MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 53592d15fc275a7c603b2c80baf9ca7d3e2f7eebe82ba8eca971ff1c005ab353. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BitRAT


Vendor detections: 10


Intelligence 10 IOCs 1 YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 53592d15fc275a7c603b2c80baf9ca7d3e2f7eebe82ba8eca971ff1c005ab353
SHA3-384 hash: 24b195622c328bfbee79628e3ffbc11901bf4543fdd5721b3be3a87a113cbe120ce2c16af8f1246fb78a3c370312296c
SHA1 hash: b019a0ebb207381823ceb49e7c19686c17921c89
MD5 hash: 62d29f32902ddcf6ebdbbb97a5001266
humanhash: south-alaska-alaska-maine
File name:62D29F32902DDCF6EBDBBB97A5001266.exe
Download: download sample
Signature BitRAT
Create hunting rule
File size:2'209'280 bytes
First seen:2021-06-23 12:06:22 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'653 x AgentTesla, 19'464 x Formbook, 12'205 x SnakeKeylogger)
ssdeep 49152:5jHSVSk8kdzQlzp63Ql8LUdaTZH6frsUC31WrV/oerXSnxnCqHyg:F6Sk8kdzot6kcU0TZaTsUR5oerXSxPH
Threatray 229 similar samples on MalwareBazaar
TLSH 6BA5223B7256C92DD773C63C1211EA09AD238E072AF6964C0380B3FD5E7162176B5F9A
Reporter abuse_ch
Tags:BitRAT exe RAT


Avatar
abuse_ch
BitRAT C2:
195.133.40.220:6992

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
195.133.40.220:6992 https://threatfox.abuse.ch/ioc/149941/

Intelligence

File Origin
# of uploads :
1
# of downloads :
126
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
62D29F32902DDCF6EBDBBB97A5001266.exe
Verdict:
Malicious activity
Analysis date:
2021-06-23 12:11:22 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/a7299801-4a66-4a07-b3d1-79d858629ee4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
BitRAT
Create hunting rule
Link:
https://www.capesandbox.com/analysis/167800/
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/bd13de15-3840-4240-ae2f-0960c37ee9bd
Result
Threat name:
BitRAT Xmrig
Create hunting rule
Detection:
malicious
Classification:
troj.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/806547
Signature
Contains functionality to hide a thread from the debugger
Contains functionality to inject code into remote processes
Creates files in alternative data streams (ADS)
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes to foreign memory regions
Yara detected BitRAT
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/53592d15fc275a7c603b2c80baf9ca7d3e2f7eebe82ba8eca971ff1c005ab353/
Threat name:
ByteCode-MSIL.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2021-06-21 15:45:31 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=knms2fp4e5nhyyb3fsalv6okpu7c67xl5av2r3fjoh7ryac2wnjq._file
Verdict:
malicious
Similar samples:
4cf44d352a41e3125ec55db9e83843e57a8a4345781fb7a4a8535935b0b87906
BitRAT
6110c332c287a7ac7fadde14aa3b69190a415e11f664f6746b461b589e0276cd
BitRAT
6387b0ded51410f864b093626cfa7e711c8885d6870996f8138de12ced45730c
BitRAT
6cd85d78caec047483007ee54b8f4cea13d29c648b7f4bd500ce199f360f1518
BitRAT
8f09e478721eecc723aa346c56541183c78bcaa6b97f08b8d33b84022881178a
BitRAT
c0c746d73e4b8e18f1dd69906d6a260bab00f57cb8532855db0f09c668fb3d8b
BitRAT
cee8aa44f63039722053db96209cf1dcfb15634bdb46c8cc3098e58407c0e4ce
BitRAT
d5b80d52df526be1a519fa5962702503f22eb24417e65041e91be881f73b36ff
BitRAT
dfeaef515d92681d5d23ace741b56e14ec71b9042427874c15ef2db030c47b95
BitRAT
e5aea3844b9f8f3811b6c3e3ff58e84793806b58da0064743235b7c6e476e624
BitRAT
+ 219 additional samples on MalwareBazaar
Result
Malware family:
bitrat
Create hunting rule
Score:
  10/10
Tags:
family:bitrat persistence trojan
Link:
https://tria.ge/reports/210623-9hva133s62/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
BitRAT
BitRAT Payload
Unpacked files
SH256 hash:
cfdecc6384cdf3b4e4a6825151e7c247647ab8669a992b37626fa41fdd1c0560
MD5 hash:
d6c43ec67fb69d6c2cd7ed706114ac0f
SHA1 hash:
c26094f153f7ef0ed7485e4d4cfc79a78a0dc578
Link:
https://www.unpac.me/results/40f654cc-4276-4de3-9ff8-54a7a939e43c/
SH256 hash:
6d54b1bd357ad0a3ba8e1095f45c77934e5bafe5897e6c0d7c49e0f0f993f0d1
MD5 hash:
9dc3164badb4caf77a52ba370db5cd6c
SHA1 hash:
b26750557cc1efe3ec987b4b6189f79bd92b3444
Link:
https://www.unpac.me/results/40f654cc-4276-4de3-9ff8-54a7a939e43c/
SH256 hash:
5bbfa609209d0711f19b926b5d5aa81b51dbfdc303936e0b81c6fda20e16e6c6
MD5 hash:
dd3dbba8f640dc7ee64a72341e38ee4b
SHA1 hash:
2a5e611353523475f3b8f96e0ee31855ffe1f729
Link:
https://www.unpac.me/results/40f654cc-4276-4de3-9ff8-54a7a939e43c/
SH256 hash:
8e71a33af516f6b6588793e87e2a8c97d642cb84c3933d3100edae636bbff96a
MD5 hash:
a7d4ca86b29ab9c8f2c8f20ea2233ff2
SHA1 hash:
13c73b5cec0fab9719eaa107938637feb7adb49f
Link:
https://www.unpac.me/results/40f654cc-4276-4de3-9ff8-54a7a939e43c/
SH256 hash:
53592d15fc275a7c603b2c80baf9ca7d3e2f7eebe82ba8eca971ff1c005ab353
MD5 hash:
62d29f32902ddcf6ebdbbb97a5001266
SHA1 hash:
b019a0ebb207381823ceb49e7c19686c17921c89
Link:
https://www.unpac.me/results/40f654cc-4276-4de3-9ff8-54a7a939e43c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/53592d15fc275a7c603b2c80baf9ca7d3e2f7eebe82ba8eca971ff1c005ab353

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with SmartAssembly
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/167800/

Comments