MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aab354a5e76026ce109b65bdf21c8d35941f0503705defa91c378106f28382ff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

BitRAT

Vendor detections: 10

Intelligence 10 IOCs YARA 3 File information Comments

SHA256 hash:	aab354a5e76026ce109b65bdf21c8d35941f0503705defa91c378106f28382ff
SHA3-384 hash:	74ab4e7827636f811cfe2997e9d5089190f28476f0b3f5fb7ea2a99f4d74647a47932eb885409eed9047e516505fd6b3
SHA1 hash:	652ca1ffbdc9f49edb0d9b97781ea74fce9c6485
MD5 hash:	8e0e7f9303562f19bd052408302c7ed7
humanhash:	may-angel-undress-nuts
File name:	8e0e7f9303562f19bd052408302c7ed7.exe
Download:	download sample
Signature	BitRAT Create hunting rule
File size:	1'832'384 bytes
First seen:	2021-06-03 09:52:11 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	7fa974366048f9c551ef45714595665e (946 x Formbook, 398 x Loki, 261 x AgentTesla)
ssdeep	49152:BDg5LE/KBPKKMf5UcKPHe6x3yv1Ox7FOvzFWCceE:xKOKBPKKMf5S2sE1Ox70bFoeE
Threatray	191 similar samples on MalwareBazaar
TLSH	C58533297ED7FDBBC9A1AB362D70C63AD6B910327357076333105F9EAD596E62C02108
Reporter	abuse_ch
Tags:	BitRAT exe RAT

Intelligence

File Origin

# of uploads :

# of downloads :

168

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

8e0e7f9303562f19bd052408302c7ed7.exe

Verdict:

Malicious activity

Analysis date:

2021-06-03 10:00:40 UTC

Tags:

installer trojan bitrat rat

Link:

https://app.any.run/tasks/512506de-f3e6-4cb5-8fb7-28aa7a1e94fe

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

BitRAT

Link:

https://www.capesandbox.com/analysis/164345/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Creating a file

Creating a file in the %AppData% subdirectories

Unauthorized injection to a recently created process

Creating a window

Setting a global event handler

Sending a custom TCP request

Sending a UDP request

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Setting a global event handler for the keyboard

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/aab354a5e76026ce109b65bdf21c8d35941f0503705defa91c378106f28382ff/

Threat name:

Win32.Trojan.SpyNoon

Status:

Malicious

First seen:

2021-06-03 08:23:40 UTC

AV detection:

20 of 47 (42.55%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=vkzvjjphmatm4ee3mw67ehengwkb6bidobo67ki4g6aqn4udql7q._file

Verdict:

malicious

Result

Malware family:

n/a

Score:

8/10

Tags:

persistence upx

Link:

https://tria.ge/reports/210603-2njq293yan/

Behaviour

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Adds Run key to start application

Loads dropped DLL

UPX packed file

Unpacked files

SH256 hash:

aab354a5e76026ce109b65bdf21c8d35941f0503705defa91c378106f28382ff

MD5 hash:

8e0e7f9303562f19bd052408302c7ed7

SHA1 hash:

652ca1ffbdc9f49edb0d9b97781ea74fce9c6485

Link:

https://www.unpac.me/results/9b51bf22-9303-4645-a45f-acd7eace3cdf/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/aab354a5e76026ce109b65bdf21c8d35941f0503705defa91c378106f28382ff

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Email_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Email in files like avemaria

Rule name:	MALWARE_Win_BitRAT Create hunting rule
Author:	ditekSHen
Description:	Detects BitRAT RAT

Rule name:	suspicious_packer_section Create hunting rule
Author:	@j0sm1
Description:	The packer/protector section names/keywords
Reference:	http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/