MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2d008c3033f4c5dbfe78d0ad678568b4bc06526e53b7a811fb86ca9e89a9d844. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BitRAT


Vendor detections: 10


Intelligence 10 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2d008c3033f4c5dbfe78d0ad678568b4bc06526e53b7a811fb86ca9e89a9d844
SHA3-384 hash: 76a1230e315bf522bc5b45c3f3b7559f67abebdb9504f0da9f63bc24e54ea6613f56262f2101b5300203e785fd8531b5
SHA1 hash: 71779521204f9be588431afb15e93de5f09d6c3f
MD5 hash: 4e28b4731390e164ae303fe0ce42868e
humanhash: fix-sierra-tennessee-muppet
File name:4e28b4731390e164ae303fe0ce42868e.exe
Download: download sample
Signature BitRAT
Create hunting rule
File size:871'064 bytes
First seen:2021-04-26 13:04:40 UTC
Last seen:2021-04-26 13:52:10 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash ebadec131a7d06138ca29b130faf8093 (1 x NetWire, 1 x BitRAT, 1 x RemcosRAT)
ssdeep 12288:jVd4W9f+QBiHK8sAo6oZFz85deRqWyAwFKLzU7kmLUgU/OyVwvDa:hCWF8HK8skoZW5dZXA00WxUDVw
Threatray 155 similar samples on MalwareBazaar
TLSH 6B058C22A68140F3C4AF15345C3A7A7558A2FA313EF55C8666F46E087FBF6903D2DD82
Reporter abuse_ch
Tags:BitRAT exe RAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
219
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
4e28b4731390e164ae303fe0ce42868e.exe
Verdict:
Malicious activity
Analysis date:
2021-04-26 13:05:50 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/1dc85494-c850-4015-bd06-2ad3fb786ff0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/144367/
Detection(s):
PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Sending a UDP request
DNS request
Creating a file
Deleting a recently created file
Unauthorized injection to a recently created process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
BitRAT Xmrig
Create hunting rule
Detection:
malicious
Classification:
troj.evad.mine
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/697988
Signature
Creates files in alternative data streams (ADS)
Hides threads from debuggers
Injects a PE file into a foreign processes
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Uses dynamic DNS services
Yara detected BitRAT
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2d008c3033f4c5dbfe78d0ad678568b4bc06526e53b7a811fb86ca9e89a9d844/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2021-04-26 13:05:22 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fuaiymbt6tc5x7ty2cwwpbliws6amutoko32qep3q3fj5cnj3bca._file
Verdict:
malicious
Similar samples:
2d5a9858f39c976a0e10ce4b8f1d05ad7bd1fe0872151ef43df402ebce15b46b
BitRAT
352079b5516356dae554a0373e989019253b4ccc75975ddf7962e6ce17d47f4e
BitRAT
6110c332c287a7ac7fadde14aa3b69190a415e11f664f6746b461b589e0276cd
BitRAT
6c2ca93949c6c8463079056deb121abcaea9934dcd860024624a4b0d53093204
BitRAT
84a40d0820ae9248a654b7d462fa3127d376792e16cf52b4621ca29add8fe0e5
BitRAT
a9133df8b9feede980d560c44b754298fc751da2ea00909ed2375f396ed3e813
BitRAT
a9c5029521e6d748545aabc303731f7df321976c956a43c971428b123e3c849f
BitRAT
ad49dea56c095979c172d844522d5f97458e41d03e8e97e647b6ee35f244c6ae
BitRAT
d509a1aac6989c651953416b29ee6c949eba0be53df193b29e2e95e5b9e4635e
BitRAT
d6ec5d9dbff79fbd96cf26d533feabb9c77087fc59be1d7b6f74d196b26d19cd
BitRAT
+ 145 additional samples on MalwareBazaar
Result
Malware family:
bitrat
Create hunting rule
Score:
  10/10
Tags:
family:bitrat persistence trojan upx
Link:
https://tria.ge/reports/210426-2bqr5l6z9j/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
UPX packed file
BitRAT
BitRAT Payload
Unpacked files
SH256 hash:
31ffb1d8050b158b4c432cbb831f9da9b918443b7ed3ecca7e3d7a18a531e3f9
MD5 hash:
406f0b9cc6dacbdd1b715c557b941343
SHA1 hash:
77387463c87215e20a8592430665820cbb146660
Link:
https://www.unpac.me/results/086bb5dc-1c3d-4526-b972-ad899a504b68/
SH256 hash:
2d008c3033f4c5dbfe78d0ad678568b4bc06526e53b7a811fb86ca9e89a9d844
MD5 hash:
4e28b4731390e164ae303fe0ce42868e
SHA1 hash:
71779521204f9be588431afb15e93de5f09d6c3f
Link:
https://www.unpac.me/results/086bb5dc-1c3d-4526-b972-ad899a504b68/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2d008c3033f4c5dbfe78d0ad678568b4bc06526e53b7a811fb86ca9e89a9d844

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Email_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Email in files like avemaria
Rule name:INDICATOR_KB_CERT_0be3f393d1ef0272aed0e2319c1b5dd0
Create hunting rule
Author:ditekSHen
Description:Detects executables signed with stolen, revoked or invalid certificates
Rule name:MALWARE_Win_BitRAT
Create hunting rule
Author:ditekSHen
Description:Detects BitRAT RAT
Rule name:MALWARE_Win_DLAgent07
Create hunting rule
Author:ditekSHen
Description:Detects delf downloader agent
Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/144367/

Comments