MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 adced62cc3699104fccf02298ae0743e49f11c51bbd6ebea524a785ec82cb5a1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BitRAT


Vendor detections: 11


Intelligence 11 IOCs 1 YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: adced62cc3699104fccf02298ae0743e49f11c51bbd6ebea524a785ec82cb5a1
SHA3-384 hash: 69ff3451595aff1f05f00684fe68e6d931826ebbbb7220af5e18c0850b14da2f9cb3d69ce6b970944bcea9991f96cfbb
SHA1 hash: b5a4abcb51121714de299ae59696b5bcf3c5f969
MD5 hash: ac3e25e9f7caf0de7997d66b4e746e84
humanhash: oranges-east-network-solar
File name:AC3E25E9F7CAF0DE7997D66B4E746E84.exe
Download: download sample
Signature BitRAT
Create hunting rule
File size:3'943'424 bytes
First seen:2021-09-02 03:26:46 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 71955ccbbcbb24efa9f89785e7cce225 (57 x BitRAT)
ssdeep 98304:877Pmq33rE/JDLPWZADUGer7B6iY74M/jmlwXVZaFB:K+R/eZADUXR
Threatray 456 similar samples on MalwareBazaar
TLSH T1B906CF02FA46C562D2170230E96E77BE053CF9354B2085C3B3946E6859B66D17A3BF3B
Reporter abuse_ch
Tags:BitRAT exe RAT


Avatar
abuse_ch
BitRAT C2:
45.76.189.89:5555

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
45.76.189.89:5555 https://threatfox.abuse.ch/ioc/209020/

Intelligence

File Origin
# of uploads :
1
# of downloads :
178
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
AC3E25E9F7CAF0DE7997D66B4E746E84.exe
Verdict:
Malicious activity
Analysis date:
2021-09-02 03:27:50 UTC
Tags:
trojan bitrat rat
Link:
https://app.any.run/tasks/38f01950-9e9f-4a0d-b278-568171ccae0f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
BitRAT
Create hunting rule
Link:
https://www.capesandbox.com/analysis/184637/
Detection(s):
Win.Malware.Mikey-9819889-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Setting a global event handler
Connection attempt
Sending a custom TCP request
Sending a UDP request
Setting a global event handler for the keyboard
Malware family:
BitRAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/02f9788f-c52f-4bb9-8d62-486f7d935b6d
Result
Threat name:
BitRAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/843750
Signature
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Found malware configuration
Hides threads from debuggers
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Uses dynamic DNS services
Yara detected BitRAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/adced62cc3699104fccf02298ae0743e49f11c51bbd6ebea524a785ec82cb5a1/
Threat name:
Win32.Backdoor.ParalaxRat
Create hunting rule
Status:
Malicious
First seen:
2021-09-02 03:27:07 UTC
AV detection:
35 of 45 (77.78%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vxhnmlgdngiqj7gpaiuyvyduhze7chcrxplox2ssjj4f5sbmwwqq._file
Verdict:
malicious
Similar samples:
03957e1a76e380308206465031a99a1db9e7afce4b82e021f0f8f94888b791b2
BitRAT
0b6efdd0f3f4dddee58af21631051999c5e9d7968a3ba2e7a34388c42375a457
BitRAT
0eaeab189b978e9babdb4324c22d4bb708e3b33c0016f52e37aa66efae4a310e
BitRAT
185d25898a718d3e3ff6d12a3ad18f12734c73859ed4ff1993ce1e4a011485f2
BitRAT
2dfe2bfefe91c1209836e4017cb2a3bb001a6de6314545f8a8eb6794a2adc204
BitRAT
4bddc1b65b7a24af3d24bddcd3722811775f3f98a65fbc433c762e1615af28c1
BitRAT
6e2510a76f130a0a009432183ed26d35d328cf34e8b4c9655327a9a8a89b8dd7
BitRAT
b4f128cdd69eb21d1de98b00303e01258993fe7fba7467aa8ab642df03ffd890
BitRAT
c3e53e28198dfe92caa7b46355f543dd18c0353ef42f2e28862682a79e863735
BitRAT
+ 446 additional samples on MalwareBazaar
Result
Malware family:
bitrat
Create hunting rule
Score:
  10/10
Tags:
family:bitrat suricata
Link:
https://tria.ge/reports/210902-ll7ac2ew9x/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
Unpacked files
SH256 hash:
adced62cc3699104fccf02298ae0743e49f11c51bbd6ebea524a785ec82cb5a1
MD5 hash:
ac3e25e9f7caf0de7997d66b4e746e84
SHA1 hash:
b5a4abcb51121714de299ae59696b5bcf3c5f969
Link:
https://www.unpac.me/results/42e375ab-67bc-4025-96c5-1291b0fcf8ab/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/adced62cc3699104fccf02298ae0743e49f11c51bbd6ebea524a785ec82cb5a1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_BitRAT
Create hunting rule
Author:ditekSHen
Description:Detects BitRAT RAT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/184637/

Comments