MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 448d23c53cc9f4a1a97683474c4e2e7a45ac05570effebc9018924a2c3cc44dc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BitRAT


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 448d23c53cc9f4a1a97683474c4e2e7a45ac05570effebc9018924a2c3cc44dc
SHA3-384 hash: a82f0999d921ad6e17ff6e9cc587f039e9605ac8a5b3da21e8c35ed6d577530bbe76ec79bcb5a8f2ba866bf5f4554e34
SHA1 hash: 3d52224ca0af65863a464c90896270b56b81028e
MD5 hash: 6889cfb3137ffee92478c3c2bb2a7722
humanhash: mobile-fourteen-item-network
File name:JCKCFSQXDZNKKJZTFXKSGP.ps1
Download: download sample
Signature BitRAT
Create hunting rule
File size:3'294'493 bytes
First seen:2022-05-07 17:14:10 UTC
Last seen:Never
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 24576:w33eITsPXOtpncI+YvuBYriu44yzXMPFz5hJRZF20iuLC+JjGsh1PV0jCF4/8ky9:u
Threatray 922 similar samples on MalwareBazaar
TLSH T11DE5AFDD9A4DA4D07F81BFC9D8862DCF26204731BAA120295E7BF8468DA74FD904BDC4
Reporter obfusor
Tags:BitRAT bladabindi ps1

Intelligence

File Origin
# of uploads :
1
# of downloads :
410
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Script.SNH-genTrj.9972.26434.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
powershell
Link:
https://www.filescan.io/uploads/6276a8efbd5c76586e1c2833/reports/65a3516e-309f-43c8-b94a-fd1615493c9b/overview
Result
Verdict:
UNKNOWN
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/989535
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 622031 Sample: JCKCFSQXDZNKKJZTFXKSGP.ps1 Startdate: 07/05/2022 Architecture: WINDOWS Score: 48 10 Multi AV Scanner detection for submitted file 2->10 6 powershell.exe 1 2->6         started        process3 process4 8 conhost.exe 6->8         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/448d23c53cc9f4a1a97683474c4e2e7a45ac05570effebc9018924a2c3cc44dc/
Threat name:
Script-PowerShell.Trojan.EvilPower
Create hunting rule
Status:
Malicious
First seen:
2022-05-06 23:39:25 UTC
File Type:
Text (PowerShell)
AV detection:
3 of 41 (7.32%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
32c17b45985fbefcf67e054af34e00eb56c0577edfa13d03abb2b8d8e041a513
BitRAT
3cead87d0418ee97c2fbddf19c699c58203c40e524e76bb08f26dcce9eb6dfdf
BitRAT
414a79e6c87489cb73e9176e867d554788a28ba86cb4e00f3f8fed15400999bd
BitRAT
8dfe0003ce22bfa6f3123e30eb90e3d10e9ef16f7a206ffed6955846e0c11c06
BitRAT
a996ff95783d0e2bc97c3e95539de831788725c7b97514ff88041f041c6172c9
BitRAT
bdbc7e20f13cee3e9ff2e82c41bd6f8740fec1ade4a0686b50c6eafce574341c
BitRAT
ce30c428376eac3095f203ebe88f94a38737dc82f2ad018b2ae6c8569b389c5a
BitRAT
dcb73a0ea23548167bd5724418377fe1e8c88f1be3125c0df6cc89722bb26f33
BitRAT
eb2b24470ff5572e47f2e39e4557f35a01233c68ce9b9db6b5eada127108d6ad
BitRAT
+ 912 additional samples on MalwareBazaar
Result
Malware family:
bitrat
Create hunting rule
Score:
  10/10
Tags:
family:bitrat suricata trojan upx
Link:
https://tria.ge/reports/220507-vsjlwsfeeq/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
UPX packed file
BitRAT
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
Malware Config
C2 Extraction:
bitrat9300.duckdns.org:9300
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/448d23c53cc9/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/448d23c53cc9f4a1a97683474c4e2e7a45ac05570effebc9018924a2c3cc44dc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments