MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 91e994fe2f5d97c9c7a8267ac900bd08d66c6e997397d01ccd15c0b301d98ea3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BitRAT


Vendor detections: 16


Intelligence 16 IOCs 1 YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 91e994fe2f5d97c9c7a8267ac900bd08d66c6e997397d01ccd15c0b301d98ea3
SHA3-384 hash: e6a808d3c7441eef46524f6acfc0c641afe44917601007bd765b0068cb3802b3b4d70ea08e60040de152cdf157c43ce6
SHA1 hash: 80f1c546beb6c241bf038848fe4fae825c3d6cd0
MD5 hash: a7710e7f82db612edd7ec60885643899
humanhash: emma-freddie-ink-hot
File name:a7710e7f82db612edd7ec60885643899.exe
Download: download sample
Signature BitRAT
Create hunting rule
File size:3'943'424 bytes
First seen:2022-10-25 13:26:19 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 71955ccbbcbb24efa9f89785e7cce225 (57 x BitRAT)
ssdeep 98304:877Pmq33rE/JDLPWZADUGer7B6iY74M/AmlwXVZaFB:K+R/eZADUXR
TLSH T14806CF02FA46C562D2170230E96E77BE053CF9354B2085C3B3946E6859B66D17A3BF3B
TrID 40.3% (.EXE) Win64 Executable (generic) (10523/12/4)
19.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.2% (.EXE) Win32 Executable (generic) (4505/5/1)
7.7% (.EXE) OS/2 Executable (generic) (2029/13)
7.6% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter abuse_ch
Tags:BitRAT exe RAT


Avatar
abuse_ch
BitRAT C2:
103.125.190.185:1234

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
103.125.190.185:1234 https://threatfox.abuse.ch/ioc/948758/

Intelligence

File Origin
# of uploads :
1
# of downloads :
246
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
bitrat
Create hunting rule
ID:
1
File name:
a7710e7f82db612edd7ec60885643899.exe
Verdict:
Malicious activity
Analysis date:
2022-10-25 13:27:23 UTC
Tags:
trojan bitrat rat
Link:
https://app.any.run/tasks/b92a664d-0cae-4cc1-a8ad-be84895afead

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
BitRAT
Create hunting rule
Link:
https://www.capesandbox.com/analysis/324036/
Detection(s):
Win.Malware.Mikey-9819889-0
Create hunting rule

SecuriteInfo.com.Trojan.Siggen14.19963.17563.12186.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Setting a global event handler
Sending a custom TCP request
Setting a global event handler for the keyboard
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/45417/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
CheckCmdLine
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
BitRAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/29572b97-5004-40a1-bb7f-a6cc343c96f8
Result
Threat name:
AveMaria, BitRAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad.phis.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1097654
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Contains functionality to steal e-mail passwords
Detected unpacking (changes PE section rights)
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has nameless sections
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
Yara detected AveMaria stealer
Yara detected BitRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 730306 Sample: NCi8SqtXLa.exe Startdate: 25/10/2022 Architecture: WINDOWS Score: 100 44 Malicious sample detected (through community Yara rule) 2->44 46 Antivirus detection for dropped file 2->46 48 Antivirus / Scanner detection for submitted sample 2->48 50 7 other signatures 2->50 8 NCi8SqtXLa.exe 1 3 2->8         started        process3 dnsIp4 42 103.125.190.185, 1234, 49704, 49707 VNPT-AS-VNVIETNAMPOSTSANDTELECOMMUNICATIONSGROUPVN Viet Nam 8->42 60 Detected unpacking (changes PE section rights) 8->60 62 Tries to steal Mail credentials (via file registry) 8->62 64 Contains functionality to steal e-mail passwords 8->64 66 2 other signatures 8->66 12 NCi8SqtXLa.exe 24 8->12         started        16 NCi8SqtXLa.exe 24 8->16         started        signatures5 process6 file7 28 C:\Users\user\Desktop\Unknown.dll, PE32 12->28 dropped 30 C:\Users\user\Desktop\...\softokn3.dll, PE32 12->30 dropped 32 C:\Users\user\Desktopxternal\...\nss3.dll, PE32 12->32 dropped 34 17 other files (2 malicious) 12->34 dropped 68 Injects a PE file into a foreign processes 12->68 18 NCi8SqtXLa.exe 5 12->18         started        22 NCi8SqtXLa.exe 5 16->22         started        signatures8 process9 dnsIp10 36 xenarmor.com 69.64.94.128 CODERO-DFWUS United States 18->36 38 www.xenarmor.com 18->38 24 conhost.exe 18->24         started        40 www.xenarmor.com 22->40 52 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 22->52 54 Tries to steal Instant Messenger accounts or passwords 22->54 56 Tries to steal Mail credentials (via file / registry access) 22->56 58 2 other signatures 22->58 26 conhost.exe 22->26         started        signatures11 process12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/91e994fe2f5d97c9c7a8267ac900bd08d66c6e997397d01ccd15c0b301d98ea3/
Threat name:
Win32.Spyware.Solmyr
Create hunting rule
Status:
Malicious
First seen:
2022-10-21 05:16:48 UTC
File Type:
PE (Exe)
AV detection:
24 of 26 (92.31%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=shuzj7rplwl4tr5iez5msaf5bdlgy3uzool5ahgncxalgaozr2rq._file
Verdict:
malicious
Result
Malware family:
xenarmor
Create hunting rule
Score:
  10/10
Tags:
family:bitrat family:xenarmor collection password recovery spyware stealer upx
Link:
https://tria.ge/reports/221025-qp3s5scgg5/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses Microsoft Outlook accounts
Loads dropped DLL
Reads data files stored by FTP clients
Reads local data of messenger clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
UPX packed file
ACProtect 1.3x - 1.4x DLL software
XenArmor Suite
Malware Config
C2 Extraction:
103.125.190.185:1234
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/d6bc40e6-5b96-400e-8be7-9872fa079cdc
Unpacked files
SH256 hash:
91e994fe2f5d97c9c7a8267ac900bd08d66c6e997397d01ccd15c0b301d98ea3
MD5 hash:
a7710e7f82db612edd7ec60885643899
SHA1 hash:
80f1c546beb6c241bf038848fe4fae825c3d6cd0
Detections:
win_bit_rat_auto
Create hunting rule
Link:
https://www.unpac.me/results/37d7dddd-a2e9-4eae-8eaa-a75c4a2a1ba7/
Parent samples :
5e1ea26f5575e26857b209695de82207a04de0b0dc06f3645f776cc628440c46
4691e86098f4a2fe6ed76c46dc7584ae25d9396b06427a47a00ce1156d38f12b
91e994fe2f5d97c9c7a8267ac900bd08d66c6e997397d01ccd15c0b301d98ea3
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/91e994fe2f5d97c9c7a8267ac900bd08d66c6e997397d01ccd15c0b301d98ea3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:bitrat_unpacked
Create hunting rule
Author:jeFF0Falltrades
Description:Experimental rule to detect unpacked BitRat payloads on disk or in memory, looking for a combination of strings and decryption/decoding patterns
Reference:https://krabsonsecurity.com/2020/08/22/bitrat-the-latest-in-copy-pasted-malware-by-incompetent-developers/
Rule name:MALWARE_Win_BitRAT
Create hunting rule
Author:ditekSHen
Description:Detects BitRAT RAT
Rule name:Windows_Trojan_Bitrat_54916275
Create hunting rule
Author:Elastic Security
Rule name:win_bit_rat_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.bit_rat.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/324036/

Comments