MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5d932142aa0df04570cea8bba6291c058438d41004554f058ea7d866b306617b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

BitRAT

Vendor detections: 10

Intelligence 10 IOCs 1 YARA 2 File information Comments 1

SHA256 hash:	5d932142aa0df04570cea8bba6291c058438d41004554f058ea7d866b306617b
SHA3-384 hash:	023ac65b42f639d1bd9421f1c192953bb5dafbaf71defc66d0531bee156ddefad47bcb06c50815b95dd2985cd9275a4c
SHA1 hash:	827a812ac1047593ba7f6faebb2596c8f90c3b92
MD5 hash:	c382203a6097153580124f8863b09b8b
humanhash:	salami-eight-india-east
File name:	C382203A6097153580124F8863B09B8B.exe
Download:	download sample
Signature	BitRAT Create hunting rule
File size:	3'941'888 bytes
First seen:	2021-05-04 06:40:33 UTC
Last seen:	2021-05-04 07:01:16 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	71955ccbbcbb24efa9f89785e7cce225 (57 x BitRAT)
ssdeep	49152:ZXUIEeZzdeh/c7p1rNdd+JNEj0ykdj21x1YhFlX4bA/Hg/11VzeLG/7wqNKB2VI0:ZXrEeZzdhjuV/gd1VzsGUqNKTHvQeI
Threatray	164 similar samples on MalwareBazaar
TLSH	8D06CF02FA41C562E2670230E9AE77BA053CF5344B2085C3B7946A385AB56D17B3BF77
Reporter	abuse_ch
Tags:	BitRAT exe

abuse_ch

Sazoora C2:
72.11.137.166:55050

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
72.11.137.166:55050	https://threatfox.abuse.ch/ioc/28638/

Intelligence

File Origin

# of uploads :

# of downloads :

115

Origin country :

n/a

Vendor Threat Intelligence

Detection:

BitRAT

Link:

https://www.capesandbox.com/analysis/149717/

Detection(s):

Win.Malware.Mikey-9819889-0

ditekSHen.MALWARE.Win.Trojan.BitRAT.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Setting a global event handler

Connection attempt

Sending a UDP request

Replacing executable files

Moving of the original file

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Setting a global event handler for the keyboard

Deleting of the original file

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

BitRAT Xmrig

Detection:

malicious

Classification:

troj.evad.mine

Score:

84 / 100

Link:

https://www.joesandbox.com/analysis/709361

Signature

Contains functionality to hide a thread from the debugger

Contains functionality to inject code into remote processes

Creates files in alternative data streams (ADS)

Hides threads from debuggers

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Yara detected BitRAT

Yara detected Xmrig cryptocurrency miner

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5d932142aa0df04570cea8bba6291c058438d41004554f058ea7d866b306617b/

Threat name:

Win32.Backdoor.ParalaxRat

Status:

Malicious

First seen:

2021-05-01 08:34:27 UTC

AV detection:

24 of 29 (82.76%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=lwjscqvkbxyek4govc52mki4awcdrvaqarku6bmou7mgnmygmf5q._file

Verdict:

malicious

Result

Malware family:

bitrat

Score:

10/10

Tags:

family:bitrat persistence trojan

Link:

https://tria.ge/reports/210504-v7e5bflsye/

Behaviour

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of NtSetInformationThreadHideFromDebugger

Adds Run key to start application

BitRAT

BitRAT Payload

Unpacked files

SH256 hash:

5d932142aa0df04570cea8bba6291c058438d41004554f058ea7d866b306617b

MD5 hash:

c382203a6097153580124f8863b09b8b

SHA1 hash:

827a812ac1047593ba7f6faebb2596c8f90c3b92

Link:

https://www.unpac.me/results/ebadb431-3f8f-458e-a7eb-701495e5322d/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/5d932142aa0df04570cea8bba6291c058438d41004554f058ea7d866b306617b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Email_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Email in files like avemaria

Rule name:	MALWARE_Win_BitRAT Create hunting rule
Author:	ditekSHen
Description:	Detects BitRAT RAT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/149717/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-05-04 07:15:22 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [B0001.025] Anti-Behavioral Analysis::Software Breakpoints
1) [B0009] Anti-Behavioral Analysis::Virtual Machine Detection
2) [B0012.001] Anti-Static Analysis::Argument Obfuscation
3) [F0002.002] Collection::Polling
4) [B0030.002] Command and Control::Receive Data
5) [B0030.001] Command and Control::Send Data
6) [C0011.001] Communication Micro-objective::Resolve::DNS Communication
7) [C0002.012] Communication Micro-objective::Create Request::HTTP Communication
8) [C0002.006] Communication Micro-objective::Download URL::HTTP Communication
9) [C0002.017] Communication Micro-objective::Get Response::HTTP Communication
10) [C0002.004] Communication Micro-objective::Open URL::HTTP Communication
11) [C0002.014] Communication Micro-objective::Read Header::HTTP Communication
12) [C0003.001] Communication Micro-objective::Create Pipe::Interprocess Communication
13) [C0003.003] Communication Micro-objective::Read Pipe::Interprocess Communication
14) [C0001.012] Communication Micro-objective::Get Socket Status::Socket Communication
15) [C0001.009] Communication Micro-objective::Initialize Winsock Library::Socket Communication
16) [C0001.006] Communication Micro-objective::Receive Data::Socket Communication
17) [C0001.007] Communication Micro-objective::Send Data::Socket Communication
18) [C0001.001] Communication Micro-objective::Set Socket Config::Socket Communication
19) [C0059] Cryptography Micro-objective::Crypto Library
20) [C0029.002] Cryptography Micro-objective::SHA1::Cryptographic Hash
21) [C0029.004] Cryptography Micro-objective::SHA224::Cryptographic Hash
22) [C0029.003] Cryptography Micro-objective::SHA256::Cryptographic Hash
23) [C0029] Cryptography Micro-objective::Cryptographic Hash
24) [C0031] Cryptography Micro-objective::Decrypt Data
25) [C0027.003] Cryptography Micro-objective::Camellia::Encrypt Data
26) [C0027.009] Cryptography Micro-objective::RC4::Encrypt Data
27) [C0027] Cryptography Micro-objective::Encrypt Data
28) [C0021.004] Cryptography Micro-objective::RC4 PRGA::Generate Pseudo-random Sequence
29) [C0021.003] Cryptography Micro-objective::Use API::Generate Pseudo-random Sequence
30) [C0021] Cryptography Micro-objective::Generate Pseudo-random Sequence
31) [C0019] Data Micro-objective::Check String
32) [C0032.005] Data Micro-objective::Adler::Checksum
33) [C0032.001] Data Micro-objective::CRC32::Checksum
34) [C0032.002] Data Micro-objective::Luhn::Checksum
35) [C0026.001] Data Micro-objective::Base64::Encode Data
36) [C0026.002] Data Micro-objective::XOR::Encode Data
37) [C0030.005] Data Micro-objective::FNV::Non-Cryptographic Hash
41) [C0045] File System Micro-objective::Copy File
42) [C0046] File System Micro-objective::Create Directory
43) [C0048] File System Micro-objective::Delete Directory
44) [C0047] File System Micro-objective::Delete File
45) [C0049] File System Micro-objective::Get File Attributes
46) [C0051] File System Micro-objective::Read File
47) [C0050] File System Micro-objective::Set File Attributes
48) [C0052] File System Micro-objective::Writes File
49) [E1510] Impact::Clipboard Modification
50) [C0007] Memory Micro-objective::Allocate Memory
51) [C0034.001] Operating System Micro-objective::Set Variable::Environment Variable
52) [C0036.004] Operating System Micro-objective::Create Registry Key::Registry
53) [C0036.002] Operating System Micro-objective::Delete Registry Key::Registry
54) [C0036.007] Operating System Micro-objective::Delete Registry Value::Registry
55) [C0036.003] Operating System Micro-objective::Open Registry Key::Registry
56) [C0036.005] Operating System Micro-objective::Query Registry Key::Registry
57) [C0036.006] Operating System Micro-objective::Query Registry Value::Registry
58) [C0036.001] Operating System Micro-objective::Set Registry Key::Registry
59) [C0040] Process Micro-objective::Allocate Thread Local Storage
60) [C0017.003] Process Micro-objective::Create Suspended Process::Create Process
61) [C0017] Process Micro-objective::Create Process
62) [C0038] Process Micro-objective::Create Thread
63) [C0054] Process Micro-objective::Resume Thread
64) [C0041] Process Micro-objective::Set Thread Local Storage Value
65) [C0055] Process Micro-objective::Suspend Thread
66) [C0018] Process Micro-objective::Terminate Process
67) [C0039] Process Micro-objective::Terminate Thread