MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 31d4937d38020e77b2212b48db435d92d66fac2642c45c3cfd42504897f34403. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

BitRAT

Vendor detections: 9

Intelligence 9 IOCs YARA 1 File information Comments

SHA256 hash:	31d4937d38020e77b2212b48db435d92d66fac2642c45c3cfd42504897f34403
SHA3-384 hash:	fbf18f16a60570e6cf18abe284d83210bf817401c59478c304a0ed82c45708014d1fe2bd11d4c7ccde6928690b0ff864
SHA1 hash:	29f5a84c92c9a8586d41c34a156aee076376bafb
MD5 hash:	50387126fefde5d2927ab022b9aabe2c
humanhash:	fix-oregon-stream-mars
File name:	50387126fefde5d2927ab022b9aabe2c.exe
Download:	download sample
Signature	BitRAT Create hunting rule
File size:	3'189'605 bytes
First seen:	2022-07-28 06:52:43 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
ssdeep	98304:877Pmq33rE/JDLPWZADUGer7B6iY74M/z:K+R/eZADUXR0
TLSH	T136E5BE02F8428962D2574170E66E3BBB453CF635072489C3A7A06D705AB59D2BB3BF37
TrID	49.9% (.EXE) Win64 Executable (generic) (10523/12/4) 21.3% (.EXE) Win32 Executable (generic) (4505/5/1) 9.6% (.EXE) OS/2 Executable (generic) (2029/13) 9.5% (.EXE) Generic Win/DOS Executable (2002/3) 9.4% (.EXE) DOS Executable Generic (2000/1)
Reporter	abuse_ch
Tags:	BitRAT exe RAT

Intelligence

File Origin

# of uploads :

# of downloads :

329

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/294851/

Detection(s):

SecuriteInfo.com.Trojan.Siggen14.19963.32168.5847.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Launching a process

Searching for the window

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

overlay packed rat

Link:

https://www.filescan.io/uploads/62e23299ef4d15d9c032d850/reports/1ec93e8f-ecbc-4adb-88c1-389549c13f0e/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

BitRAT

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/46143ce5-c076-46d6-b6c2-42e33342fed2

Result

Threat name:

BitRAT

Detection:

malicious

Classification:

troj

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/1042311

Signature

Multi AV Scanner detection for submitted file

Yara detected BitRAT

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/31d4937d38020e77b2212b48db435d92d66fac2642c45c3cfd42504897f34403/

Threat name:

Win32.Backdoor.ParalaxRat

Status:

Malicious

First seen:

2022-07-28 04:11:40 UTC

File Type:

PE (Exe)

AV detection:

19 of 40 (47.50%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ghkjg7jyaihhpmrbfnenwq25sllg7lbgilcfyph5ijierf7tiqbq._file

Result

Malware family:

bitrat

Score:

10/10

Tags:

family:bitrat

Link:

https://tria.ge/reports/220728-hnnc3adfem/

Unpacked files

SH256 hash:

31d4937d38020e77b2212b48db435d92d66fac2642c45c3cfd42504897f34403

MD5 hash:

50387126fefde5d2927ab022b9aabe2c

SHA1 hash:

29f5a84c92c9a8586d41c34a156aee076376bafb

Detections:

win_bit_rat_auto

Link:

https://www.unpac.me/results/50718dcb-3e1c-41d9-8281-a1a8b32cc937/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.