MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8dae589a1806bcf1cf37a85cf9821a25527c4a271d8aba3c9a8f621061766840. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BitRAT


Vendor detections: 11


Intelligence 11 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8dae589a1806bcf1cf37a85cf9821a25527c4a271d8aba3c9a8f621061766840
SHA3-384 hash: 25bb9cce6f21ca28eeef286fb3f08b4545c0cb8eb9be322d6ffdfd02870914e44f8315de8193f04c0a27546780b50faa
SHA1 hash: 9791da30a7d8e2370d035d46dc45238daaf79301
MD5 hash: 3f4db4050dee9f3e8bd5e5582c819cf5
humanhash: potato-fix-gee-hamper
File name:3f4db4050dee9f3e8bd5e5582c819cf5.exe
Download: download sample
Signature BitRAT
Create hunting rule
File size:2'436'096 bytes
First seen:2022-06-01 07:15:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 49152:36KjjW/uyQLV3r4KO3/HJUuS5FGxFZ13zZf5+0JWc9UM94bn:Rmuya0hVhxr13zlI0JvUM
Threatray 710 similar samples on MalwareBazaar
TLSH T174B5121E9743C840E89ABBB4CAB757BA1710DE2195469307A3D4B81BF43B7F95F81382
TrID 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.4% (.EXE) Win64 Executable (generic) (10523/12/4)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 16174db2a88e9620 (26 x BitRAT, 16 x AsyncRAT, 9 x AveMariaRAT)
Reporter abuse_ch
Tags:BitRAT exe RAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
357
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
2b041f7295848862da192bb22b0a29642474da2a.doc
Verdict:
Malicious activity
Analysis date:
2022-05-31 12:06:17 UTC
Tags:
macros macros-on-open generated-doc loader
Link:
https://app.any.run/tasks/ba8452fd-10c4-4231-a121-3192440ad758

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
BitRAT
Create hunting rule
Link:
https://www.capesandbox.com/analysis/275927/
Detection(s):
Win.Trojan.EmbeddedDotNetBinary-9940868-0
Create hunting rule

Win.Trojan.EmbeddedReversedDLL-9940922-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Sending a custom TCP request
Searching for the window
Сreating synchronization primitives
Running batch commands
Creating a process with a hidden window
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c8db9840-5970-4ab2-8a2e-41727d2f33c1
Result
Threat name:
BitRAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1004789
Signature
.NET source code contains potential unpacker
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Contains functionality to hide a thread from the debugger
Creates files in alternative data streams (ADS)
Found malware configuration
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes to foreign memory regions
Yara detected BitRAT
Yara detected Costura Assembly Loader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 637284 Sample: qXx3Yh8rCr.exe Startdate: 01/06/2022 Architecture: WINDOWS Score: 100 66 Found malware configuration 2->66 68 Malicious sample detected (through community Yara rule) 2->68 70 Antivirus / Scanner detection for submitted sample 2->70 72 7 other signatures 2->72 7 qXx3Yh8rCr.exe 1 5 2->7         started        11 Dzueh.exe 1 2->11         started        13 Dzueh.exe 1 2->13         started        process3 file4 52 C:\Users\user\AppData\Roaming\...\Dzueh.exe, PE32 7->52 dropped 54 C:\Users\user\...\Dzueh.exe:Zone.Identifier, ASCII 7->54 dropped 56 C:\Users\user\AppData\...\qXx3Yh8rCr.exe.log, ASCII 7->56 dropped 74 Writes to foreign memory regions 7->74 76 Allocates memory in foreign processes 7->76 78 Injects a PE file into a foreign processes 7->78 15 InstallUtil.exe 1 1 7->15         started        20 cmd.exe 1 7->20         started        22 cmd.exe 1 7->22         started        80 Antivirus detection for dropped file 11->80 82 Multi AV Scanner detection for dropped file 11->82 84 Machine Learning detection for dropped file 11->84 24 cmd.exe 1 11->24         started        26 cmd.exe 11->26         started        28 cmd.exe 1 13->28         started        30 cmd.exe 13->30         started        signatures5 process6 dnsIp7 58 37.0.11.155, 4670, 49773, 49776 WKD-ASIE Netherlands 15->58 50 C:\Users\user\AppData\Local:01-06-2022, HTML 15->50 dropped 60 Creates files in alternative data streams (ADS) 15->60 62 Hides threads from debuggers 15->62 64 Contains functionality to hide a thread from the debugger 15->64 32 conhost.exe 20->32         started        34 timeout.exe 1 20->34         started        36 conhost.exe 22->36         started        38 timeout.exe 1 22->38         started        40 conhost.exe 24->40         started        42 timeout.exe 1 24->42         started        44 2 other processes 26->44 46 2 other processes 28->46 48 2 other processes 30->48 file8 signatures9 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8dae589a1806bcf1cf37a85cf9821a25527c4a271d8aba3c9a8f621061766840/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-05-31 10:46:18 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
24 of 41 (58.54%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rwxfrgqya26pdtzxvboptaq2evjhysrhdwflupe2r5rbaylwnbaa._file
Verdict:
malicious
Similar samples:
44e1fc8d3558bd5caa25ec85f99363873fefdab67ec1a478e67a93ffa993c850
BitRAT
5bf8991a61f6a801bc10ffca78c4ee78236dfc1a920f29a678c8072b5c2d67ce
BitRAT
879b3899bd1dc321c620a9abcd9fa2ce3222047bc49b57cd00a8dabfc9e2b0ac
BitRAT
d7c1130bfed2081ab246aa229e524dd38eb91b22af6db68ddb89f1c760379d9a
BitRAT
f3941a25493fe512c5800ffe411c0d4f3b673da008b655c2343734f077963c66
BitRAT
+ 700 additional samples on MalwareBazaar
Result
Malware family:
bitrat
Create hunting rule
Score:
  10/10
Tags:
family:bitrat persistence trojan
Link:
https://tria.ge/reports/220601-h3sw4afbh2/
Behaviour
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
BitRAT
Malware Config
C2 Extraction:
37.0.11.155:4670
Unpacked files
SH256 hash:
062450d42ee76accef24ea370726ef90d72f60b137124aa26f0f187b66ab3f66
MD5 hash:
30f26ee6d82686f2407d851096769020
SHA1 hash:
a239ab4fee0d8898c1c948032a2d9325588d5918
Detections:
win_bit_rat_auto
Create hunting rule
Link:
https://www.unpac.me/results/920c8644-55e0-4e15-af1b-fc7cdc5ea88a/
Parent samples :
afee0b3d9b0d5b49066b1c30caa599cfda93d070170ef5e30d33e534cb185eb2
8dae589a1806bcf1cf37a85cf9821a25527c4a271d8aba3c9a8f621061766840
SH256 hash:
7c0ba4ed77f850d83cd5904eb3c2337271be25851e195b648f4e0dd5c1b1b25f
MD5 hash:
079696e00ba1b767ccde21bf8ca05d70
SHA1 hash:
fad674cca6f8d43d09a78d77f69c95fac748119b
Link:
https://www.unpac.me/results/920c8644-55e0-4e15-af1b-fc7cdc5ea88a/
SH256 hash:
31c852c9a8a18f02853fa0a22b6613256a75389940e328b36c05b8ef608fcd27
MD5 hash:
8ad80066187e9671624da23bc4ab9483
SHA1 hash:
b8380b9f7694832f84bd0e108fa0860b6e288a81
Link:
https://www.unpac.me/results/920c8644-55e0-4e15-af1b-fc7cdc5ea88a/
SH256 hash:
8dae589a1806bcf1cf37a85cf9821a25527c4a271d8aba3c9a8f621061766840
MD5 hash:
3f4db4050dee9f3e8bd5e5582c819cf5
SHA1 hash:
9791da30a7d8e2370d035d46dc45238daaf79301
Link:
https://www.unpac.me/results/920c8644-55e0-4e15-af1b-fc7cdc5ea88a/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/8dae589a1806/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/8dae589a1806bcf1cf37a85cf9821a25527c4a271d8aba3c9a8f621061766840

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Typical_Malware_String_Transforms
Create hunting rule
Author:Florian Roth
Description:Detects typical strings in a reversed or otherwise modified form
Reference:Internal Research
Rule name:Typical_Malware_String_Transforms_RID3473
Create hunting rule
Author:Florian Roth
Description:Detects typical strings in a reversed or otherwise modified form
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/275927/

Comments