MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 881003326302ab243f71138e2e39517677c9117fd73e50f8989ee9b39e86407b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

BitRAT

Vendor detections: 11

Intelligence 11 IOCs YARA 1 File information Comments

SHA256 hash:	881003326302ab243f71138e2e39517677c9117fd73e50f8989ee9b39e86407b
SHA3-384 hash:	f7406b7e8acb39fac57d05f714a757c66605e98740ac173484f88143f1bdc0bde6bcbbd6b1abe4c13eb5cd9966f105ad
SHA1 hash:	a2d96bbe0837fcb7a1057e69c8b77960a81ae2b9
MD5 hash:	e60399a0e9761e7653376e878875ef3a
humanhash:	five-twenty-monkey-magazine
File name:	e60399a0e9761e7653376e878875ef3a.exe
Download:	download sample
Signature	BitRAT Create hunting rule
File size:	1'776'128 bytes
First seen:	2021-10-13 18:01:21 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	e9d1f1739ab48fbfe7c7128688524302 (3 x RaccoonStealer, 2 x Smoke Loader, 2 x DanaBot)
ssdeep	24576:aGAASJ+e1ne+6Iyc0mauZEpTZIc1h9A+1TcVDka13/n/nMFaWaiEpwqnyGpXS28X:xAALe8+68auZuZ6SMJPIaoE2qne28X
Threatray	530 similar samples on MalwareBazaar
TLSH	T1DB852201B6A0C039F0F7A7F84975A268B83E79A1672499CF63D42AED4774AD4ED30353
File icon (PE):
dhash icon	ead8ac9cc6a68ee0 (93 x RedLineStealer, 50 x RaccoonStealer, 15 x Smoke Loader)
Reporter	abuse_ch
Tags:	BitRAT exe RAT

Intelligence

File Origin

# of uploads :

# of downloads :

315

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

e60399a0e9761e7653376e878875ef3a.exe

Verdict:

Malicious activity

Analysis date:

2021-10-13 19:21:58 UTC

Tags:

trojan bitrat rat

Link:

https://app.any.run/tasks/99ac1eb3-f14b-4bb2-b16a-2f283632f45d

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/197353/

Detection(s):

SecuriteInfo.com.W32.AIDetect.malware2.25144.27883.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/61671f1efd35fe780c3dd2a1/reports/e824961e-4866-4185-b87c-ee0c21bbc510/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/fcbe1726-607e-49b6-9ef2-ced1a49f8077

Result

Threat name:

BitRAT

Detection:

malicious

Classification:

troj.evad

Score:

76 / 100

Link:

https://www.joesandbox.com/analysis/869906

Signature

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found malware configuration

Hides threads from debuggers

Injects a PE file into a foreign processes

Machine Learning detection for sample

Yara detected BitRAT

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/881003326302ab243f71138e2e39517677c9117fd73e50f8989ee9b39e86407b/

Threat name:

Win32.Trojan.Generic

Status:

Suspicious

First seen:

2021-10-13 18:04:32 UTC

AV detection:

16 of 38 (42.11%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=raiagmtdakvsip3rcohc4okroz34sel7247fb6eyt3u3hhugib5q._file

Verdict:

malicious

BitRAT

29dd2b13f081a0c7f8312c4b4c433ccdcc3b3a83b91a16a88393370dda44f60b

BitRAT

3a3ff370dac609a17ea67e35e81a3b82702afe6660bb3439a489ff8f4350d607

BitRAT

8d3637cd959d0ea44c713b76b6ad46614b8f91a58398cad0f5929cf179cf9e80

BitRAT

b4a79b7fac8b571454b8d2373623a9fa825c1bc2ef6d1370b831782237d24984

BitRAT

b610d1ae855f79028cabdbd3c1160bc330ef68a7f30ab5544d00b09af341cc68

BitRAT

bf6b69cb7063d748e6404300ed8b587473b20b2239605862ccbec909bccf7485

BitRAT

dcb73a0ea23548167bd5724418377fe1e8c88f1be3125c0df6cc89722bb26f33

BitRAT

fd1dfd46f65c7c958e81931c7a47de00166f9ac5527ebd6b7742cf6e8b6de2de

BitRAT

+ 520 additional samples on MalwareBazaar

Result

Malware family:

bitrat

Score:

10/10

Tags:

family:bitrat suricata trojan upx

Link:

https://tria.ge/reports/211013-wmgqsaegap/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

UPX packed file

BitRAT

BitRAT Payload

suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

Unpacked files

SH256 hash:

a2f8d63c62cb008bca76e9a795aba42944b7e338e041798b55aa26eaf8b53bbd

MD5 hash:

2591da8ba0b555639fed94ab4d637c48

SHA1 hash:

1102fddd684d20f78cc860445e5c74dd53aff999

Link:

https://www.unpac.me/results/8c94bc80-f8af-447f-ae25-879916627a32/

SH256 hash:

881003326302ab243f71138e2e39517677c9117fd73e50f8989ee9b39e86407b

MD5 hash:

e60399a0e9761e7653376e878875ef3a

SHA1 hash:

a2d96bbe0837fcb7a1057e69c8b77960a81ae2b9

Link:

https://www.unpac.me/results/8c94bc80-f8af-447f-ae25-879916627a32/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/881003326302ab243f71138e2e39517677c9117fd73e50f8989ee9b39e86407b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.