MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 68087284713cf5b3080650a0f37fa67db5eff1b18c7cac032e0fa0c19752c118. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BitRAT


Vendor detections: 7


Intelligence 7 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 68087284713cf5b3080650a0f37fa67db5eff1b18c7cac032e0fa0c19752c118
SHA3-384 hash: 5ea83f332f58d2c9c49240cf426172dfadcf1bbce715c54c7cf0db6f31e2335e0acbc632e4b05de8e9f63c114f80e580
SHA1 hash: 2c50396d954b69b9060798c0da3adbf48a169bdf
MD5 hash: 7d939ae6a2f2906fe21e90c3307d2be9
humanhash: nitrogen-oven-finch-helium
File name:Dokument.exe
Download: download sample
Signature BitRAT
Create hunting rule
File size:2'457'088 bytes
First seen:2021-02-22 12:54:59 UTC
Last seen:2021-02-22 15:00:01 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 49152:oEpF63vDG5RX0yIXP6GWSCcwhxWqpitZKSS2zzICv:rivDGHePFCzvWH3KSS4I
Threatray 99 similar samples on MalwareBazaar
TLSH 75B5D01532016F2DF03DC33A69AC2A1997F8A907D391DF2BBDF510EB5A61F21832651E
Reporter abuse_ch
Tags:BitRAT DEU exe geo RAT


Avatar
abuse_ch
Malspam distributing BitRAT:

HELO: 107-174-142-107-host.colocrossing.com
Sending IP: 107.174.142.107
From: reichelt@xtr-global.de
Subject: Unterschrift erforderlich
Attachment: Dokument.img (contains "Dokument.exe")

BitRAT C2:
venomrating.hopto.org:4712 (198.102.14.18)

Intelligence

File Origin
# of uploads :
2
# of downloads :
141
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/118312/
Detection(s):
SecuriteInfo.com.Win32.Outbreak.19747.24325.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/614086
Signature
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
Sigma detected: Scheduled temp file as task from temp location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 356050 Sample: Dokument.exe Startdate: 22/02/2021 Architecture: WINDOWS Score: 76 31 venomrating.hopto.org 2->31 37 Sigma detected: Scheduled temp file as task from temp location 2->37 39 Yara detected AntiVM_3 2->39 41 Machine Learning detection for sample 2->41 43 3 other signatures 2->43 8 Dokument.exe 7 2->8         started        signatures3 process4 file5 23 C:\Users\user\AppData\Roaming\kWfxhw.exe, PE32 8->23 dropped 25 C:\Users\user\...\kWfxhw.exe:Zone.Identifier, ASCII 8->25 dropped 27 C:\Users\user\AppData\Local\...\tmpCB72.tmp, XML 8->27 dropped 29 C:\Users\user\AppData\...\Dokument.exe.log, ASCII 8->29 dropped 11 RegSvcs.exe 1 8->11         started        15 schtasks.exe 1 8->15         started        17 RegSvcs.exe 8->17         started        19 RegSvcs.exe 8->19         started        process6 dnsIp7 33 venomrating.hopto.org 198.102.14.18, 4712 KVCNET-2009US United States 11->33 35 192.168.2.1 unknown unknown 11->35 45 Hides threads from debuggers 11->45 21 conhost.exe 15->21         started        signatures8 process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/68087284713cf5b3080650a0f37fa67db5eff1b18c7cac032e0fa0c19752c118/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-22 12:55:08 UTC
AV detection:
16 of 28 (57.14%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=naehfbdrht23gcagkcqpg75gpw2674nrrr6kyazob6qmdf2syema._file
Verdict:
malicious
Similar samples:
16d2779eb519c6c58ac8e4b95595737f9f71f37bf214d6220036abf0fe7908b6
BitRAT
360dc7aa2889b1ed05b553eccab73348de2fae89cd7742e64422712298b670ca
BitRAT
533aa4375a4eac85feb6d0ab962c38a68775ed412d056ed12535605fd5c1f415
BitRAT
6c212901b861bddfecd68559ceecc3a35898d965b4e56aeb67febbfa65dc9d52
BitRAT
6c2a2251861a6d2701814843fadac940cf4d34db9f446f0698352fd866b31739
BitRAT
7277f1d3ddf844d18b2b0f95b620c8617736ad6703234fee2cb46299590180fe
BitRAT
79e6d1b262a31a2619284f38b059e266d0fa27109c9b1f4fc9100aa6bb619e05
BitRAT
a52ed9486d2ccdf0a9e29fe70ea7df8ddcb8bc06f9329664a310ae32d1308d6f
BitRAT
aa79d46aa459af0d46da380af6481f51369da4c4080a009028e83857dcd844f2
BitRAT
db7619d7304cbb9c7ad4bf8c74836f241aecac1fda067f3ffadadf7ee6d44930
BitRAT
+ 89 additional samples on MalwareBazaar
Result
Malware family:
xenarmor
Create hunting rule
Score:
  10/10
Tags:
family:xenarmor password recovery spyware upx
Link:
https://tria.ge/reports/210222-vdptqpj4de/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Executes dropped EXE
UPX packed file
ACProtect 1.3x - 1.4x DLL software
XenArmor Suite
Unpacked files
SH256 hash:
e624003658c4f8b349f567c82229fd15d1e63d3d20fe6f7b4388403038cd2a44
MD5 hash:
b6ce7c1d81b9271eab825ea63de154c3
SHA1 hash:
0e7b89555314f8908c1098b652c9bf50e5ecc27b
Link:
https://www.unpac.me/results/5e2da4eb-9d54-4527-875b-c35375108648/
SH256 hash:
68087284713cf5b3080650a0f37fa67db5eff1b18c7cac032e0fa0c19752c118
MD5 hash:
7d939ae6a2f2906fe21e90c3307d2be9
SHA1 hash:
2c50396d954b69b9060798c0da3adbf48a169bdf
Link:
https://www.unpac.me/results/5e2da4eb-9d54-4527-875b-c35375108648/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
BitRat
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/68087284713cf5b3080650a0f37fa67db5eff1b18c7cac032e0fa0c19752c118

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Email_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Email in files like avemaria
Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:MALWARE_Win_BitRAT
Create hunting rule
Author:ditekSHen
Description:Detects BitRAT RAT
Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/
Rule name:upx_packed
Create hunting rule
Description:UPX packed file

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

BitRAT

img 5acdc48ba968ef0ea6c0732dd77b352415f3535d1405d9814870401d40466e5e

BitRAT

Executable exe 68087284713cf5b3080650a0f37fa67db5eff1b18c7cac032e0fa0c19752c118

(this sample)

  
Dropped by
MD5 d210b2c849cf123efb2feadfd76ea913
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/118312/
  
Dropped by
SHA256 5acdc48ba968ef0ea6c0732dd77b352415f3535d1405d9814870401d40466e5e

Comments