MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bb534b16e60c7e9dac99750bb42d8c7c033c94c39bc59ce818266b6ba8f8752a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

BitRAT

Vendor detections: 9

Intelligence 9 IOCs YARA 1 File information Comments 1

SHA256 hash:	bb534b16e60c7e9dac99750bb42d8c7c033c94c39bc59ce818266b6ba8f8752a
SHA3-384 hash:	04d571371f816a90f9e83a75fad4bf7a7417b239d08eebcf5c63a963b1535840400240310800d8216d62c9c26348481b
SHA1 hash:	8fdbf63113c549be2b02913fa652f5c34c7fdd99
MD5 hash:	e7c0b56dd1a23c604dfef02fde250715
humanhash:	romeo-carpet-fanta-delaware
File name:	e7c0b56dd1a23c604dfef02fde250715
Download:	download sample
Signature	BitRAT Create hunting rule
File size:	1'722'880 bytes
First seen:	2021-09-21 08:59:56 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	3c935a80613bb38675ee523829e64ef7 (1 x ArkeiStealer, 1 x BitRAT)
ssdeep	24576:9uLJS4WdZRCVaK3qjJwIcjIjPwmro30z9jaj/W/GGR/M+oNsW87C7QH/VDOBh7:9uPKRiGJbcjuwMoEtGGlMBNFi1H/J0h
Threatray	503 similar samples on MalwareBazaar
TLSH	T111852220BB84D03BE1E766F45579C3A9A52E7E705B3C50CBE2D02BDE46286F4AC30657
File icon (PE):
dhash icon	5052b0e068696c46 (1 x RaccoonStealer, 1 x BitRAT)
Reporter	zbetcheckin
Tags:	32 BitRAT exe

Intelligence

File Origin

# of uploads :

# of downloads :

197

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

e7c0b56dd1a23c604dfef02fde250715

Verdict:

Suspicious activity

Analysis date:

2021-09-21 09:05:11 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/6fc29977-4ea2-4ad2-b7b3-7af2d9fea599

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/189811/

Detection(s):

Win.Packed.Generic-9893540-0

Win.Packed.Raccoon-9893961-1

Win.Packed.Generic-9894053-0

Win.Packed.Generic-9894122-0

Win.Packed.Generic-9894125-0

Win.Packed.Ransomx-9894271-0

Win.Malware.Raccoon-9894280-1

Win.Malware.Raccoon-9894356-1

Win.Dropper.Stop-9894748-0

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/4e09bff6-0e3c-4dd5-a955-b880ad8aed28

Result

Threat name:

BitRAT

Detection:

malicious

Classification:

troj.evad

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/854703

Signature

C2 URLs / IPs found in malware configuration

Found malware configuration

Hides threads from debuggers

Injects a PE file into a foreign processes

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Yara detected BitRAT

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bb534b16e60c7e9dac99750bb42d8c7c033c94c39bc59ce818266b6ba8f8752a/

Threat name:

Win32.Trojan.Azorult

Status:

Malicious

First seen:

2021-09-17 17:24:52 UTC

AV detection:

25 of 28 (89.29%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xnjuwfxgbr7j3lezouf3ilmmpqbtzfgdtpczz2ayezvwxkhyouva._file

Verdict:

malicious

BitRAT

29dd2b13f081a0c7f8312c4b4c433ccdcc3b3a83b91a16a88393370dda44f60b

BitRAT

3a3ff370dac609a17ea67e35e81a3b82702afe6660bb3439a489ff8f4350d607

BitRAT

8d3637cd959d0ea44c713b76b6ad46614b8f91a58398cad0f5929cf179cf9e80

BitRAT

b4a79b7fac8b571454b8d2373623a9fa825c1bc2ef6d1370b831782237d24984

BitRAT

b610d1ae855f79028cabdbd3c1160bc330ef68a7f30ab5544d00b09af341cc68

BitRAT

bf6b69cb7063d748e6404300ed8b587473b20b2239605862ccbec909bccf7485

BitRAT

dcb73a0ea23548167bd5724418377fe1e8c88f1be3125c0df6cc89722bb26f33

BitRAT

fd1dfd46f65c7c958e81931c7a47de00166f9ac5527ebd6b7742cf6e8b6de2de

BitRAT

+ 493 additional samples on MalwareBazaar

Result

Malware family:

bitrat

Score:

10/10

Tags:

family:bitrat trojan upx

Link:

https://tria.ge/reports/210921-kycqesbfbn/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

UPX packed file

BitRAT

BitRAT Payload

Unpacked files

SH256 hash:

0bbf11f08a44e759ff450759113eda6394eb94b4f8f1a023f7124f23267003b0

MD5 hash:

6894034ce3600b5f726504c7ddf20c87

SHA1 hash:

bbe19e4cf5d3e5c8c53889c688a05b7129f5f9c0

Link:

https://www.unpac.me/results/b603254b-cc94-4568-bb8a-c7002763e6dc/

SH256 hash:

bb534b16e60c7e9dac99750bb42d8c7c033c94c39bc59ce818266b6ba8f8752a

MD5 hash:

e7c0b56dd1a23c604dfef02fde250715

SHA1 hash:

8fdbf63113c549be2b02913fa652f5c34c7fdd99

Link:

https://www.unpac.me/results/b603254b-cc94-4568-bb8a-c7002763e6dc/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/bb534b16e60c7e9dac99750bb42d8c7c033c94c39bc59ce818266b6ba8f8752a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.