MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 5dfd85a1c9a3b450d9aa14d3ea0a6bac9db88623004e5e6d7b40e7ab3b17cd31. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
BitRAT
Vendor detections: 8
| SHA256 hash: | 5dfd85a1c9a3b450d9aa14d3ea0a6bac9db88623004e5e6d7b40e7ab3b17cd31 |
|---|---|
| SHA3-384 hash: | e8611935068ed782a728bc7adbd985436e9b666b67e5af7453bb938c0d19b260fcd9e7f3611a63760d7a7d737c59cd75 |
| SHA1 hash: | ec2e05df0be36afb123ab9eade59d3dab7b0cf65 |
| MD5 hash: | cab3923d1f82f381b9421b45dc0f89e5 |
| humanhash: | artist-moon-yellow-oregon |
| File name: | 5dfd85a1c9a3b450d9aa14d3ea0a6bac9db88623004e5e6d7b40e7ab3b17cd31 |
| Download: | download sample |
| Signature | BitRAT |
| File size: | 3'607'552 bytes |
| First seen: | 2021-02-28 07:26:35 UTC |
| Last seen: | 2021-02-28 08:59:47 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger) |
| ssdeep | 98304:2Gh+ArPDYIurK3xh/d8fvFhq+bRVqJlnJlt8opA/A6s:v1rPMisfvPKDBgA |
| Threatray | 104 similar samples on MalwareBazaar |
| TLSH | 77F51278219F605EC433BEA22BD4699FE79177126B0F782F208052975E62D43DFC1A39 |
| Reporter |  JAMESWT_WT |
| Tags: | BitRAT |
Intelligence
File Origin
# of uploads :
2
# of downloads :
802
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
factura.doc
Verdict:
Malicious activity
Analysis date:
2021-02-27 05:58:54 UTC
Tags:
exploit CVE-2017-11882
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Sending a custom TCP request
Creating a window
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
BitRAT Xmrig
Detection:
malicious
Classification:
troj.evad.mine
Score:
100 / 100
Signature
.NET source code contains very large strings
Contains functionality to hide a thread from the debugger
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected BitRAT
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Backdoor.NanoBot
Status:
Malicious
First seen:
2021-02-27 07:45:18 UTC
AV detection:
13 of 28 (46.43%)
Threat level:
5/5
Verdict:
malicious
Similar samples:
+ 94 additional samples on MalwareBazaar
Unpacked files
SH256 hash:
910b2a212928a24aa136805bb3a6519b1509d6851e93a14ff101ffb30dbd61c4
MD5 hash:
783049e2b2dd0f9a3c35a0cf50114112
SHA1 hash:
4543993b53037f9d188cede41eda976847aac961
SH256 hash:
f8b5b51efedb3e87493ac2439473564603cc3059d57956f209a7310e311a1027
MD5 hash:
d66f89bf838fb52ed59d311a99aea214
SHA1 hash:
342525c4aabbb92abf51459081d34ed0f1cdc965
SH256 hash:
5dfd85a1c9a3b450d9aa14d3ea0a6bac9db88623004e5e6d7b40e7ab3b17cd31
MD5 hash:
cab3923d1f82f381b9421b45dc0f89e5
SHA1 hash:
ec2e05df0be36afb123ab9eade59d3dab7b0cf65
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.