MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 645dbb6df97018fafb4285dc18ea374c721c86349cb75494c7d63d6a6afc27e6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BitRAT


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 645dbb6df97018fafb4285dc18ea374c721c86349cb75494c7d63d6a6afc27e6
SHA3-384 hash: 05212933599f613c1efa7062814b036a8ed4aea2fac5a94ab17063cfcf80d1a61d58bd96eb0b3234de2be86cbe923867
SHA1 hash: e9a007208d57a1645f6419be170eb976705a7c12
MD5 hash: 51d43d2127ed77d3067acd0e91c45dcc
humanhash: mars-jersey-earth-bakerloo
File name:645dbb6df97018fafb4285dc18ea374c721c86349cb75494c7d63d6a6afc27e6
Download: download sample
Signature BitRAT
Create hunting rule
File size:4'058'608 bytes
First seen:2021-03-12 14:08:59 UTC
Last seen:2021-11-10 10:18:19 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 9e063f4c3ed14a9c5d231fdeccac900c (1 x BitRAT)
ssdeep 98304:uyrSuQZ/PFqBuqLw1wKpR3srNW8/lfX2/KACiD7WI95XzHTrimWPuxy2F7zedxGZ:uym15wma/lfXkMPuxy+Cimx+
Threatray 12 similar samples on MalwareBazaar
TLSH 6D16DF11F6485866C5230E30FA49E37DB3BDA921CA3A41F71395AE1C6D32583F618DAF
Reporter JAMESWT_WT
Tags:51.195.57.232 BitRAT FoodLehto Oy signed

Code Signing Certificate

Organisation:FoodLehto Oy
Issuer:Sectigo RSA Code Signing CA
Algorithm:sha256WithRSAEncryption
Valid from:2021-02-26T00:00:00Z
Valid to:2022-02-26T23:59:59Z
Serial number: d9e834182dec62c654e775e809ac1d1b
MalwareBazaar Blocklist:This certificate is on the MalwareBazaar code signing certificate blocklist (CSCB)
Thumbprint Algorithm:SHA256
Thumbprint: 374e7e84e1280e8739cc113014a8561f18226202b5866e7132e916f22f4999f2
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
3
# of downloads :
161
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
645dbb6df97018fafb4285dc18ea374c721c86349cb75494c7d63d6a6afc27e6
Verdict:
Malicious activity
Analysis date:
2021-03-12 14:10:06 UTC
Tags:
trojan bitrat rat
Link:
https://app.any.run/tasks/f7e7a6a4-eb5b-4e6e-a0a3-5e0df80ef2d6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/123929/
Detection(s):
SecuriteInfo.com.Trojan.Inject4.8641.12480.9676.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Transferring files using the Background Intelligent Transfer Service (BITS)
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Moving a file to the %AppData% directory
Deleting a recently created file
Creating a file in the %temp% directory
Launching a process
Creating a window
DNS request
Setting a global event handler
Unauthorized injection to a system process
Setting a global event handler for the keyboard
Sending a TCP request to an infection source
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/637811
Signature
Antivirus detection for dropped file
Hides threads from debuggers
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Sigma detected: Suspicious Svchost Process
System process connects to network (likely due to code injection or exploit)
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/645dbb6df97018fafb4285dc18ea374c721c86349cb75494c7d63d6a6afc27e6/
Threat name:
Win32.Backdoor.ParallaxRat
Create hunting rule
Status:
Malicious
First seen:
2021-03-12 01:25:21 UTC
File Type:
PE (Exe)
Extracted files:
200
AV detection:
16 of 28 (57.14%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mro3w3pzoampv62cqxobr2rxjrzbzbruts3vjfgh2y6wu2x4e7ta._file
Verdict:
unknown
Similar samples:
4737b939774fa43ffaec93dcee6112b2c3372bcd9910ecd2969cb8dc75ef4857
BitRAT
49db3918a64a934e5fcfe8940f47af2927a9e67a79371fc7b5cc19d5ec5aeaf5
BitRAT
5346d8a0c2bba4d4f5f5c336958bc5ca5c797649df51a815bafcdc619bc07a9e
BitRAT
6a28f7fb457fb484c1fbcceb41b10637345b18950b62df89c0a7689dd4f20d68
BitRAT
7087214159114804bf5e751cee8004818f6d78d671c646ec0775fbc5b3954b10
BitRAT
8f22d0bc0ecaabfea46715aafcaae5db27c74dc564a47c66fd7ffdb53e18e0bf
BitRAT
a4cad2ac92b79ee5a3c0b19e182832b2a6e3fd2ea731e65571561b0b307768a1
BitRAT
b6fbcfc55f0124980a29986006323c37504b13e09e45d5c949c448f4f339ec56
BitRAT
c0054f47a3edfcc977871a0e19413b9596ea15be86a338568333044ff10e07df
BitRAT
e6e9b8fe2bb57d5dc22953b423d6340ef3adf9ebef4852a842c9c87e9d3fead7
BitRAT
+ 2 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
upx
Link:
https://tria.ge/reports/210312-4lwd6ed79j/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
UPX packed file
Unpacked files
SH256 hash:
645dbb6df97018fafb4285dc18ea374c721c86349cb75494c7d63d6a6afc27e6
MD5 hash:
51d43d2127ed77d3067acd0e91c45dcc
SHA1 hash:
e9a007208d57a1645f6419be170eb976705a7c12
Link:
https://www.unpac.me/results/c163779d-a302-4d5a-bf5e-a2c949fe3763/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
BitRat
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/645dbb6df97018fafb4285dc18ea374c721c86349cb75494c7d63d6a6afc27e6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/
Rule name:upx_packed
Create hunting rule
Description:UPX packed file

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
X
https://twitter.com/malwrhunterteam/status/1370375264455249920?s=20
Cape
Cape
https://www.capesandbox.com/analysis/123929/

Comments