MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 313c959b7868e8a29f3402f4dc87905635f2fd0701441db7d9900d31ccd47d50. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

BitRAT

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	313c959b7868e8a29f3402f4dc87905635f2fd0701441db7d9900d31ccd47d50
SHA3-384 hash:	6515d11f63ec1d3ac1f9a1b69aa497562089aedcafbbf81b69478efaf21dfd12e101ec58c936b444f43be628a865b5a6
SHA1 hash:	bf6dd0f03e80fe4fbfc8e4222ae4acbee35b68bb
MD5 hash:	da3b8b8b369687b0140f1ff2abc6b7b3
humanhash:	happy-saturn-spring-equal
File name:	da3b8b8b369687b0140f1ff2abc6b7b3.exe
Download:	download sample
Signature	BitRAT Create hunting rule
File size:	4'425'216 bytes
First seen:	2021-02-15 20:14:05 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep	98304:czWWHWqTQdizfbeuoHtNSvGo9fGyc3/lsrH4ser9:cb2qRz65Mx9fGZ2Gr
Threatray	9 similar samples on MalwareBazaar
TLSH	4926012291D2A508E4ED7AF31720D11D3163FCCE7DB5A06929C236B7AD7B61143B89E3
Reporter	abuse_ch
Tags:	BitRAT exe RAT

Intelligence

File Origin

# of uploads :

# of downloads :

138

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

da3b8b8b369687b0140f1ff2abc6b7b3.exe

Verdict:

Suspicious activity

Analysis date:

2021-02-15 20:17:37 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/03ccd2d3-9ae1-4b4e-8914-f8ef263f7c21

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/117240/

Detection(s):

SecuriteInfo.com.Trojan.Packed2.42845.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

BitRAT Xmrig

Detection:

malicious

Classification:

troj.evad.mine

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/608443

Signature

Binary contains a suspicious time stamp

Contains functionality to hide a thread from the debugger

Contains functionality to inject code into remote processes

Hides threads from debuggers

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected BitRAT

Yara detected Xmrig cryptocurrency miner

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/313c959b7868e8a29f3402f4dc87905635f2fd0701441db7d9900d31ccd47d50/

Threat name:

ByteCode-MSIL.Packed.Generic

Status:

Suspicious

First seen:

2021-02-15 09:48:19 UTC

AV detection:

15 of 29 (51.72%)

Threat level:

1/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ge6jlg3yndukfhzual2nzb4qky27f7ihafcb3n6zsagtdtgupvia._file

Verdict:

unknown

BitRAT

522a495b289cf22898f762f18571b8839194e6232cb80fbb28dc426cbeeee323

BitRAT

634dcb680c790c160d226db106e6da96efdaa3ae9a9413fe500a98192c98c50c

BitRAT

7277f1d3ddf844d18b2b0f95b620c8617736ad6703234fee2cb46299590180fe

BitRAT

8c6515ea1d1dc1263f76e273d06eee09ce298ddaefa435b84bb6e5bc9b578da1

BitRAT

8edf23c4454fd98bd716452dc825103d48d9d34e71ef9f5166c81712865d3d9e

BitRAT

d3137355e1a0ae230086a1351aaad0a97fce1835de3fad1474dc2d32c593cc0f

BitRAT

e9c3fc00ddb08ef196d05b56ce0c83c04381de42e8777e902e3e9c7afe4a9f11

BitRAT

f29b0b35d584de9410f3ffe75e8e4dbc6d90ecbc6f2c4d9382d8faf33e88d80b

BitRAT

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/210215-k4jmgylys6/

Unpacked files

SH256 hash:

2ec41720b412f91f91daaefea38007449491b2c016238aa8f23b6866c89bc788

MD5 hash:

987ce346069cf47535e5ac57265c7228

SHA1 hash:

d0085325ed78fcac6d1f605753237abd1c40db22

Link:

https://www.unpac.me/results/271930db-c5f9-4085-9e3a-c98542f9fb29/

SH256 hash:

1204f6c74e159ee81c9e2db44c4ab7b7d0869062dad6dfb95ef50e77edfc32e7

MD5 hash:

d837e5424586dfc7bd3ae8c22e92da43

SHA1 hash:

149b72a9fbbc1b6a9b417e040e77a60cc7a49a61

Link:

https://www.unpac.me/results/271930db-c5f9-4085-9e3a-c98542f9fb29/

SH256 hash:

313c959b7868e8a29f3402f4dc87905635f2fd0701441db7d9900d31ccd47d50

MD5 hash:

da3b8b8b369687b0140f1ff2abc6b7b3

SHA1 hash:

bf6dd0f03e80fe4fbfc8e4222ae4acbee35b68bb

Link:

https://www.unpac.me/results/271930db-c5f9-4085-9e3a-c98542f9fb29/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.51

Link:

https://yomi.yoroi.company/submissions/313c959b7868e8a29f3402f4dc87905635f2fd0701441db7d9900d31ccd47d50

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu Create hunting rule
Author:	ditekSHen
Description:	Detect executables with stomped PE compilation timestamp that is greater than local current time