MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9ed20e145000de987d91695be5537f6b3cadec06e47254d768e158c3a7582bb7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BitRAT


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9ed20e145000de987d91695be5537f6b3cadec06e47254d768e158c3a7582bb7
SHA3-384 hash: 23fdd6edc94bad33b35d602683ef56156352c05b899e66d5b53030d52e9959da4b36dfc7b009f584516eeeba3a8e014c
SHA1 hash: 639e39eff8e5eba8126dc0adb71da1d6d46ccab5
MD5 hash: ca264691ae5050da7ba7db3c48687bc3
humanhash: equal-london-jupiter-kilo
File name:ca264691ae5050da7ba7db3c48687bc3.exe
Download: download sample
Signature BitRAT
Create hunting rule
File size:1'259'520 bytes
First seen:2020-12-18 16:54:31 UTC
Last seen:2020-12-18 18:33:53 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 6ed4f5f04d62b18d96b26d6db7c18840 (221 x SalatStealer, 78 x BitRAT, 42 x RedLineStealer)
ssdeep 24576:HAgfcG8iZEX4ez/WDAJubSl60XAVWMDG3ocAaeaJ8ORnbZ+:H8G8iyP+k0SloVa3ocbePORb
Threatray 52 similar samples on MalwareBazaar
TLSH BC453389318658B2F9D4313D5B8A2C5AC305DEE112F5A3065379C2B36DB3B307796CDA
Reporter abuse_ch
Tags:BitRAT exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
251
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ca264691ae5050da7ba7db3c48687bc3.exe
Verdict:
Malicious activity
Analysis date:
2020-12-18 16:58:46 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/744cdec2-1f67-46c2-92dc-efdf92364844

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/108460/
Detection(s):
PUA.Win.Packer.Upolyx-12
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Setting a global event handler
Connection attempt
Replacing executable files
Sending a UDP request
Moving of the original file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Setting a global event handler for the keyboard
Deleting of the original file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/566515
Signature
Antivirus / Scanner detection for submitted sample
Contains functionality to hide a thread from the debugger
Contains functionality to inject code into remote processes
Creates files in alternative data streams (ADS)
Found Tor onion address
Hides threads from debuggers
Multi AV Scanner detection for submitted file
Uses dynamic DNS services
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9ed20e145000de987d91695be5537f6b3cadec06e47254d768e158c3a7582bb7/
Threat name:
Win32.Trojan.Graftor
Create hunting rule
Status:
Malicious
First seen:
2020-12-08 11:55:55 UTC
AV detection:
23 of 26 (88.46%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
22ba4198dd80989673a5db96ec9a50b4bbd45931c98636aba17443d638ef937c
BitRAT
34fea0ffa5d9e73cf376929c94e5e4ab31a7781f51c0e0e08012b714e7851e4d
BitRAT
56223f30d25ad9e7ace44f33bf080b1b965df0a8d4f0b298537d9dcda4162052
BitRAT
586db73f0c9c8a852533d500b667211da84f2621c79c2cf19f471655db0cd64f
BitRAT
717b902e972dc5fef4b12b83f75a922acb007a547ec772b2084b307361d7f630
BitRAT
bdd18f3aa33fa9598b5fbf01f137f8f651f23371adc6d759bbc8fdc617aca6ef
BitRAT
d6964f92949edac5e3f2b740a6c2fa121eb1539f5a291ee7d4cc5cd55cadd49d
BitRAT
d827689b395e61faaa11fcf68118f58ae90a291819e1dabe2fd1f91c37805ee2
BitRAT
ec8127c4b1dae8a286793e1c3a85a0f793203fe3e1142a2f57117ff5308a86e2
BitRAT
edc94fa5e8c239bd9e5ad814faed3b3d0089f63d98ffe5c70e7401652e6636ca
BitRAT
+ 42 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence upx
Link:
https://tria.ge/reports/201218-hl16ejwhgs/
Behaviour
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Adds Run key to start application
Unpacked files
SH256 hash:
3698164f959f8fca6577f0d8615c21867d8015e36656d4b8cbb54335aa984236
MD5 hash:
98eb6baa6e909be10e9d7a4e9de77171
SHA1 hash:
1866d8017be23480ff136d444c820a84a068411f
Link:
https://www.unpac.me/results/4604907e-3daf-4431-9769-7fb2e787a333/
SH256 hash:
9ed20e145000de987d91695be5537f6b3cadec06e47254d768e158c3a7582bb7
MD5 hash:
ca264691ae5050da7ba7db3c48687bc3
SHA1 hash:
639e39eff8e5eba8126dc0adb71da1d6d46ccab5
Link:
https://www.unpac.me/results/4604907e-3daf-4431-9769-7fb2e787a333/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Cryptor
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/9ed20e145000de987d91695be5537f6b3cadec06e47254d768e158c3a7582bb7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_BitRAT
Create hunting rule
Author:ditekSHen
Description:Detects BitRAT RAT
Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/108460/

Comments