MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a294e980bb7b7e74981a67379dd4c589803d0d5c17946b3b00ce561791ecfc63. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BitRAT


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a294e980bb7b7e74981a67379dd4c589803d0d5c17946b3b00ce561791ecfc63
SHA3-384 hash: 068a7320651273e6fdd2b76fa0ac564ef73538489baef6f30b5b573579d91d94aa1cb1f0faca7eb96a692ae0699e77ee
SHA1 hash: 46551ee912bc763ba25339586163607f24b8a23c
MD5 hash: 2e4cb1595a3dcd3d664601275ef900a6
humanhash: muppet-sweet-enemy-july
File name:cW49B9lA9c4reHCwa7Be.exe
Download: download sample
Signature BitRAT
Create hunting rule
File size:4'430'860 bytes
First seen:2021-02-04 02:54:09 UTC
Last seen:2021-02-04 05:04:12 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'647 x AgentTesla, 19'451 x Formbook, 12'201 x SnakeKeylogger)
ssdeep 98304:UZrJYwPJxJWRN4Dq/yyo2s+4XGBhzXrzHnNfZLdUVJQVmq9NVuDMlj8eeO:y/Who2cGr/NfhdUV2ZwMlH
Threatray 88 similar samples on MalwareBazaar
TLSH 1426333D58AD0A5CC58D6DF98678C238A2BEC3B13E5FF3218E705DE89F21FA51604991
Reporter vm001cn
Tags:BitRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
132
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
cW49B9lA9c4reHCwa7Be.exe
Verdict:
Malicious activity
Analysis date:
2021-02-04 02:55:24 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/82499f6d-e374-4a83-a95e-ae35b3cb01d8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
BitRAT
Create hunting rule
Link:
https://www.capesandbox.com/analysis/115470/
Detection(s):
SecuriteInfo.com.Trojan.Packed2.42827.23289.7248.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Launching a process
Creating a process with a hidden window
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
BitRAT Xmrig
Create hunting rule
Detection:
malicious
Classification:
troj.evad.mine
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/598675
Signature
Contains functionality to hide a thread from the debugger
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
Sigma detected: Scheduled temp file as task from temp location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM_3
Yara detected BitRAT
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a294e980bb7b7e74981a67379dd4c589803d0d5c17946b3b00ce561791ecfc63/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-04 02:55:08 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ukkotaf3pn7hjga2m43z3vgfrgad2dk4c6kgwoyazzlbpepm7rrq._file
Verdict:
malicious
Similar samples:
1c1b2595e6838a1ee24e806ff60b80a40ad7166caaaaf65080deda57c7292c53
BitRAT
22dbe6172d32b9b90d66036688e440a9026524f8c4c61b1c05f45dbd63919483
BitRAT
243e8ba43bcdb6634c77835df678964743893a30f4d2abe9596f2add2882e074
BitRAT
2ddd796e9b53ab3d7eaf4093529077f637f182a934a851af24da8c8f189aeed3
BitRAT
3cf331e46b6f16ef2a591637b64865d81b19e016ad3f4f3280aa1a872f1261ab
BitRAT
403943dce6fbb57dfaf602189ee84bcef2ac109b952027bff8e1cc49c6b81d9d
BitRAT
79e6d1b262a31a2619284f38b059e266d0fa27109c9b1f4fc9100aa6bb619e05
BitRAT
80104e0ad490b44a632a15e5875e7626db7f35fa94d7aadf19c45a621d75c7e0
BitRAT
8fdc007dd13e7c0c5bbe426da723499db81518697eb84d2fd2a0181996d276fa
BitRAT
9ffa16b91dc10936865d1d9849940c9d27276fd6acd6ab947d31e7f80322eea2
BitRAT
+ 78 additional samples on MalwareBazaar
Result
Malware family:
bitrat
Create hunting rule
Score:
  10/10
Tags:
family:bitrat ransomware trojan
Link:
https://tria.ge/reports/210204-tcvjq8v6qn/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
BitRAT
BitRAT Payload
Unpacked files
SH256 hash:
51de07a446c965a8ad4fabd9445b53d08cc68c5785796bb7738f36779b6f59ac
MD5 hash:
6b31801bf9beda5378987df6b95b640c
SHA1 hash:
fbb4d8b9a58bf816f678915c38f81411953f7207
Link:
https://www.unpac.me/results/17b0dc03-d662-4483-9b55-70e41329c8fe/
SH256 hash:
a2a0bbbe8c9ee88441356010f63455c50dfcafe663db757bbc453c815c51d720
MD5 hash:
11e80c54bfeff7f0c120dae46df0a8be
SHA1 hash:
d597b9b0dcac06f0aa00a931bb90de8eba564651
Link:
https://www.unpac.me/results/17b0dc03-d662-4483-9b55-70e41329c8fe/
SH256 hash:
34bf005fcd83ebdfa7a34bd7a731a58639faab1f8701ddafe79040ae022a5537
MD5 hash:
90c7e7b069e1e1209799701e32400480
SHA1 hash:
053bdb548cae939ac95badebb90fa76028963725
Link:
https://www.unpac.me/results/17b0dc03-d662-4483-9b55-70e41329c8fe/
SH256 hash:
a294e980bb7b7e74981a67379dd4c589803d0d5c17946b3b00ce561791ecfc63
MD5 hash:
2e4cb1595a3dcd3d664601275ef900a6
SHA1 hash:
46551ee912bc763ba25339586163607f24b8a23c
Link:
https://www.unpac.me/results/17b0dc03-d662-4483-9b55-70e41329c8fe/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a294e980bb7b7e74981a67379dd4c589803d0d5c17946b3b00ce561791ecfc63

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Email_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Email in files like avemaria
Rule name:MALWARE_Win_BitRAT
Create hunting rule
Author:ditekSHen
Description:Detects BitRAT RAT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/115470/

Comments