MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7eed0a7abb529f2d7208babe7ab96ea673878fad3fcd7779340b4d6dc3d8468e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BitRAT


Vendor detections: 7


Intelligence 7 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7eed0a7abb529f2d7208babe7ab96ea673878fad3fcd7779340b4d6dc3d8468e
SHA3-384 hash: 7297913fa0507fa442b089a700cfe0052818eb1b038cd1e430d0b08a0e959d1af0d53d5c3134d5f7a9f82a0f059682dd
SHA1 hash: cc6a630f58de4d50f347e4e99f372ba6b8b912b9
MD5 hash: fc72ab34d865089f137f44792dc72487
humanhash: red-lake-colorado-social
File name:fc72ab34d865089f137f44792dc72487.exe
Download: download sample
Signature BitRAT
Create hunting rule
File size:6'033'920 bytes
First seen:2020-10-10 11:21:16 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 6ed4f5f04d62b18d96b26d6db7c18840 (221 x SalatStealer, 78 x BitRAT, 42 x RedLineStealer)
ssdeep 98304:ChukfWodQ1pqfCWnqS0SveO186xwnhKAFhovosyo31CPwDv3uFZjhUg2EeJUO9Wf:ChRWo+efCWnqS0SBjxwhzav1yo31CPwe
Threatray 907 similar samples on MalwareBazaar
TLSH BB56DF9030E55C5EDD966B7CC6EB9327363DFA840B67C7135B21AA364E23EC62E90305
Reporter abuse_ch
Tags:BitRAT exe RAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
164
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/69746/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Deleting a recently created file
Setting a global event handler
Delayed writing of the file
Replacing files
Sending a UDP request
Creating a window
Creating a file
Creating a process from a recently created file
Creating a process with a hidden window
Moving a recently created file
Sending a custom TCP request
Setting a global event handler for the keyboard
Result
Threat name:
BitRAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/487498
Signature
Antivirus / Scanner detection for submitted sample
Hides threads from debuggers
Machine Learning detection for sample
May use the Tor software to hide its network traffic
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: System File Execution Location Anomaly
System process connects to network (likely due to code injection or exploit)
Yara detected BitRAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7eed0a7abb529f2d7208babe7ab96ea673878fad3fcd7779340b4d6dc3d8468e/
Threat name:
Win32.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-10-06 06:40:00 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=p3wqu6v3kkps24qixk7hvolouzzypd5nh7gxo6jubngw3q6yi2ha._file
Verdict:
unknown
Similar samples:
24676397320c85928b2fc53501109d63f3fb34a6aba00446c7ed5fbd272fda8b
BitRAT
6d01ee99d5c720b96cc5d8d468305ad87fd0cb0e3730fd907f74a27d13239a06
BitRAT
7faef4d80d1100c3a233548473d4dd7d5bb570dd83e8d6e5faff509d6726baf2
BitRAT
a4cb4b3c28208b5f92691ffa076e7926b70f7c2f03911c5772f3db84f0994807
BitRAT
aa7983e98428266c58447652fe8c1b211db525293c117c59fc54d4cc318be59d
BitRAT
bc742c33c446a25e6482c4209436088415d5c89a7f8ab66f37f16006d62344ac
BitRAT
c829aa312e2ea1c043566e26517b2bf90e9c12ed68e9d7d24577ebc13f2cf3b1
BitRAT
d8dbe0a74ff4d70f5633f8177f37c14cd1586d7a658ecf72d05f59261e8ad016
BitRAT
ee5ce848044843cd0ceeeab61270c15a35f571a9faca4daa9cc17b212dc753d9
BitRAT
f9b7ef320dd7f76be9bdf12f14f0875a9f52165b989376cd1f2e2d23cdb52fe5
BitRAT
+ 897 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
upx
Link:
https://tria.ge/reports/201010-jeqycdmtaj/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Looks up external IP address via web service
Loads dropped DLL
Executes dropped EXE
UPX packed file
Unpacked files
SH256 hash:
7eed0a7abb529f2d7208babe7ab96ea673878fad3fcd7779340b4d6dc3d8468e
MD5 hash:
fc72ab34d865089f137f44792dc72487
SHA1 hash:
cc6a630f58de4d50f347e4e99f372ba6b8b912b9
Link:
https://www.unpac.me/results/405c7606-0de2-4cc4-b89f-121d8029bed8/
SH256 hash:
d8f51d1ecf47c429a558402ed3d5b8e46228cae78688a848a589bc9e5304a30b
MD5 hash:
b1b5748526a375765a31005118b2fdef
SHA1 hash:
4efa38c476e3bfaa286a7c675196b3b87fc68e4b
Detections:
win_bit_rat_w0
Create hunting rule
Link:
https://www.unpac.me/results/405c7606-0de2-4cc4-b89f-121d8029bed8/
SH256 hash:
bf17144d079649dcf2f770f4527ddb27dab66a51a77d5725d5fb358c847fa88a
MD5 hash:
bbcb4489c483ca0ac14336cda6f941b3
SHA1 hash:
3b5bc6b21f5dce2d6c400b7f5793b909ee771d66
Link:
https://www.unpac.me/results/405c7606-0de2-4cc4-b89f-121d8029bed8/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Eldorado
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/7eed0a7abb529f2d7208babe7ab96ea673878fad3fcd7779340b4d6dc3d8468e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:IPPort_combo_mem
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:Ping_Del_method_bin_mem
Create hunting rule
Author:James_inthe_box
Description:cmd ping IP nul del
Rule name:Rooter
Create hunting rule
Author:Seth Hardy
Description:Rooter
Rule name:RooterStrings
Create hunting rule
Author:Seth Hardy
Description:Rooter Identifying Strings
Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/
Rule name:win_bit_rat_w0
Create hunting rule
Author:KrabsOnSecurity
Description:String-based rule for detecting BitRAT malware payload

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

BitRAT

Executable exe 7eed0a7abb529f2d7208babe7ab96ea673878fad3fcd7779340b4d6dc3d8468e

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/678796/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/69746/

Comments