MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a9b4758c091b653468bcfe33b2262f282589e0e5c52c02120b215a4bc6109d6a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BitRAT


Vendor detections: 9


Intelligence 9 IOCs 1 YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a9b4758c091b653468bcfe33b2262f282589e0e5c52c02120b215a4bc6109d6a
SHA3-384 hash: 7c26eb41e40a0b93c29f021a518e7bc1b53b1d8a3e4df80c1e46634e65479e3ecd07b195b46da810770401111fb6d9a3
SHA1 hash: ce5978b055fb9b2c530633a446837cef287e88bf
MD5 hash: 0771e6f599f97823f7c459d0a777a2a9
humanhash: oregon-mike-friend-bravo
File name:slip.exe
Download: download sample
Signature BitRAT
Create hunting rule
File size:1'589'909 bytes
First seen:2021-05-25 08:20:07 UTC
Last seen:2021-05-25 09:02:57 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 099c0646ea7282d232219f8807883be0 (476 x Formbook, 210 x Loki, 107 x AgentTesla)
ssdeep 24576:FTkRIKN7TaTxMgK8oVhRCyRg4YmcVOomJ+cHzlpABsF324yHAsP:lW/BsxM98o5C54Y8o7OzA2C
Threatray 180 similar samples on MalwareBazaar
TLSH 5A7533B3ACC94E2FD8161937459A654D7AFCF993531100532B2FAF222D8D72FE3A6201
Reporter abuse_ch
Tags:BitRAT exe RAT


Avatar
abuse_ch
BitRAT C2:
79.134.225.75:7739

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
79.134.225.75:7739 https://threatfox.abuse.ch/ioc/58213/

Intelligence

File Origin
# of uploads :
2
# of downloads :
137
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
slip.exe
Verdict:
Malicious activity
Analysis date:
2021-05-25 08:25:27 UTC
Tags:
installer trojan bitrat rat
Link:
https://app.any.run/tasks/52a1debd-e3b3-4915-896e-fe0645a31977

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/161784/
Detection(s):
PUA.Win.Trojan.Casino-141
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a file
Creating a file in the %AppData% subdirectories
Launching a process
Creating a window
Setting a global event handler
Sending a UDP request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Setting a global event handler for the keyboard
Sending a TCP request to an infection source
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
BitRAT Xmrig
Create hunting rule
Detection:
malicious
Classification:
troj.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/791331
Signature
Contains functionality to hide a thread from the debugger
Contains functionality to inject code into remote processes
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Dridex Process Pattern
Sigma detected: Suspicious Svchost Process
System process connects to network (likely due to code injection or exploit)
Writes to foreign memory regions
Yara detected BitRAT
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 423737 Sample: slip.exe Startdate: 25/05/2021 Architecture: WINDOWS Score: 100 35 Multi AV Scanner detection for submitted file 2->35 37 Yara detected BitRAT 2->37 39 Yara detected Xmrig cryptocurrency miner 2->39 41 3 other signatures 2->41 7 slip.exe 1 23 2->7         started        10 dsvri.exe 18 2->10         started        process3 file4 25 C:\Users\user\AppData\Roaming\...\dsvri.exe, PE32 7->25 dropped 27 C:\Users\user\AppData\Local\...\System.dll, PE32 7->27 dropped 13 slip.exe 19 7->13         started        17 svchost.exe 7->17         started        29 C:\Users\user\AppData\Local\...\System.dll, PE32 10->29 dropped 47 Multi AV Scanner detection for dropped file 10->47 49 Machine Learning detection for dropped file 10->49 51 Writes to foreign memory regions 10->51 53 Maps a DLL or memory area into another process 10->53 19 svchost.exe 10->19         started        signatures5 process6 file7 31 C:\Users\user\AppData\Local\...\System.dll, PE32 13->31 dropped 55 Writes to foreign memory regions 13->55 57 Maps a DLL or memory area into another process 13->57 21 svchost.exe 1 13->21         started        59 Contains functionality to inject code into remote processes 17->59 61 Contains functionality to hide a thread from the debugger 17->61 63 Hides threads from debuggers 19->63 signatures8 process9 dnsIp10 33 79.134.225.75, 49745, 49749, 49750 FINK-TELECOM-SERVICESCH Switzerland 21->33 43 System process connects to network (likely due to code injection or exploit) 21->43 45 Hides threads from debuggers 21->45 signatures11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a9b4758c091b653468bcfe33b2262f282589e0e5c52c02120b215a4bc6109d6a/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vg2hldajdnsti2f47yz3ejrpfasytyhfyuwaeeqlefnexrqqtvva._file
Verdict:
malicious
Similar samples:
083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89
BitRAT
1759dd8f52a3e1e13c8b23adff5c8f2d0db25d9fe60abf25acb607103924e7a3
BitRAT
1d64c9836f3e45a4083774fa75ef8b1ca9be4b85561ec12608a10570734f3725
BitRAT
2d5a9858f39c976a0e10ce4b8f1d05ad7bd1fe0872151ef43df402ebce15b46b
BitRAT
352079b5516356dae554a0373e989019253b4ccc75975ddf7962e6ce17d47f4e
BitRAT
777a8e5ae3342940c8f95e98a46d5b9bde8a431692f91b9b26d265034d6f41a1
BitRAT
a9133df8b9feede980d560c44b754298fc751da2ea00909ed2375f396ed3e813
BitRAT
a9c5029521e6d748545aabc303731f7df321976c956a43c971428b123e3c849f
BitRAT
d6ec5d9dbff79fbd96cf26d533feabb9c77087fc59be1d7b6f74d196b26d19cd
BitRAT
f902d7a9a985e2488fc770e265cec8fcaffb1848c4cd506a67e03b2f20484281
BitRAT
+ 170 additional samples on MalwareBazaar
Result
Malware family:
xenarmor
Create hunting rule
Score:
  10/10
Tags:
family:xenarmor password persistence recovery spyware stealer upx
Link:
https://tria.ge/reports/210525-jjmnrp42c2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Reads data files stored by FTP clients
Reads local data of messenger clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Executes dropped EXE
UPX packed file
ACProtect 1.3x - 1.4x DLL software
XenArmor Suite
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a9b4758c091b653468bcfe33b2262f282589e0e5c52c02120b215a4bc6109d6a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Email_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Email in files like avemaria
Rule name:MALWARE_Win_BitRAT
Create hunting rule
Author:ditekSHen
Description:Detects BitRAT RAT
Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/161784/

Comments