03f45469583dc6611dda5e11297f1bb76
SHA1 hash: 2804836fd73f477863d411df7915e22ad20d5e6d
MD5 hash: 246358731c6f96d318a5f6b6ba60ef7d
humanhash: september-kansas-blossom-pizza
File name:SecuriteInfo.com.Trojan.PackedNET.680.23816.17591
Download: download sample
Signature BitRAT
Create hunting rule
File size:2'221'056 bytes
First seen:2021-12-10 12:36:18 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 49152:amQYxdjblx29i17+JGhBrY3GIPlIZEIELphexAG2Df:aIfl4iHh1Y3NNzD4x+
Threatray 276 similar samples on MalwareBazaar
TLSH T1BFA5232173E96756D17E93730868A09413FEB11AD732E22C7CEA50FB4D72F0886B1B65
Reporter SecuriteInfoCom
Tags:BitRAT exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
227
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Trojan.PackedNET.680.23816.17591
Verdict:
Malicious activity
Analysis date:
2021-12-10 12:38:48 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/a18627a5-3899-4f41-8b84-c0309e50c9ae

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/213185/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.680.23816.17591.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/61b349f44d8e6f3a5e1f5fa0/reports/c0769ef7-a9f5-42cc-b825-262eefec10a6/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0bd595fa-6f3d-4b2c-b139-f58c197920de
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/905322
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses dynamic DNS services
Writes to foreign memory regions
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 537800 Sample: SecuriteInfo.com.Trojan.Pac... Startdate: 10/12/2021 Architecture: WINDOWS Score: 92 26 Antivirus / Scanner detection for submitted sample 2->26 28 Multi AV Scanner detection for submitted file 2->28 30 Yara detected AntiVM3 2->30 32 3 other signatures 2->32 6 SecuriteInfo.com.Trojan.PackedNET.680.23816.exe 3 2->6         started        process3 file4 20 SecuriteInfo.com.T...T.680.23816.exe.log, ASCII 6->20 dropped 34 Writes to foreign memory regions 6->34 36 Allocates memory in foreign processes 6->36 38 Injects a PE file into a foreign processes 6->38 10 vbc.exe 1 6->10         started        14 vbc.exe 6->14         started        16 vbc.exe 6->16         started        18 vbc.exe 6->18         started        signatures5 process6 dnsIp7 22 faithheals.duckdns.org 10->22 24 192.168.2.1 unknown unknown 10->24 40 Hides threads from debuggers 10->40 signatures8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0bff04505ca79f054fe406fd08cc7289462df2e3a16cd878e4bea7b7b1fdc670/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-04-26 14:07:47 UTC
File Type:
PE (.Net Exe)
Extracted files:
10
AV detection:
34 of 45 (75.56%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
19af65abb20a0194c6728230052b0fc7e763ab60250930ee6f84cecbbc642477
BitRAT
1cc623e73d0c6eeedfb75a89406c71dd183847f290133b73e470d20068384700
BitRAT
3eef6177a6ba3ac13850cfc0e229e6a6ede00b6cda2b01247e933d1585c27284
BitRAT
512e2ffb2c0fea781781ac3c04ce0ec6395add6cdb80cb4a6fb88ded75f0154c
BitRAT
8d5eccfebf89d043aed9c05293080f8045f54802a514265e03b4ec39c1eb58d2
BitRAT
8eb6fcb3e943426769b1433c8eafd4d87d2d255b7545f92ce570f73803a9a898
BitRAT
b24dca7a4be8c8bf61d8e2c17bb596caee88f6f2aabda72c14dc6f0f3684bb87
BitRAT
b735d91a1cd3e6849e83aaa4b07be315312796090b5fe6f11668b8decde753b4
BitRAT
cb24694242c1c1618678711184ab8abe6a1335d348f3549d2b568d99f793bf28
BitRAT
ec265177529ab61116c59e3361436b6c4f9e48bbef4488d2d3a97ebdb2f9837a
BitRAT
+ 266 additional samples on MalwareBazaar
Result
Malware family:
bitrat
Create hunting rule
Score:
  10/10
Tags:
family:bitrat trojan upx
Link:
https://tria.ge/reports/211210-ptf99sgdg3/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Uses the VBS compiler for execution
UPX packed file
CustAttr .NET packer
BitRAT
BitRAT Payload
Unpacked files
SH256 hash:
e90a19eba5f2de3ba82f652221105bb0682b07c20abddec487c6f4354ea79c39
MD5 hash:
efb0de4397ea61e17d262e278b53ff86
SHA1 hash:
727fdf2ceb13262d56bdda24a02564fb3e80c8b0
Link:
https://www.unpac.me/results/f5de4ef3-5554-4ae6-9b74-b09020334b0f/
SH256 hash:
0bff04505ca79f054fe406fd08cc7289462df2e3a16cd878e4bea7b7b1fdc670
MD5 hash:
246358731c6f96d318a5f6b6ba60ef7d
SHA1 hash:
2804836fd73f477863d411df7915e22ad20d5e6d
Link:
https://www.unpac.me/results/f5de4ef3-5554-4ae6-9b74-b09020334b0f/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/0bff04505ca7/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.54
Link:
https://yomi.yoroi.company/submissions/0bff04505ca79f054fe406fd08cc7289462df2e3a16cd878e4bea7b7b1fdc670

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/213185/

Comments