MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1aa49d396f379747b78ad52b75228a66a330caa67eae2fd86c0cf4b9bbf078a1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BitRAT


Vendor detections: 9


Intelligence 9 IOCs 1 YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1aa49d396f379747b78ad52b75228a66a330caa67eae2fd86c0cf4b9bbf078a1
SHA3-384 hash: 4bb94b7c9cee6afd0b96ec04d8d266dfdc15192f1d2b33df9b8bfc8e1b3656571733fd7965be73e996b85694a3d68260
SHA1 hash: 27620f0b8412b40d74ea0af98970f9f64d6ef60d
MD5 hash: 226ba2426c05250b6cc81014631d9559
humanhash: montana-leopard-table-salami
File name:invoice11201.exe
Download: download sample
Signature BitRAT
Create hunting rule
File size:1'755'856 bytes
First seen:2021-06-01 19:55:31 UTC
Last seen:2021-06-01 20:39:49 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 7fa974366048f9c551ef45714595665e (946 x Formbook, 398 x Loki, 261 x AgentTesla)
ssdeep 24576:G0bldrWsWS8Sc18Er7V9lgJuxiAKBzBYk1IVIf0Nw39JCsIhpaWrGR1CzVE0NTb/:PpUVjGJusAECNwntIhcWa/ClbbDi+
Threatray 189 similar samples on MalwareBazaar
TLSH 3C8512C44D120EA7DE774AB86742DFD5EB2B4186A3D38D1FE70B0F58290A38CAE245C5
Reporter abuse_ch
Tags:BitRAT exe RAT


Avatar
abuse_ch
BitRAT C2:
212.192.241.187:5520

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
212.192.241.187:5520 https://threatfox.abuse.ch/ioc/68337/

Intelligence

File Origin
# of uploads :
2
# of downloads :
214
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
invoice11201.exe
Verdict:
Malicious activity
Analysis date:
2021-06-01 19:58:37 UTC
Tags:
installer trojan bitrat rat
Link:
https://app.any.run/tasks/98715552-4df4-4ead-becb-031f57449698

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/163891/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware2.6353.20954.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a file
Creating a file in the %AppData% subdirectories
Unauthorized injection to a recently created process
Sending a UDP request
Creating a window
DNS request
Setting a global event handler
Sending a custom TCP request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Setting a global event handler for the keyboard
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
BitRAT Xmrig
Create hunting rule
Detection:
malicious
Classification:
troj.evad.mine
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/795511
Signature
Contains functionality to hide a thread from the debugger
Contains functionality to inject code into remote processes
Creates files in alternative data streams (ADS)
Hides threads from debuggers
Initial sample is a PE file and has a suspicious name
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Performs DNS queries to domains with low reputation
Yara detected BitRAT
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 427907 Sample: invoice11201.exe Startdate: 01/06/2021 Architecture: WINDOWS Score: 92 47 Yara detected BitRAT 2->47 49 Yara detected Xmrig cryptocurrency miner 2->49 51 Initial sample is a PE file and has a suspicious name 2->51 6 invoice11201.exe 1 21 2->6         started        10 jkrsmbip.exe 17 2->10         started        12 jkrsmbip.exe 17 2->12         started        process3 file4 23 C:\Users\user\AppData\...\jkrsmbip.exe, PE32 6->23 dropped 25 C:\Users\user\AppData\Local\...\System.dll, PE32 6->25 dropped 53 Performs DNS queries to domains with low reputation 6->53 55 Contains functionality to inject code into remote processes 6->55 57 Maps a DLL or memory area into another process 6->57 59 Contains functionality to hide a thread from the debugger 6->59 14 invoice11201.exe 1 1 6->14         started        27 C:\Users\user\AppData\Local\...\System.dll, PE32 10->27 dropped 61 Multi AV Scanner detection for dropped file 10->61 19 jkrsmbip.exe 10->19         started        29 C:\Users\user\AppData\Local\...\System.dll, PE32 12->29 dropped 21 jkrsmbip.exe 12->21         started        signatures5 process6 dnsIp7 33 dopeonlineforwarding.xyz 14->33 35 dopeonlineforwarding.xyz 212.192.241.187, 49740, 49748, 49749 RAPMSB-ASRU Russian Federation 14->35 37 192.168.2.1 unknown unknown 14->37 31 C:\Users\user\AppData\Local:01-06-2021, ASCII 14->31 dropped 41 Creates files in alternative data streams (ADS) 14->41 43 Hides threads from debuggers 14->43 39 dopeonlineforwarding.xyz 19->39 file8 45 Performs DNS queries to domains with low reputation 39->45 signatures9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1aa49d396f379747b78ad52b75228a66a330caa67eae2fd86c0cf4b9bbf078a1/
Threat name:
Win32.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2021-06-01 19:56:11 UTC
AV detection:
10 of 29 (34.48%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dksj2olpg6lupn4k2uvxkiukm2rtbsvgp2xc7wdmbt2lto7qpcqq._file
Verdict:
malicious
Similar samples:
083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89
BitRAT
1759dd8f52a3e1e13c8b23adff5c8f2d0db25d9fe60abf25acb607103924e7a3
BitRAT
1d64c9836f3e45a4083774fa75ef8b1ca9be4b85561ec12608a10570734f3725
BitRAT
352079b5516356dae554a0373e989019253b4ccc75975ddf7962e6ce17d47f4e
BitRAT
5764c6a1fc596df5e693f53736692d4f395ba92cb0b9a30db1b2b00d790155c0
BitRAT
777a8e5ae3342940c8f95e98a46d5b9bde8a431692f91b9b26d265034d6f41a1
BitRAT
a9133df8b9feede980d560c44b754298fc751da2ea00909ed2375f396ed3e813
BitRAT
a9b4758c091b653468bcfe33b2262f282589e0e5c52c02120b215a4bc6109d6a
BitRAT
d6ec5d9dbff79fbd96cf26d533feabb9c77087fc59be1d7b6f74d196b26d19cd
BitRAT
f902d7a9a985e2488fc770e265cec8fcaffb1848c4cd506a67e03b2f20484281
BitRAT
+ 179 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence upx
Link:
https://tria.ge/reports/210601-z7v29h8qmx/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
UPX packed file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1aa49d396f379747b78ad52b75228a66a330caa67eae2fd86c0cf4b9bbf078a1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Email_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Email in files like avemaria
Rule name:MALWARE_Win_BitRAT
Create hunting rule
Author:ditekSHen
Description:Detects BitRAT RAT
Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/163891/

Comments