MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 921f2ab9efbdf8b31267044ad0090666510f22d740d55aeeef27262c89e7a5e3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BitRAT


Vendor detections: 9


Intelligence 9 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 921f2ab9efbdf8b31267044ad0090666510f22d740d55aeeef27262c89e7a5e3
SHA3-384 hash: 98c63df5cc8dc3aa5a69f142ed974cf2ee2847ad18da310e66457e37e75d511c2f997e51e8a41932215bf3f51d16caa6
SHA1 hash: 866dc0edd0185a780c631921b577e144208befe3
MD5 hash: d68a36052fbc5c3295928486743027a5
humanhash: april-mango-mike-vegan
File name:USD43000.exe
Download: download sample
Signature BitRAT
Create hunting rule
File size:74'240 bytes
First seen:2021-10-19 10:41:13 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'653 x AgentTesla, 19'464 x Formbook, 12'205 x SnakeKeylogger)
ssdeep 1536:0K58xMrMJn7HJ0cYeWQzPhOvVihneW9+m:0K00wz5OdRSF
Threatray 540 similar samples on MalwareBazaar
TLSH T10D73AF3A76A4C9FAC7A592B3D047F30112AB6DA5D740840F23A47ACF2C777814EEE581
File icon (PE):PE icon
dhash icon 71f0c08888c0e070 (9 x SnakeKeylogger, 9 x AgentTesla, 8 x AsyncRAT)
Reporter pr0xylife
Tags:BitRAT exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
178
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/198461/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a service
Creating a window
Connection attempt to an infection source
Sending a TCP request to an infection source
Launching a process
Creating a file in the %temp% directory
Delayed writing of the file
Query of malicious DNS domain
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
80%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/616ea0fd9a5a1e91c5c5fe5d/reports/7154059a-fcf9-445d-8564-c9fd9d4d78c4/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Quasar RAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b86c6cf0-51da-4646-8579-a4cffd144b14
Result
Threat name:
BitRAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/873022
Signature
.NET source code contains potential unpacker
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Creates an undocumented autostart registry key
Found malware configuration
Hides threads from debuggers
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Writes to foreign memory regions
Yara detected BitRAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/921f2ab9efbdf8b31267044ad0090666510f22d740d55aeeef27262c89e7a5e3/
Threat name:
ByteCode-MSIL.Downloader.Seraph
Create hunting rule
Status:
Malicious
First seen:
2021-10-19 10:42:05 UTC
AV detection:
16 of 26 (61.54%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=sipsvoppxx4lgetharfnacigmziq6iwxidkvv3xpe4tczcphuxrq._file
Verdict:
malicious
Similar samples:
3a3ff370dac609a17ea67e35e81a3b82702afe6660bb3439a489ff8f4350d607
BitRAT
51af4d4e1af93fd32fd240a7ec9df52e2af9f7d7567c7f7dff776ce0b4852323
BitRAT
704e26dbdebc8b3ad1391f5b9d671f8b9550609455821540151ff70e17bed798
BitRAT
888497ac8f3cb030dc34d198ef8e307fab6b129f31f4fc9c41ea78f94d831529
BitRAT
8d3637cd959d0ea44c713b76b6ad46614b8f91a58398cad0f5929cf179cf9e80
BitRAT
b4a79b7fac8b571454b8d2373623a9fa825c1bc2ef6d1370b831782237d24984
BitRAT
b610d1ae855f79028cabdbd3c1160bc330ef68a7f30ab5544d00b09af341cc68
BitRAT
d9f858f28cab427ea59133d06469903d937cd10334a0fdd5f77fe529e3d0ece1
BitRAT
+ 530 additional samples on MalwareBazaar
Result
Malware family:
bitrat
Create hunting rule
Score:
  10/10
Tags:
family:bitrat persistence trojan upx
Link:
https://tria.ge/reports/211019-mrpgragehq/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
UPX packed file
BitRAT
BitRAT Payload
Modifies WinLogon for persistence
Unpacked files
SH256 hash:
921f2ab9efbdf8b31267044ad0090666510f22d740d55aeeef27262c89e7a5e3
MD5 hash:
d68a36052fbc5c3295928486743027a5
SHA1 hash:
866dc0edd0185a780c631921b577e144208befe3
Link:
https://www.unpac.me/results/6fb7c062-bc26-434d-b71f-f8822f86f6a2/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/921f2ab9efbdf8b31267044ad0090666510f22d740d55aeeef27262c89e7a5e3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/198461/

Comments