MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 3e8b88231d978979494ad100ee0b578e89c8dc354b23f3b1caf9d0fd86a37765. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
BitRAT
Vendor detections: 11
| SHA256 hash: | 3e8b88231d978979494ad100ee0b578e89c8dc354b23f3b1caf9d0fd86a37765 |
|---|---|
| SHA3-384 hash: | 102fb07584327de0fb843e00a1202dd1b5aa94e2eaf90838d1afacde998f2a4300acb4e302da26517ed31ea439a46b72 |
| SHA1 hash: | a625945ad476e59c3107f708c457a3ce8f675dec |
| MD5 hash: | ee8c70aa66bd53744f4b350b9516e67f |
| humanhash: | indigo-video-mango-cold |
| File name: | Sghzguwameybzriiwpflupyisqxvypagrv.exe |
| Download: | download sample |
| Signature | BitRAT |
| File size: | 887'296 bytes |
| First seen: | 2021-11-04 00:46:17 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 3513b15d2020b37cf2b66a761c75ed57 (3 x RemcosRAT, 1 x Formbook, 1 x BitRAT) |
| ssdeep | 12288:WxBZN9xp6/Yo9sSbJ+RLbKvOS9cr9BE6ZyxDcC6CoueU:WF/C/N+1KWS49xy |
| Threatray | 11 similar samples on MalwareBazaar |
| TLSH | T167157C62F1C08176C41A3FB8CD47BBEE14D9BF522CE0644B6BD83F4ACA346E5242A553 |
| File icon (PE): |  |
| dhash icon | 78f6b6aa8ed8e8b4 (11 x RemcosRAT, 11 x Formbook, 1 x BitRAT) |
| Reporter |  GovCERT_CH |
| Tags: | BitRAT exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
145
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Sghzguwameybzriiwpflupyisqxvypagrv.exe
Verdict:
Malicious activity
Analysis date:
2021-11-04 00:51:04 UTC
Tags:
trojan bitrat rat
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
67%
Tags:
keylogger remcos
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Result
Threat name:
BitRAT
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Signature
C2 URLs / IPs found in malware configuration
Creates a thread in another existing process (thread injection)
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Writes to foreign memory regions
Yara detected BitRAT
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.DelfInject
Status:
Malicious
First seen:
2021-11-03 21:14:38 UTC
AV detection:
19 of 27 (70.37%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 1 additional samples on MalwareBazaar
Result
Malware family:
bitrat
Score:
10/10
Tags:
family:bitrat persistence suricata trojan upx
Behaviour
Modifies registry key
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of NtSetInformationThreadHideFromDebugger
Adds Run key to start application
UPX packed file
BitRAT
BitRAT Payload
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
Unpacked files
SH256 hash:
70bd3e01b06e54d3623976213eedfe5ecdd635bc5432fc769f3d469a3d7321b3
MD5 hash:
5f784b2a0e9e31dcd2dcb8a42a76086c
SHA1 hash:
b165b8a2d8d5586cc2987f5a3af659ccfa662df8
Detections:
win_temple_loader_w0
Parent samples :
5319f3410910762ce2ce6846ee27fffcb22673693874bad5844510b627d0f715
8092efe07b8ea30e06c824d673824d1bdc867d6dc66ac83024256ca8620b2cc9
680c9cb7cec2aa66bb7b74385f8e31d2eb6f1894c0d1d1d9a44056da6c0234e1
5791b27e20fa666be3f44f75942070fda981fc2fadaa4e6d410376a41bde0d89
22a943a5c28c80163c59b4a42923050c5af77fe9cc919aee6d1aab569d684dc6
3e8b88231d978979494ad100ee0b578e89c8dc354b23f3b1caf9d0fd86a37765
1e1b82105fd64b23e2a37614fa59ff29c6bb675c1fbc8c43b0b56fe960d0080b
ee512919a9cfc596c316713b5456687ef0f53e53bd8b3a84ee4fb4792f8ac02e
8092efe07b8ea30e06c824d673824d1bdc867d6dc66ac83024256ca8620b2cc9
680c9cb7cec2aa66bb7b74385f8e31d2eb6f1894c0d1d1d9a44056da6c0234e1
5791b27e20fa666be3f44f75942070fda981fc2fadaa4e6d410376a41bde0d89
22a943a5c28c80163c59b4a42923050c5af77fe9cc919aee6d1aab569d684dc6
3e8b88231d978979494ad100ee0b578e89c8dc354b23f3b1caf9d0fd86a37765
1e1b82105fd64b23e2a37614fa59ff29c6bb675c1fbc8c43b0b56fe960d0080b
ee512919a9cfc596c316713b5456687ef0f53e53bd8b3a84ee4fb4792f8ac02e
SH256 hash:
3e8b88231d978979494ad100ee0b578e89c8dc354b23f3b1caf9d0fd86a37765
MD5 hash:
ee8c70aa66bd53744f4b350b9516e67f
SHA1 hash:
a625945ad476e59c3107f708c457a3ce8f675dec
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.