MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6ea90b2104d4ded4edbe26cb33a507bee9557541b40e8dbc7b2b5a77125d3802. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BitRAT


Vendor detections: 10


Intelligence 10 IOCs 1 YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6ea90b2104d4ded4edbe26cb33a507bee9557541b40e8dbc7b2b5a77125d3802
SHA3-384 hash: 270f8ee1d1da7dd9bb2ea7658e9f954e810016c213d083ec4634550677eb16949a110aeb4dd28d4dfdc140be53227b99
SHA1 hash: 4be084634d93899ecbc74ad2d723fa43bbb509c2
MD5 hash: 0965917ae4a77487c2ae86e6b5ed0250
humanhash: earth-monkey-alaska-arizona
File name:0965917ae4a77487c2ae86e6b5ed0250.exe
Download: download sample
Signature BitRAT
Create hunting rule
File size:4'397'448 bytes
First seen:2022-07-20 11:55:23 UTC
Last seen:2022-07-20 12:37:47 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 98304:+Mt/RKMRjJ/yDAzwvEnrgXFyA3GoyRP5LIDVJFZnWcObIy9i:+cRxVkA8vErgVd/yRRCGcgTi
TLSH T1351633845670E136CF17AB36C0B3226C43B64E4EF555F19B6F9DBCE7386A28016906B3
TrID 64.2% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.5% (.SCR) Windows screen saver (13101/52/3)
9.2% (.EXE) Win64 Executable (generic) (10523/12/4)
5.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.9% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon f0c66f9dcea6d870 (1 x BitRAT)
Reporter abuse_ch
Tags:BitRAT exe RAT


Avatar
abuse_ch
BitRAT C2:
172.94.8.172:1117

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
172.94.8.172:1117 https://threatfox.abuse.ch/ioc/838820/

Intelligence

File Origin
# of uploads :
2
# of downloads :
363
Origin country :
n/a
Vendor Threat Intelligence
Detection:
BitRAT
Create hunting rule
Link:
https://www.capesandbox.com/analysis/292909/
Detection(s):
SecuriteInfo.com.W32.AIDetectNet.01.7112.11571.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Launching a process
Creating a process with a hidden window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/62d7ede86e3737a058a9aa25/reports/d7f72d0d-8613-4aa2-94b2-fb9713d3812b/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
BitRAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1037457
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6ea90b2104d4ded4edbe26cb33a507bee9557541b40e8dbc7b2b5a77125d3802/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2022-07-15 09:46:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
18
AV detection:
7 of 26 (26.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=n2uqwiie2tpnj3n6e3fthjihx3uvk5kbwqhi3pd3fnnhoes5haba._file
Verdict:
malicious
Result
Malware family:
bitrat
Create hunting rule
Score:
  10/10
Tags:
family:bitrat trojan
Link:
https://tria.ge/reports/220720-n31vlafad5/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Checks computer location settings
BitRAT
Malware Config
C2 Extraction:
queentaline.ddns.net:1117
Unpacked files
SH256 hash:
e7210cd540a24a999839ae63ee7ae6dd4266114816c013e937eba47246f216f6
MD5 hash:
a112b3e6e8e9113ce131ff428565e1d8
SHA1 hash:
7195f533f8f4e212b2a3c0da431a5c27d1972d41
Link:
https://www.unpac.me/results/07843000-6442-4a9c-bd56-77c62bd12037/
SH256 hash:
933867ac91d16c46f5e01d13715c2e232446f82318fd87b32e3a09cc2c8f05e0
MD5 hash:
f6ce9e9b4edbc6f33138143711dc4204
SHA1 hash:
314a08daea112f1c177a5af236406f74bc4b2158
Detections:
win_bit_rat_auto
Create hunting rule
Link:
https://www.unpac.me/results/07843000-6442-4a9c-bd56-77c62bd12037/
SH256 hash:
d612e6196f1e9cb7db16d60a6b1f58542affa6559ecd492aa3317dee275bba1c
MD5 hash:
fdee6b4e360d4a417231a688f00b841d
SHA1 hash:
fd36d2601a888257722c0f1480edf48b4417c444
Link:
https://www.unpac.me/results/07843000-6442-4a9c-bd56-77c62bd12037/
SH256 hash:
0e28097ddee76a94e6464ac9c9eb6cb69fb24d9148187606c74ce9b1f473eb93
MD5 hash:
29785aa2f9a90ae32b974958db232871
SHA1 hash:
a760c8fe4a4bc4fc61ffd97835ca82545f0822a4
Link:
https://www.unpac.me/results/07843000-6442-4a9c-bd56-77c62bd12037/
SH256 hash:
6ea90b2104d4ded4edbe26cb33a507bee9557541b40e8dbc7b2b5a77125d3802
MD5 hash:
0965917ae4a77487c2ae86e6b5ed0250
SHA1 hash:
4be084634d93899ecbc74ad2d723fa43bbb509c2
Link:
https://www.unpac.me/results/07843000-6442-4a9c-bd56-77c62bd12037/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6ea90b2104d4ded4edbe26cb33a507bee9557541b40e8dbc7b2b5a77125d3802

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/292909/

Comments