MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 16d2779eb519c6c58ac8e4b95595737f9f71f37bf214d6220036abf0fe7908b6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BitRAT


Vendor detections: 7


Intelligence 7 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 16d2779eb519c6c58ac8e4b95595737f9f71f37bf214d6220036abf0fe7908b6
SHA3-384 hash: e1a5923b9730cdca68044e63d7fd98f118a28c932b82875f04a852f74d2d370df33db0a4720967da0345d78006df89c8
SHA1 hash: a4909adade1c76d636ac5a6c8affa7ff2f44f78f
MD5 hash: 34133ac94d78f2c16d85a1aae62fd254
humanhash: mango-stairway-lactose-glucose
File name:Unterlagen PDF.exe
Download: download sample
Signature BitRAT
Create hunting rule
File size:2'142'720 bytes
First seen:2021-02-22 06:32:28 UTC
Last seen:2021-02-26 06:08:50 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'647 x AgentTesla, 19'451 x Formbook, 12'201 x SnakeKeylogger)
ssdeep 49152:h8Xcztc9/2uAi9HULJCEj5Xi+sY/mEGFqr:h86tcBnAiJezZismJor
Threatray 98 similar samples on MalwareBazaar
TLSH 07A5012122991A6CF5B7AB396AB5440FCBF1BC23DB36C55B3D60318F0D72E418772626
Reporter cocaman
Tags:BitRAT exe

Intelligence

File Origin
# of uploads :
11
# of downloads :
100
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/118178/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
BitRAT Xmrig
Create hunting rule
Detection:
malicious
Classification:
troj.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/613640
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code contains very large strings
Allocates memory in foreign processes
Contains functionality to hide a thread from the debugger
Contains functionality to inject code into remote processes
Detected unpacking (changes PE section rights)
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Sample uses process hollowing technique
Sigma detected: Scheduled temp file as task from temp location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Uses the Telegram API (likely for C&C communication)
Writes to foreign memory regions
Yara detected AntiVM_3
Yara detected BitRAT
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 355827 Sample: Unterlagen PDF.exe Startdate: 22/02/2021 Architecture: WINDOWS Score: 100 73 venomrating.hopto.org 2->73 75 avatars.githubusercontent.com 2->75 97 Multi AV Scanner detection for dropped file 2->97 99 Sigma detected: Scheduled temp file as task from temp location 2->99 101 Yara detected BitRAT 2->101 103 10 other signatures 2->103 11 Unterlagen PDF.exe 7 2->11         started        signatures3 process4 file5 65 C:\Users\user\AppData\Local\...\tmp48F3.tmp, XML 11->65 dropped 67 C:\Users\user\...\Unterlagen PDF.exe.log, ASCII 11->67 dropped 69 C:\Users\user\AppData\...\ulxYbBZKSNsyC.exe, PE32 11->69 dropped 109 Writes to foreign memory regions 11->109 111 Injects a PE file into a foreign processes 11->111 15 RegSvcs.exe 1 25 11->15         started        20 schtasks.exe 1 11->20         started        signatures6 process7 dnsIp8 81 cdn.discordapp.com 15->81 83 api.telegram.org 149.154.167.220, 443, 49691, 49701 TELEGRAMRU United Kingdom 15->83 85 5 other IPs or domains 15->85 57 C:\Users\user\AppData\Local\...\btc[1].exe, PE32 15->57 dropped 59 C:\Users\user\AppData\Local\...\btc[3].exe, PE32 15->59 dropped 61 C:\Users\user\AppData\Local\...\btc[2].exe, PE32 15->61 dropped 63 2 other malicious files 15->63 dropped 87 Contains functionality to inject code into remote processes 15->87 89 Writes to foreign memory regions 15->89 91 Allocates memory in foreign processes 15->91 95 4 other signatures 15->95 22 RegSvcs.exe 15->22         started        25 0JCVcV88.exe 15->25         started        27 RegSvcs.exe 6 15->27         started        30 RegSvcs.exe 15->30         started        32 conhost.exe 20->32         started        file9 93 Uses the Telegram API (likely for C&C communication) 81->93 signatures10 process11 file12 105 Injects a PE file into a foreign processes 22->105 34 schtasks.exe 22->34         started        36 RegSvcs.exe 22->36         started        107 Detected unpacking (changes PE section rights) 25->107 38 iexplore.exe 25->38         started        71 C:\Users\user\AppData\...\WmlCBzYsNvjOl.exe, PE32 27->71 dropped 40 schtasks.exe 27->40         started        42 RegSvcs.exe 27->42         started        44 RegSvcs.exe 27->44         started        signatures13 process14 process15 46 conhost.exe 34->46         started        48 WerFault.exe 36->48         started        50 conhost.exe 40->50         started        52 WerFault.exe 42->52         started        process16 54 iexplore.exe 50->54         started        dnsIp17 77 github.com 140.82.121.3, 443, 49723, 49724 GITHUBUS United States 54->77 79 avatars.githubusercontent.com 185.199.108.133, 443, 49729, 49730 FASTLYUS Netherlands 54->79
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/16d2779eb519c6c58ac8e4b95595737f9f71f37bf214d6220036abf0fe7908b6/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-02-22 03:00:37 UTC
File Type:
PE (.Net Exe)
Extracted files:
16
AV detection:
15 of 48 (31.25%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=c3jhphvvdhdmlcwi4s4vlfltp6pxd4336iknmiqag2v7b7tzbc3a._file
Verdict:
malicious
Similar samples:
360dc7aa2889b1ed05b553eccab73348de2fae89cd7742e64422712298b670ca
BitRAT
533aa4375a4eac85feb6d0ab962c38a68775ed412d056ed12535605fd5c1f415
BitRAT
6c212901b861bddfecd68559ceecc3a35898d965b4e56aeb67febbfa65dc9d52
BitRAT
6c2a2251861a6d2701814843fadac940cf4d34db9f446f0698352fd866b31739
BitRAT
7277f1d3ddf844d18b2b0f95b620c8617736ad6703234fee2cb46299590180fe
BitRAT
79e6d1b262a31a2619284f38b059e266d0fa27109c9b1f4fc9100aa6bb619e05
BitRAT
a294e980bb7b7e74981a67379dd4c589803d0d5c17946b3b00ce561791ecfc63
BitRAT
a52ed9486d2ccdf0a9e29fe70ea7df8ddcb8bc06f9329664a310ae32d1308d6f
BitRAT
aa79d46aa459af0d46da380af6481f51369da4c4080a009028e83857dcd844f2
BitRAT
db7619d7304cbb9c7ad4bf8c74836f241aecac1fda067f3ffadadf7ee6d44930
BitRAT
+ 88 additional samples on MalwareBazaar
Result
Malware family:
bitrat
Create hunting rule
Score:
  10/10
Tags:
family:bitrat trojan upx
Link:
https://tria.ge/reports/210222-hmss6a7f12/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Executes dropped EXE
UPX packed file
BitRAT
BitRAT Payload
Unpacked files
SH256 hash:
e624003658c4f8b349f567c82229fd15d1e63d3d20fe6f7b4388403038cd2a44
MD5 hash:
b6ce7c1d81b9271eab825ea63de154c3
SHA1 hash:
0e7b89555314f8908c1098b652c9bf50e5ecc27b
Link:
https://www.unpac.me/results/f540d820-ccb4-4f14-bd7f-bb0695c0ede3/
SH256 hash:
16d2779eb519c6c58ac8e4b95595737f9f71f37bf214d6220036abf0fe7908b6
MD5 hash:
34133ac94d78f2c16d85a1aae62fd254
SHA1 hash:
a4909adade1c76d636ac5a6c8affa7ff2f44f78f
Link:
https://www.unpac.me/results/f540d820-ccb4-4f14-bd7f-bb0695c0ede3/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Email_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Email in files like avemaria
Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:MALWARE_Win_BitRAT
Create hunting rule
Author:ditekSHen
Description:Detects BitRAT RAT
Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/
Rule name:upx_packed
Create hunting rule
Description:UPX packed file

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

BitRAT

zip c2e93c4abdef1d36dd8a41653b8945566e557d80f27832f839245c4098eb74e3

BitRAT

Executable exe 16d2779eb519c6c58ac8e4b95595737f9f71f37bf214d6220036abf0fe7908b6

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 c2e93c4abdef1d36dd8a41653b8945566e557d80f27832f839245c4098eb74e3
Cape
Cape
https://www.capesandbox.com/analysis/118178/

Comments