MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7e562d4eb934e1f2d7b9ee0fb618886fe0a587772bcb695b71e7cd8b1f1ec303. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BitRAT


Vendor detections: 10


Intelligence 10 IOCs 1 YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7e562d4eb934e1f2d7b9ee0fb618886fe0a587772bcb695b71e7cd8b1f1ec303
SHA3-384 hash: 921f042781f25eeb1011e12e72af9d1029ffd7ff824643093ebd13515b399835a47730efc5ffaacaea14b15e89534667
SHA1 hash: 43cf4e08b6d04b8b5a77fdbdebe5fe95d7f2151a
MD5 hash: 8816eec5f3f3775bfe1d1b8b624ca7e8
humanhash: stream-single-island-bakerloo
File name:Shipment0806201pdf.exe
Download: download sample
Signature BitRAT
Create hunting rule
File size:4'059'136 bytes
First seen:2021-06-08 04:20:24 UTC
Last seen:2021-06-08 04:38:19 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 98304:Zat3TENymUUYchRPk3LoC62rkarBKgMyD7m:k+8PhchRPk3MckaVKPynm
Threatray 202 similar samples on MalwareBazaar
TLSH C816DFAC356071EFC4A7C6BA8AA82CA4EB613577530F9103942715ED9A0CB97DF244F3
Reporter abuse_ch
Tags:BitRAT exe RAT


Avatar
abuse_ch
BitRAT C2:
45.133.1.212:50855

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
45.133.1.212:50855 https://threatfox.abuse.ch/ioc/72311/

Intelligence

File Origin
# of uploads :
2
# of downloads :
137
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Shipment0806201pdf.exe
Verdict:
Malicious activity
Analysis date:
2021-06-08 04:21:40 UTC
Tags:
trojan bitrat rat
Link:
https://app.any.run/tasks/90ce08b0-3142-4c42-9f0b-d179fbb2bbd6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/165118/
Detection(s):
SecuriteInfo.com.Variant.Barys.22147.16617.15747.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Launching a process
Creating a file
DNS request
Setting a global event handler
Sending a custom TCP request
Forced shutdown of a system process
Setting a global event handler for the keyboard
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/798449
Signature
.NET source code contains potential unpacker
.NET source code contains very large strings
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 430845 Sample: Shipment0806201pdf.exe Startdate: 08/06/2021 Architecture: WINDOWS Score: 52 16 .NET source code contains potential unpacker 2->16 18 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 2->18 20 .NET source code contains very large strings 2->20 6 Shipment0806201pdf.exe 3 2->6         started        process3 process4 8 vbc.exe 6->8         started        10 vbc.exe 6->10         started        12 vbc.exe 6->12         started        14 2 other processes 6->14
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7e562d4eb934e1f2d7b9ee0fb618886fe0a587772bcb695b71e7cd8b1f1ec303/
Threat name:
Win32.Trojan.Barys
Create hunting rule
Status:
Malicious
First seen:
2021-06-08 04:21:10 UTC
AV detection:
8 of 47 (17.02%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pzlc2tvzgtq7fv5z5yh3mgein7qklb3xfpfwsw3r47gywhy6ymbq._file
Verdict:
malicious
Similar samples:
1e92ffaaee0217be3540c5a8e0b465d639008e15bb1335fc1aab14ef252f4072
BitRAT
4fb70014b735a41f61b7e5a6cd155c1801a4bda693e4dc5e75581c990c9d05c4
BitRAT
6110c332c287a7ac7fadde14aa3b69190a415e11f664f6746b461b589e0276cd
BitRAT
6387b0ded51410f864b093626cfa7e711c8885d6870996f8138de12ced45730c
BitRAT
6cd85d78caec047483007ee54b8f4cea13d29c648b7f4bd500ce199f360f1518
BitRAT
8f09e478721eecc723aa346c56541183c78bcaa6b97f08b8d33b84022881178a
BitRAT
b16c4aa0a8ec4b2fc3c6f5323a3bb35f9c4d26c97aeaff4aa874507ffb3339e3
BitRAT
cee8aa44f63039722053db96209cf1dcfb15634bdb46c8cc3098e58407c0e4ce
BitRAT
d5b80d52df526be1a519fa5962702503f22eb24417e65041e91be881f73b36ff
BitRAT
dfeaef515d92681d5d23ace741b56e14ec71b9042427874c15ef2db030c47b95
BitRAT
+ 192 additional samples on MalwareBazaar
Result
Malware family:
bitrat
Create hunting rule
Score:
  10/10
Tags:
family:bitrat trojan
Link:
https://tria.ge/reports/210608-1rzd88hmae/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Uses the VBS compiler for execution
BitRAT
BitRAT Payload
Unpacked files
SH256 hash:
8413b962086ebbe003acbb51708034c745db8a1e68d46b39f958079b8d26cc39
MD5 hash:
679881cf260a99ded2ec6f48b539bbcf
SHA1 hash:
b632ad26c2109c3e4b2e7d366a034a58189d9a63
Link:
https://www.unpac.me/results/e39bc7b0-e6b3-4f41-9e2b-0aa7d762827a/
SH256 hash:
5bede9eedf6ae6df5a9d587c116c9583b31474c159c2b53486b000093cb3fde6
MD5 hash:
072eeac61b35d3f09edee4ff4f80f52d
SHA1 hash:
696fd9905a47e526470c2e234fef32f1ec1b74ad
Link:
https://www.unpac.me/results/e39bc7b0-e6b3-4f41-9e2b-0aa7d762827a/
SH256 hash:
dcc7e926f5f3eb44a8fe2890ff58cda6864be8d7f50e0f62545b0a82af1d1afc
MD5 hash:
ef1e27e8cfeb328859dcb3667d7d27a8
SHA1 hash:
534cfb5d6f2152175be4fe6134146d66dead1227
Link:
https://www.unpac.me/results/e39bc7b0-e6b3-4f41-9e2b-0aa7d762827a/
SH256 hash:
7e562d4eb934e1f2d7b9ee0fb618886fe0a587772bcb695b71e7cd8b1f1ec303
MD5 hash:
8816eec5f3f3775bfe1d1b8b624ca7e8
SHA1 hash:
43cf4e08b6d04b8b5a77fdbdebe5fe95d7f2151a
Link:
https://www.unpac.me/results/e39bc7b0-e6b3-4f41-9e2b-0aa7d762827a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.54
Link:
https://yomi.yoroi.company/submissions/7e562d4eb934e1f2d7b9ee0fb618886fe0a587772bcb695b71e7cd8b1f1ec303

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/165118/

Comments