MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 259c654cdd235de9942f23bc7465252d50f2edf6e0b2dc320658fc00bc054ac4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BitRAT


Vendor detections: 10


Intelligence 10 IOCs 1 YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 259c654cdd235de9942f23bc7465252d50f2edf6e0b2dc320658fc00bc054ac4
SHA3-384 hash: 64337b87d4bae66b73bac23582071f2c543324de05ff605d1a95b02c1e43a35e89aacb759889a5615c2047bc9af958d3
SHA1 hash: 7f66963cc9c85f38349470e2b046007edd128fdb
MD5 hash: a09f9a55d0b7e456179e43f1fe1abe2f
humanhash: ten-eleven-angel-muppet
File name:a09f9a55d0b7e456179e43f1fe1abe2f.exe
Download: download sample
Signature BitRAT
Create hunting rule
File size:1'511'424 bytes
First seen:2021-07-24 08:31:16 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 6ed4f5f04d62b18d96b26d6db7c18840 (235 x SalatStealer, 78 x BitRAT, 42 x RedLineStealer)
ssdeep 24576:andRKZCy2BrhCeU2i2cJijFbCBTPmiY05tJMSQp5ysA7Yg1nLkzOlthXuviY:cXDFBU2iIBb0xY/6sUYYblttFY
Threatray 597 similar samples on MalwareBazaar
TLSH T1116533F11A2E977AF65ACC3CB97B1D03CD78C261256B05167F2CC4BE60FEA621484C66
Reporter abuse_ch
Tags:BitRAT exe RAT


Avatar
abuse_ch
BitRAT C2:
212.192.241.19:4898

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
212.192.241.19:4898 https://threatfox.abuse.ch/ioc/162690/

Intelligence

File Origin
# of uploads :
1
# of downloads :
162
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
a09f9a55d0b7e456179e43f1fe1abe2f.exe
Verdict:
Malicious activity
Analysis date:
2021-07-24 08:37:00 UTC
Tags:
trojan bitrat rat
Link:
https://app.any.run/tasks/e7c65753-90ea-4874-b461-a397a1db4b0d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
BitRAT
Create hunting rule
Link:
https://www.capesandbox.com/analysis/173875/
Detection(s):
PUA.Win.Packer.Upolyx-12
Create hunting rule

Win.Malware.Mikey-9819889-0
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
BitRAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6131ac40-a816-4990-a382-bbe88829960a
Result
Threat name:
BitRAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/821200
Signature
Antivirus / Scanner detection for submitted sample
Hides threads from debuggers
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected BitRAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/259c654cdd235de9942f23bc7465252d50f2edf6e0b2dc320658fc00bc054ac4/
Threat name:
Win32.Backdoor.ParalaxRat
Create hunting rule
Status:
Malicious
First seen:
2021-07-22 23:09:10 UTC
AV detection:
32 of 46 (69.57%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ewogktg5eno6tfbpeo6hizjffvipf3pw4cznymqgld6abpafjlca._file
Verdict:
malicious
Similar samples:
3d63c22ce814418819c6a1783e542bd75a23ca4321f49208391f18dd781b27e7
BitRAT
4a820b04406f4c710b08b1675a7ffa778c806285dd115404fb415a8096baadda
BitRAT
52dbaf7435516b388d60abebda89615a4c2286a663de889a15b45be3b71b0def
BitRAT
60b1e21007ef93c3ac0bb8fcb0d063f2429aae47b4715d0324096887aeb165f8
BitRAT
8c584a322deb7e0731b90ae30dbdfe4821d13ad8ae7ade8fffd28ebbf0ca2504
BitRAT
9438c974f3cdefd5a097e55bde4734a2db9438be7c8012fa455d4d8bceb537ca
BitRAT
befaecfa9c1207b951dcf8e72b803cb32d237f16d9e49df1c6c29fcf690b4ec3
BitRAT
f69b86e22b03881dc837afc9a2c0d4f6555e1e9eb19f7c826b3eb695feaa76bb
BitRAT
+ 587 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
suricata upx
Link:
https://tria.ge/reports/210724-q9bvfgygk2/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
Unpacked files
SH256 hash:
abc00d610ca15f87ed9a9dc311160ce643f849635534900235e293828fb0c9d4
MD5 hash:
ab4330a902cc9dc1506f85b8e785a040
SHA1 hash:
343fbf33a768b62a88a7cd2634394cd4c544431d
Link:
https://www.unpac.me/results/4eb68661-4e74-4578-a700-0e4933116030/
SH256 hash:
259c654cdd235de9942f23bc7465252d50f2edf6e0b2dc320658fc00bc054ac4
MD5 hash:
a09f9a55d0b7e456179e43f1fe1abe2f
SHA1 hash:
7f66963cc9c85f38349470e2b046007edd128fdb
Link:
https://www.unpac.me/results/4eb68661-4e74-4578-a700-0e4933116030/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.79
Link:
https://yomi.yoroi.company/submissions/259c654cdd235de9942f23bc7465252d50f2edf6e0b2dc320658fc00bc054ac4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_BitRAT
Create hunting rule
Author:ditekSHen
Description:Detects BitRAT RAT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/173875/

Comments