MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 482fcdb4d60ba6efdfedec28d5a9f6b026fb21cec672d1a9adfdcc20d9542e9d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
BitRAT
Vendor detections: 10
| SHA256 hash: | 482fcdb4d60ba6efdfedec28d5a9f6b026fb21cec672d1a9adfdcc20d9542e9d |
|---|---|
| SHA3-384 hash: | 84c66cfdce1833f994d62c12d19b2f3698594b02c67fe98d23dbd520fc625228a09e6c54b9d4be8e4b2a2932a8e69942 |
| SHA1 hash: | 41a3b0f4814239903fe1b895bb796f4001e21b4b |
| MD5 hash: | 35b7f76a7ed775b9b0f851bdc10e75a7 |
| humanhash: | mike-social-zebra-mango |
| File name: | 35b7f76a7ed775b9b0f851bdc10e75a7.exe |
| Download: | download sample |
| Signature | BitRAT |
| File size: | 2'321'920 bytes |
| First seen: | 2021-11-20 09:51:21 UTC |
| Last seen: | 2021-11-20 12:16:08 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'609 x Formbook, 12'242 x SnakeKeylogger) |
| ssdeep | 49152:pJxKAR8yCW9pyJIuEVF7kLgRBG6IiZKOMZjxmexKndAV:53hpWEVFhBG61KPKndA |
| Threatray | 1'156 similar samples on MalwareBazaar |
| TLSH | T141B5335413E14C87EED75AB82BB1A201D7BD90B709C9E3DE0A86917AE88F3151F5C327 |
| Reporter |  abuse_ch |
| Tags: | BitRAT exe RAT |
Intelligence
File Origin
# of uploads :
2
# of downloads :
219
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
35b7f76a7ed775b9b0f851bdc10e75a7.exe
Verdict:
Malicious activity
Analysis date:
2021-11-20 09:59:57 UTC
Tags:
trojan bitrat rat
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Gathering data
Result
Verdict:
Malware
Maliciousness:
Behaviour
Сreating synchronization primitives
Launching a process
Creating a process with a hidden window
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Launching a service
Creating a file
DNS request
Sending an HTTP GET request
Using the Windows Management Instrumentation requests
Adding exclusions to Windows Defender
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
packed
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Result
Threat name:
Unknown
Detection:
malicious
Classification:
expl.evad
Score:
84 / 100
Signature
.NET source code contains very large array initializations
Adds a directory exclusion to Windows Defender
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Sigma detected: Powershell Defender Exclusion
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM3
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Packed.Generic
Status:
Suspicious
First seen:
2021-11-20 03:30:08 UTC
AV detection:
17 of 28 (60.71%)
Threat level:
1/5
Detection(s):
Malicious file
Verdict:
malicious
Similar samples:
+ 1'146 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
10/10
Tags:
evasion trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Loads dropped DLL
Windows security modification
Executes dropped EXE
Nirsoft
Windows security bypass
Unpacked files
SH256 hash:
7ea7a332e341494d57881a72d86958da111f6642acb6d10e84454157a5c86593
MD5 hash:
3fc457d33c537182264da2623459b27a
SHA1 hash:
d5fb45e42c40c4ca9f9d809bf960e5b0b7eab666
SH256 hash:
c2ac2648ea11c79ca7974112af7d1ddacd284eeae38b2e251cd5d66ac5e2a8a7
MD5 hash:
d9380e4a91f0908c2c32677904f259ba
SHA1 hash:
bcaa17625436ff4f3c161653e82b1cfd5cdded1e
SH256 hash:
a13f62587c83eaef5bb421567cae5f91de0bef9082ee05b0341a2eeda24e6643
MD5 hash:
c253e1ae926c8d5cd4ec1f42d82dbba7
SHA1 hash:
b31a25ce6a17bd13ba754e7a834313811ba90599
SH256 hash:
3da80bd8e18bf2ef5e28f5e2e0d2095b0d4e65391800ce18f9a18859d7beb220
MD5 hash:
5dbed7594d4c8d71c1882692e6776bf0
SHA1 hash:
8552a2f2afca501945fe57c1875970b6f777f709
SH256 hash:
8063623fd33585184e865ac1f8685446c819841d212bc6c848f8dc4a137960be
MD5 hash:
4abff34e351e4e95514aecb515e8aea3
SHA1 hash:
742702e8c78e7cf19f19e56a6cdb2d1811759710
SH256 hash:
482fcdb4d60ba6efdfedec28d5a9f6b026fb21cec672d1a9adfdcc20d9542e9d
MD5 hash:
35b7f76a7ed775b9b0f851bdc10e75a7
SHA1 hash:
41a3b0f4814239903fe1b895bb796f4001e21b4b
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | BitcoinAddress |
|---|---|
| Author: | Didier Stevens (@DidierStevens) |
| Description: | Contains a valid Bitcoin address |
| Rule name: | INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture |
|---|---|
| Author: | ditekSHen |
| Description: | Detect executables with stomped PE compilation timestamp that is greater than local current time |
| Rule name: | MALWARE_Win_BitRAT |
|---|---|
| Author: | ditekSHen |
| Description: | Detects BitRAT RAT |
| Rule name: | pe_imphash |
|---|
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.