MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6a28f7fb457fb484c1fbcceb41b10637345b18950b62df89c0a7689dd4f20d68. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BitRAT


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6a28f7fb457fb484c1fbcceb41b10637345b18950b62df89c0a7689dd4f20d68
SHA3-384 hash: 51c549fa04d00f4d7f16a5c3b3e8338fd647d05b7e5c9ab629aa5a137e66d1833615c4486de21e5044d5767e30739edb
SHA1 hash: 1443306efc49c4820770fe0cde36c4ca68fdeda2
MD5 hash: 52245de0b67a49befe656dec74b9344f
humanhash: fillet-tennis-texas-speaker
File name:6a28f7fb457fb484c1fbcceb41b10637345b18950b62df89c0a7689dd4f20d68
Download: download sample
Signature BitRAT
Create hunting rule
File size:3'600'360 bytes
First seen:2021-03-10 11:23:49 UTC
Last seen:2021-03-10 13:01:21 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash a7d65c09859bf3644a45cb38958d7206 (3 x ParallaxRAT, 1 x BitRAT)
ssdeep 98304:PVZWhDELQh4pAJ/mS3YN8HgIsYCXJtH6zpj2euVljJsPWW:PVZyNJ+isYCXz+YVl1GB
Threatray 11 similar samples on MalwareBazaar
TLSH 2AF5CF1276C24BB7C5130E31B969F638F3ADA5342F3D02C713D4AA1C3A755429B9CE6A
Reporter JAMESWT_WT
Tags:BitRAT S-PRO d.o.o. signed

Code Signing Certificate

Organisation:S-PRO d.o.o.
Issuer:Sectigo RSA Code Signing CA
Algorithm:sha256WithRSAEncryption
Valid from:2021-03-01T00:00:00Z
Valid to:2022-03-01T23:59:59Z
Serial number: b97f66bb221772dc07ef1d4bed8f6085
MalwareBazaar Blocklist:This certificate is on the MalwareBazaar code signing certificate blocklist (CSCB)
Thumbprint Algorithm:SHA256
Thumbprint: 33f7c1b050d1f08d1e52888939a11362c14898adccb894e1a7c6ba869b0e4e7c
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
146
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
6a28f7fb457fb484c1fbcceb41b10637345b18950b62df89c0a7689dd4f20d68
Verdict:
Malicious activity
Analysis date:
2021-03-10 11:24:15 UTC
Tags:
trojan bitrat rat
Link:
https://app.any.run/tasks/3fb1fb95-a1c6-4a42-ac69-6a275f4ed1e5

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/123593/
Detection(s):
SecuriteInfo.com.Trojan.Inject4.8489.23009.23455.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Sending a UDP request
Transferring files using the Background Intelligent Transfer Service (BITS)
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Moving a file to the %AppData% directory
Deleting a recently created file
Creating a file in the %temp% directory
Launching a process
Creating a window
DNS request
Setting a global event handler
Unauthorized injection to a system process
Setting a global event handler for the keyboard
Sending a TCP request to an infection source
Enabling autorun by creating a file
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
66 / 100
Link:
https://www.joesandbox.com/analysis/634252
Signature
Antivirus detection for dropped file
Hides threads from debuggers
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Sigma detected: Suspicious Svchost Process
System process connects to network (likely due to code injection or exploit)
Behaviour
Behavior Graph:
Download SVG
Gathering data
Threat name:
Win32.Adware.RedCap
Create hunting rule
Status:
Malicious
First seen:
2021-03-10 00:24:56 UTC
File Type:
PE (Exe)
Extracted files:
58
AV detection:
13 of 27 (48.15%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=niupp62fp62ijqp3ztvudmigg42fwgevbnrn7coau5uj3vhsbvua._file
Verdict:
unknown
Similar samples:
4737b939774fa43ffaec93dcee6112b2c3372bcd9910ecd2969cb8dc75ef4857
BitRAT
5346d8a0c2bba4d4f5f5c336958bc5ca5c797649df51a815bafcdc619bc07a9e
BitRAT
7087214159114804bf5e751cee8004818f6d78d671c646ec0775fbc5b3954b10
BitRAT
8f22d0bc0ecaabfea46715aafcaae5db27c74dc564a47c66fd7ffdb53e18e0bf
BitRAT
a4cad2ac92b79ee5a3c0b19e182832b2a6e3fd2ea731e65571561b0b307768a1
BitRAT
b6fbcfc55f0124980a29986006323c37504b13e09e45d5c949c448f4f339ec56
BitRAT
c0054f47a3edfcc977871a0e19413b9596ea15be86a338568333044ff10e07df
BitRAT
c8a0556f803e6e456cfea037885f007dba3b69287459562324460829c57380b7
BitRAT
e6e9b8fe2bb57d5dc22953b423d6340ef3adf9ebef4852a842c9c87e9d3fead7
BitRAT
ffec3bddbb7b0af2ea2ba4cef9756b43adb1fdac458fd14b122ef1aefa5aa15b
BitRAT
+ 1 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
upx
Link:
https://tria.ge/reports/210310-nde6ygxbtn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
UPX packed file
Unpacked files
SH256 hash:
6a28f7fb457fb484c1fbcceb41b10637345b18950b62df89c0a7689dd4f20d68
MD5 hash:
52245de0b67a49befe656dec74b9344f
SHA1 hash:
1443306efc49c4820770fe0cde36c4ca68fdeda2
Link:
https://www.unpac.me/results/638e268f-c10e-4ecb-9799-7fc22eabc60e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
BitRat
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6a28f7fb457fb484c1fbcceb41b10637345b18950b62df89c0a7689dd4f20d68

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/
Rule name:upx_packed
Create hunting rule
Description:UPX packed file

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
X
https://twitter.com/malwrhunterteam/status/1369607587872792577?s=20
Cape
Cape
https://www.capesandbox.com/analysis/123593/

Comments