MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 969c3fd429a58baf7cd7c95375a80c0d6335df32cf6107205e1ce82526bae511. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BitRAT


Vendor detections: 10


Intelligence 10 IOCs 1 YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 969c3fd429a58baf7cd7c95375a80c0d6335df32cf6107205e1ce82526bae511
SHA3-384 hash: 4d95e14a17e8228fbe6744837354c2a200ab8f44ec13c806cd7565a5128813d218815697f2c340a71b841d3cc56439d4
SHA1 hash: 3bc1d96db28a34908ecd012802c2116e7059215b
MD5 hash: cb359b177605b936f7fdffa64869bdf9
humanhash: floor-victor-delta-uniform
File name:payment invoice 962008.exe
Download: download sample
Signature BitRAT
Create hunting rule
File size:3'138'609 bytes
First seen:2021-10-22 07:54:33 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b76363e9cb88bf9390860da8e50999d2 (464 x Formbook, 184 x AgentTesla, 122 x SnakeKeylogger)
ssdeep 49152:eE286xT68bljvXaC9bfawTmKxJpHzhy7bitFYXOpXZvkje1x0ST6ZVKqKo6:eE286x2Abhra6mWJlzhynitlXZvkje1x
TLSH T16EE523E1D32648A5DD36633CA8B3592A7173B93EDBB0004E5ADCF63B0F3275A0092957
File icon (PE):PE icon
dhash icon c8ccccc0c0d0f074 (9 x Formbook, 2 x BitRAT, 1 x NanoCore)
Reporter abuse_ch
Tags:BitRAT exe RAT

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
136.144.41.42:6703 https://threatfox.abuse.ch/ioc/236632/

Intelligence

File Origin
# of uploads :
1
# of downloads :
220
Origin country :
n/a
Vendor Threat Intelligence
Detection:
BitRAT
Create hunting rule
Link:
https://www.capesandbox.com/analysis/199301/
Detection(s):
SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.17566.5697.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a file
Unauthorized injection to a recently created process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/61726e59db358dd15ed2e6ed/reports/29d5b99d-a4a4-4028-91a7-bbd5dda7d2ce/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/ba0c8348-a82f-49c7-bf2f-42f8aa132cf3
Result
Threat name:
BitRAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/875105
Signature
C2 URLs / IPs found in malware configuration
Contains functionality to hide a thread from the debugger
Found malware configuration
Hides threads from debuggers
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Uses dynamic DNS services
Yara detected BitRAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/969c3fd429a58baf7cd7c95375a80c0d6335df32cf6107205e1ce82526bae511/
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2021-10-22 07:55:07 UTC
AV detection:
17 of 38 (44.74%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=s2od7vbjuwf267gxzfjxlkambvrtlxzsz5qqoic6dtuckjv24uiq._file
Verdict:
malicious
Result
Malware family:
bitrat
Create hunting rule
Score:
  10/10
Tags:
family:bitrat trojan
Link:
https://tria.ge/reports/211022-jr5besbcf6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of NtSetInformationThreadHideFromDebugger
Loads dropped DLL
BitRAT
BitRAT Payload
Unpacked files
SH256 hash:
969c3fd429a58baf7cd7c95375a80c0d6335df32cf6107205e1ce82526bae511
MD5 hash:
cb359b177605b936f7fdffa64869bdf9
SHA1 hash:
3bc1d96db28a34908ecd012802c2116e7059215b
Link:
https://www.unpac.me/results/00a7f6d2-68c4-4fe0-874f-b5b52f1016e6/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.37
Link:
https://yomi.yoroi.company/submissions/969c3fd429a58baf7cd7c95375a80c0d6335df32cf6107205e1ce82526bae511

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:MALWARE_Win_BitRAT
Create hunting rule
Author:ditekSHen
Description:Detects BitRAT RAT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/199301/

Comments