MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 26451cc21c9b45f518c361ce5c7db51016fc19cd8aca7c2886e26e768eb10a81. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BitRAT


Vendor detections: 8


Intelligence 8 IOCs 1 YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 26451cc21c9b45f518c361ce5c7db51016fc19cd8aca7c2886e26e768eb10a81
SHA3-384 hash: 67397bcabf2be015235e75c27f5e151e68b38a705b7c617595828862027fed363cf08c3123752a4ed9f2e7246a953c9f
SHA1 hash: de43eff7cb2d6712c9d458f1700f657741101721
MD5 hash: 2f607fcbd684a21335fceb9ce0bc0174
humanhash: mike-virginia-colorado-six
File name:26451cc21c9b45f518c361ce5c7db51016fc19cd8aca7.exe
Download: download sample
Signature BitRAT
Create hunting rule
File size:105'984 bytes
First seen:2021-06-13 06:40:14 UTC
Last seen:2021-06-13 07:37:11 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 3072:YWUaV9mCyM8MqZaPFgrahWcJ0mrCELexZb:YsV9mCy2zue
TLSH 40A30969A3E01F15F5FE6BF590A31204CF7C7116386EF76A1C96E4F51CA23948A013A7
Reporter abuse_ch
Tags:BitRAT exe RAT


Avatar
abuse_ch
BitRAT C2:
41.102.231.123:300

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
41.102.231.123:300 https://threatfox.abuse.ch/ioc/100955/

Intelligence

File Origin
# of uploads :
2
# of downloads :
311
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
VueScan KeyGen v1.1.exe
Verdict:
Malicious activity
Analysis date:
2021-06-10 19:11:58 UTC
Tags:
opendir trojan bitrat rat
Link:
https://app.any.run/tasks/85068418-b93c-4626-9867-48fcac5953df

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/166287/
Detection(s):
SecuriteInfo.com.Trojan.MSIL.Injuke.gen.13070.1114.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Sending an HTTP GET request
Sending a UDP request
Running batch commands
Creating a process with a hidden window
Using the Windows Management Instrumentation requests
Unauthorized injection to a recently created process
Creating a file
Setting a global event handler
Connection attempt
Setting a global event handler for the keyboard
Enabling autorun by creating a file
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a5a155a8-30f0-466c-bad8-f8ff5c9b96c8
Result
Threat name:
BitRAT Xmrig
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.spyw.evad.mine
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/801259
Signature
.NET source code contains potential unpacker
Contains functionality to hide a thread from the debugger
Contains functionality to inject code into remote processes
Contains functionality to log keystrokes (.Net Source)
Drops PE files to the startup folder
Hides threads from debuggers
Injects a PE file into a foreign processes
Sigma detected: WScript or CScript Dropper
Suspicious powershell command line found
Yara detected BitRAT
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 433655 Sample: 26451cc21c9b45f518c361ce5c7... Startdate: 13/06/2021 Architecture: WINDOWS Score: 92 53 tornoob.me 2->53 71 Yara detected BitRAT 2->71 73 Yara detected Xmrig cryptocurrency miner 2->73 75 .NET source code contains potential unpacker 2->75 77 4 other signatures 2->77 10 26451cc21c9b45f518c361ce5c7db51016fc19cd8aca7.exe 15 4 2->10         started        13 26451cc21c9b45f518c361ce5c7db51016fc19cd8aca7.exe 3 2->13         started        signatures3 process4 dnsIp5 61 yggteam.com 172.67.153.238, 49734, 49749, 49766 CLOUDFLARENETUS United States 10->61 16 cmd.exe 3 10->16         started        20 cmd.exe 1 10->20         started        81 Injects a PE file into a foreign processes 13->81 22 26451cc21c9b45f518c361ce5c7db51016fc19cd8aca7.exe 1 13->22         started        25 26451cc21c9b45f518c361ce5c7db51016fc19cd8aca7.exe 13->25         started        27 26451cc21c9b45f518c361ce5c7db51016fc19cd8aca7.exe 13->27         started        29 26451cc21c9b45f518c361ce5c7db51016fc19cd8aca7.exe 13->29         started        signatures6 process7 dnsIp8 49 26451cc21c9b45f518...1016fc19cd8aca7.exe, PE32 16->49 dropped 51 26451cc21c9b45f518...exe:Zone.Identifier, ASCII 16->51 dropped 65 Suspicious powershell command line found 16->65 67 Drops PE files to the startup folder 16->67 31 conhost.exe 16->31         started        33 powershell.exe 18 20->33         started        35 wscript.exe 20->35         started        37 conhost.exe 20->37         started        39 timeout.exe 1 20->39         started        55 tornoob.me 41.102.231.123, 300 ALGTEL-ASDZ Algeria 22->55 57 192.168.2.1 unknown unknown 22->57 69 Hides threads from debuggers 22->69 file9 signatures10 process11 process12 41 26451cc21c9b45f518c361ce5c7db51016fc19cd8aca7.exe 33->41         started        dnsIp13 59 yggteam.com 41->59 79 Injects a PE file into a foreign processes 41->79 45 26451cc21c9b45f518c361ce5c7db51016fc19cd8aca7.exe 41->45         started        signatures14 process15 dnsIp16 63 tornoob.me 45->63 83 Hides threads from debuggers 45->83 signatures17
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/26451cc21c9b45f518c361ce5c7db51016fc19cd8aca7c2886e26e768eb10a81/
Threat name:
ByteCode-MSIL.Trojan.Injuke
Create hunting rule
Status:
Malicious
First seen:
2021-06-11 06:11:17 UTC
AV detection:
7 of 46 (15.22%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ezcrzqq4tnc7kggdmhhfy7nvcalpygonrlfhykeg4jxhndvrbkaq._file
Result
Malware family:
bitrat
Create hunting rule
Score:
  10/10
Tags:
family:bitrat trojan
Link:
https://tria.ge/reports/210613-t2g1ye5zz6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Drops startup file
BitRAT
BitRAT Payload
Unpacked files
SH256 hash:
26451cc21c9b45f518c361ce5c7db51016fc19cd8aca7c2886e26e768eb10a81
MD5 hash:
2f607fcbd684a21335fceb9ce0bc0174
SHA1 hash:
de43eff7cb2d6712c9d458f1700f657741101721
Link:
https://www.unpac.me/results/f2d4375c-8fde-45fa-98eb-2c9fcccb45c7/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/26451cc21c9b45f518c361ce5c7db51016fc19cd8aca7c2886e26e768eb10a81

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Email_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Email in files like avemaria
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:MALWARE_Win_BitRAT
Create hunting rule
Author:ditekSHen
Description:Detects BitRAT RAT
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/166287/

Comments