MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1ce688c18aeac8e14b9e022c644193549af78239b11d22d843c57b5aae6e3b8c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

BitRAT

Vendor detections: 9

Intelligence 9 IOCs YARA 3 File information Comments

SHA256 hash:	1ce688c18aeac8e14b9e022c644193549af78239b11d22d843c57b5aae6e3b8c
SHA3-384 hash:	6b49db0568b769f7cdd4d429a2e9ff25531ab29ca7a81ce2c3e6f48a8917cbd22b267556ecfb2d82cd0b6ebe78311d33
SHA1 hash:	2487304c01b0d01f783b3d87f74806ce3f9a456c
MD5 hash:	896e7b3008849a4ee1cd70de0d1ce636
humanhash:	wyoming-bluebird-magnesium-spaghetti
File name:	DHL detail.exe
Download:	download sample
Signature	BitRAT Create hunting rule
File size:	1'610'240 bytes
First seen:	2020-12-24 16:35:20 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	7da4566606a6e32590916ebceb94dd14 (2 x Matiex, 1 x BitRAT, 1 x RemcosRAT)
ssdeep	49152:dgB+B+4zZ7T1Idhpb+//MUMM8VXuqHJ7djLnT1M65:wK+UvidQaz7JLnpMy
Threatray	58 similar samples on MalwareBazaar
TLSH	4F75335A577ECF28C2479FF607EF88B8660D0453078971BFF2A52C10D8F3A89D65624A
Reporter	abuse_ch
Tags:	BitRAT exe RAT

abuse_ch

Malspam distributing BitRAT:

HELO: geetoolsmtp4.wickcz3wjevexd0kwxo5mu0d1a.yx.internal.cloudapp.net
Sending IP: 13.78.174.70
From: DHL Customer Service <customer@dhl.com>
Subject: DHL - Pending delivery
Attachment: DHL detail.img (contains "DHL detail.exe")

BitRAT C2:
bitrat.nsupdate.info

Intelligence

File Origin

# of uploads :

# of downloads :

734

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

DHL detail.exe

Verdict:

Suspicious activity

Analysis date:

2020-12-24 16:38:24 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/3c141728-e674-4cfa-93fc-23bb54f4b42d

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/109386/

Detection(s):

SecuriteInfo.com.BehavesLike.Win32.PWSZbot.tc.23636.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Result

Threat name:

BitRAT

Detection:

malicious

Classification:

troj.evad

Score:

84 / 100

Link:

https://www.joesandbox.com/analysis/569847

Signature

Antivirus / Scanner detection for submitted sample

Contains functionality to hide a thread from the debugger

Contains functionality to inject code into remote processes

Hides threads from debuggers

Machine Learning detection for sample

Maps a DLL or memory area into another process

Multi AV Scanner detection for submitted file

Yara detected BitRAT

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1ce688c18aeac8e14b9e022c644193549af78239b11d22d843c57b5aae6e3b8c/

Threat name:

Win32.Spyware.Solmyr

Status:

Malicious

First seen:

2020-12-24 16:36:08 UTC

AV detection:

15 of 29 (51.72%)

Threat level:

2/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=dttirqmk5leocs46aiwgiqmtksnpparzweosfwcdyv5vvltohoga._file

Verdict:

malicious

Result

Malware family:

n/a

Score:

8/10

Tags:

upx

Link:

https://tria.ge/reports/201224-nlj7pke7wx/

Behaviour

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

UPX packed file

Unpacked files

SH256 hash:

65fbcdf932a714994d597dc2992388f6fbd83054b3e6bced41a2789224360252

MD5 hash:

1366106add50e80449e2453ee05dffab

SHA1 hash:

c4ae51436b5094743b490444ae5ccb70413fab75

Detections:

win_bit_rat_w0

Link:

https://www.unpac.me/results/22302f2d-1503-4883-aa6a-d043a3a222ff/

Parent samples :

3faafeae03cf24f47b90a17040357b6b130ec8daf8d39a3410be86dbd767a541
1b95de55808c88599a46d6a21a0063a874a6e2ca7f0644989ce60eee025a6485
1ce688c18aeac8e14b9e022c644193549af78239b11d22d843c57b5aae6e3b8c

SH256 hash:

1ce688c18aeac8e14b9e022c644193549af78239b11d22d843c57b5aae6e3b8c

MD5 hash:

896e7b3008849a4ee1cd70de0d1ce636

SHA1 hash:

2487304c01b0d01f783b3d87f74806ce3f9a456c

Link:

https://www.unpac.me/results/22302f2d-1503-4883-aa6a-d043a3a222ff/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/1ce688c18aeac8e14b9e022c644193549af78239b11d22d843c57b5aae6e3b8c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MALWARE_Win_BitRAT Create hunting rule
Author:	ditekSHen
Description:	Detects BitRAT RAT

Rule name:	suspicious_packer_section Create hunting rule
Author:	@j0sm1
Description:	The packer/protector section names/keywords
Reference:	http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/