MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 483919bfc0da6d92481d70ca620e1ee0aebb3d81931d88a894ac32328e8808e8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BitRAT


Vendor detections: 13


Intelligence 13 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 483919bfc0da6d92481d70ca620e1ee0aebb3d81931d88a894ac32328e8808e8
SHA3-384 hash: 9c0861388fec0eb64721388a36999a81295b905aae6b9c9f817e73208193d413c3b235a6e33aca9838950c005db24094
SHA1 hash: 8d8d72cb65bf3ae6d21c0d7f0db3d032dc2e96fe
MD5 hash: a50ba19fceada58af31034c9ee38062b
humanhash: delta-louisiana-april-thirteen
File name:SecuriteInfo.com.W32.Injector.ESFA.tr.9234.20511
Download: download sample
Signature BitRAT
Create hunting rule
File size:923'648 bytes
First seen:2022-10-31 00:16:21 UTC
Last seen:2022-10-31 01:04:41 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 5d256620035c1cc779508730b46ddb3d (1 x BitRAT)
ssdeep 12288:i9DB0XN+2zVPNZHHuixe/5Zh0SYWf1bjUGKgEbORhFBN8De3JFjcTWZmhj+wzhd:uDmwoHHuSe/5j0ifVU5u8DAo3YYh
Threatray 2'728 similar samples on MalwareBazaar
TLSH T1DE158B23B281C077C2333E3B5F4A5A64881BBB32293968B56FE55D4C6F7B2536474C92
TrID 28.1% (.EXE) Win32 Executable Delphi generic (14182/79/4)
25.9% (.SCR) Windows screen saver (13101/52/3)
20.8% (.EXE) Win64 Executable (generic) (10523/12/4)
8.9% (.EXE) Win32 Executable (generic) (4505/5/1)
4.1% (.EXE) Win16/32 Executable Delphi generic (2072/23)
File icon (PE):PE icon
dhash icon e896696969b4acac (2 x BitRAT)
Reporter SecuriteInfoCom
Tags:BitRAT exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
255
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
bitrat
Create hunting rule
ID:
1
File name:
SecuriteInfo.com.W32.Injector.ESFA.tr.9234.20511
Verdict:
Malicious activity
Analysis date:
2022-10-31 00:19:04 UTC
Tags:
trojan bitrat rat
Link:
https://app.any.run/tasks/8efa4dbe-b80f-446e-a374-1b58a3e5cd72

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/326222/
Detection(s):
SecuriteInfo.com.W32.Injector.ESFA.tr.9234.20511.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Creating a window
DNS request
Sending a custom TCP request
Creating a file
Launching a process
Creating a process with a hidden window
Setting a global event handler
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Setting a global event handler for the keyboard
Unauthorized injection to a system process
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/46896/overview
Behaviour
MalwareBazaar
CheckScreenResolution
CheckCmdLine
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
keylogger
Link:
https://www.filescan.io/uploads/635f13ff58409ff7bc0c5495/reports/c5e87942-f6da-45a6-b522-9f9511b21252/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/23b6c785-b7c7-4f1c-90f5-63d04e4855ed
Result
Threat name:
BitRAT, DBatLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1101379
Signature
Allocates memory in foreign processes
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Creates a thread in another existing process (thread injection)
Hides threads from debuggers
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Writes to foreign memory regions
Yara detected BitRAT
Yara detected DBatLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 734040 Sample: SecuriteInfo.com.W32.Inject... Startdate: 31/10/2022 Architecture: WINDOWS Score: 100 24 davidmanne.casacam.net 2->24 42 Multi AV Scanner detection for domain / URL 2->42 44 Malicious sample detected (through community Yara rule) 2->44 46 Antivirus detection for URL or domain 2->46 48 4 other signatures 2->48 7 Wlfnebsl.exe 15 2->7         started        11 SecuriteInfo.com.W32.Injector.ESFA.tr.9234.20511.exe 1 18 2->11         started        signatures3 process4 dnsIp5 26 sn-files.fe.1drv.com 7->26 28 onedrive.live.com 7->28 30 lexaya.sn.files.1drv.com 7->30 50 Multi AV Scanner detection for dropped file 7->50 52 Writes to foreign memory regions 7->52 54 Allocates memory in foreign processes 7->54 14 wscript.exe 7->14         started        32 sn-files.fe.1drv.com 11->32 34 onedrive.live.com 11->34 36 lexaya.sn.files.1drv.com 11->36 20 C:\Users\Public\Libraries\Wlfnebsl.exe, PE32 11->20 dropped 22 C:\Users\...\Wlfnebsl.exe:Zone.Identifier, ASCII 11->22 dropped 56 Creates a thread in another existing process (thread injection) 11->56 58 Injects a PE file into a foreign processes 11->58 18 colorcpl.exe 3 2 11->18         started        file6 signatures7 process8 dnsIp9 60 System process connects to network (likely due to code injection or exploit) 14->60 62 Hides threads from debuggers 14->62 38 davidmanne.casacam.net 20.12.20.153, 2223, 49703, 49704 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 18->38 40 192.168.2.1 unknown unknown 18->40 signatures10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/483919bfc0da6d92481d70ca620e1ee0aebb3d81931d88a894ac32328e8808e8/
Threat name:
Win32.Spyware.Solmyr
Create hunting rule
Status:
Malicious
First seen:
2022-10-30 21:59:47 UTC
File Type:
PE (Exe)
Extracted files:
25
AV detection:
14 of 26 (53.85%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ja4rtp6a3jwzesa5odfgedq64cxlwpmbsmoyrkeuvqzdfduibdua._file
Verdict:
malicious
Similar samples:
1a28af1d858e4d8650c914eb319c09d28a50c262ce42d236737f3d38a617c99c
BitRAT
1f58e0127c25c0a356436a3c78bcf05de2afacff0cba41275972d25a4be0bbfd
BitRAT
455043f1dd7882239a50cca55df4fbdf5cc5e04e305c7052346fc38c2aad015e
BitRAT
5b1f1843bbb992e3d5c635aa69d8409de4ae4d3f04cf19994d8e953e99cf451a
BitRAT
9b60c965a1425ff01954ce6a917cb4486d5af5cb36f538233139042ea324a64e
BitRAT
ab9041fe7e0a4a439521d6eb01cc16d74c00a0427c86b067120ac453ba7329d9
BitRAT
d40b7d79822917e150fd3975a74e643c736bf55fb7173df40494f8afab138da0
BitRAT
dd90203d2caab14ccfb48f6fbb2c15b956b07c72395b671e06b68049c90ceb25
BitRAT
eb77240415767631cd46725bf985bd034d5b005a939ea60785ebe2e45aa5541a
BitRAT
f09dc0b3275b4c1e3a616911805011c2871af1407599493dc980b6987cb313eb
BitRAT
+ 2'718 additional samples on MalwareBazaar
Result
Malware family:
modiloader
Create hunting rule
Score:
  10/10
Tags:
family:bitrat family:modiloader persistence trojan upx
Link:
https://tria.ge/reports/221031-ak2ghsgag6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Adds Run key to start application
UPX packed file
ModiLoader Second Stage
BitRAT
ModiLoader, DBatLoader
Malware Config
C2 Extraction:
davidmanne.casacam.net:2223
Unpacked files
SH256 hash:
3f17ebba5a2529b8794c6e86f2b124eacc332692ccdb8acfc6ebf8829c5889e7
MD5 hash:
990016aba0656d25f84a329e5a48c50b
SHA1 hash:
f13ea53aaa58d65bd696da99836dd5473f290536
Detections:
win_dbatloader_g1
Create hunting rule
Link:
https://www.unpac.me/results/5d804d88-0307-4d28-a47b-48218819ec31/
Parent samples :
de8962c07eba5fdd819df024cf7a88ccbec0084913e782182dc0392338f0243e
a35981f164ad40d52d9c1f665d0cd9506abcefec984fd00ec21a7a83aeb25024
483919bfc0da6d92481d70ca620e1ee0aebb3d81931d88a894ac32328e8808e8
cafb7d353313362efa3d09e9a4345c681bba522185870ceb930216d54ffe00c8
25d182f0fae63df346da5dd500309607c39325a90aca36121e9d928e4c445b76
3a61c9b0b4096cef95698ca41594941955d36e857c7b42f8d84962272f850115
4cf4313d499e9400a60a0961344e6df29acc85e6d62e18c118bef1493f801e53
f36b68e818ef0e90919221028f143fe314f463f418f550c707e1ca5fc632ad9c
f90adf7f130b1deacd0b940e101f471efeb9c670e848cd2a7e77152db0455298
580f58b0bcc5fdd1b9e1237ec9d6a58b3de0f532d92b0ef49314bcc05442272a
0d5a138754a0bcb2bf5557f158c342e8f7e32a509a3d93775e5aeb59d5d4e0d0
6d22199bcb9c6a15a14e129c4c30ad4aa19148a9b1aac32531d1dfa19a40f671
2bfbbbf3105253503802f18a048d3b36954efeb97ecb9ab9556dffa98bfb832a
e9ca640bda7dd97f7d0c9d1b810a7704144cfba14ec0271ead9e8dd6636c89d0
3f2a62eed0aff1007bac6177aed82a1722bb6b63b1d49fa87153199cd8e8d5f1
b5b7bca8e148356c32d008301fc0209f003ac123c0d752e685f87a66e81ac64b
b812dd30a73b638b960af5ef21e2e3dcf807728b381a8f71553e0a32d2307b92
da7ce792ea58fe4b0920be78435d44fef2ef1025cfac8abb0b43a9878d26c6c3
97672b7a0e6ab5bdc206aecdc117fd9ec7529db666f9c30764fa0d4e31fa48bb
3f5d2ca933f5c7cea6f55f14ebfd7d9f703ef2d9ba54ed8212aeda2d893c875b
e56fd483ef8e5da7ce843288c45d4af517bf868c18ddeba08da40814b8b0a60e
754025dc4effece12c7c7b3041d2f22050b442251ef1f25dc425f685a277e0e6
1d160af25e96ec1d33d50216a3eafdc16a1df90a6c62929e25f626dae138015b
f6ddc63173d134db79db880c7f5b338987f31ddd36cfcb27cf15e3bb08a507bb
6ffcc5061fbafa5eeee756b0292d6ec83109623b786b8e2f5ca5ecbd92a816c0
63419dd22896ba6ddb1710fd35ae0b64506c8a80c62b59ba33979d375737c2ca
22655d19fee46d3578c4425d75f5633cb06b353b7383a300962d46289b6ba24d
7a9c39d98ace102b6fa94aafaa6bd652b17b247da09bee12e84fca6302b08e19
bec4ef3573fb041d4a688c353f4682186f2bfe3918e9add4b9c5ceda5ec2627c
0aa8a9d5f174dc2d70924c909f6f1f1336152de536a729931a1acfa2500fb2f5
SH256 hash:
483919bfc0da6d92481d70ca620e1ee0aebb3d81931d88a894ac32328e8808e8
MD5 hash:
a50ba19fceada58af31034c9ee38062b
SHA1 hash:
8d8d72cb65bf3ae6d21c0d7f0db3d032dc2e96fe
Detections:
DbatLoaderStage1
Create hunting rule
Link:
https://www.unpac.me/results/5d804d88-0307-4d28-a47b-48218819ec31/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/483919bfc0da/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/483919bfc0da6d92481d70ca620e1ee0aebb3d81931d88a894ac32328e8808e8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/326222/

Comments