MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c074b02a7c31f653ce16773fe3d97884a5d4cefed346918b79db7f060661f9f0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BitRAT


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c074b02a7c31f653ce16773fe3d97884a5d4cefed346918b79db7f060661f9f0
SHA3-384 hash: 49e897565d4da7781517210c6038f5e52d60fcd1178b018aa265a17df536bec5484682506169591853cd346d5d54816b
SHA1 hash: 28d261bf8f37944007b61b37a24e8b79e4821db3
MD5 hash: 1e06aeba99c329ca66985146d3422a58
humanhash: single-green-solar-quebec
File name:eryyeye.exe
Download: download sample
Signature BitRAT
Create hunting rule
File size:7'993'344 bytes
First seen:2020-11-12 08:07:33 UTC
Last seen:2024-07-24 21:07:03 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash ee29d956202a00089af753de40f7f116 (2 x BitRAT, 1 x NanoCore)
ssdeep 196608:imxljesxwhzav1yo31CPwDv3uFZjeg2EeJUO9WLQUDxtw3iFFrS6XOfTV73c:bblxwZ6v1CPwDv3uFteg2EeJUO9WLjDu
Threatray 26 similar samples on MalwareBazaar
TLSH 7086DF4174918D6FD5562238CAAFA737213CF6A00B33CBC36B546A3D4E62EC12E76B15
Reporter JoulK
Tags:BitRAT exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
121
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.Upolyx-12
Create hunting rule

PUA.Win.Packer.Upx-49
Create hunting rule

PUA.Win.Packer.UpxProtector-1
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
DNS request
Creating a file
Creating a process from a recently created file
Creating a process with a hidden window
Moving a recently created file
Sending a custom TCP request
Deleting a recently created file
Setting a global event handler
Delayed writing of the file
Replacing files
Setting a global event handler for the keyboard
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
BitRAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/532130
Signature
Hides threads from debuggers
Machine Learning detection for sample
May check the online IP address of the machine
May use the Tor software to hide its network traffic
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected BitRAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c074b02a7c31f653ce16773fe3d97884a5d4cefed346918b79db7f060661f9f0/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-11-12 08:08:06 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yb2lakt4gh3fhtqwo476hwlyqss5jtx62ndjdc3z3n7qmbtb7hya._file
Verdict:
unknown
Similar samples:
23cfbb0bf1e110a79678f45c29897e6090b660d3df420bbb916fc3f1bc12eead
BitRAT
38a36c357a50c0f3d6ba6cbaa600507d485271ac452212850dff78f1a430f9e1
BitRAT
4e4cd19c835a2fafb63df3429c6db21507e34fcb33c3072c93f28fb4fc32967b
BitRAT
6269fd417f93e7c0d7cab576b35dc3b6f6a58c0f04e75533bad84987c228f0e6
BitRAT
723e6b54cd996205412396bbfba18171a8e4e7297dd2492b35ec198e122849cb
BitRAT
75fa551eec71d6d8b9817266813715c2bbb7a537005587f9f1e0d058a05febc6
BitRAT
7eed0a7abb529f2d7208babe7ab96ea673878fad3fcd7779340b4d6dc3d8468e
BitRAT
7faef4d80d1100c3a233548473d4dd7d5bb570dd83e8d6e5faff509d6726baf2
BitRAT
83db3e008537b9da1f048cf2a36931238afcdabf35ecbeedecd808ea6bee3bf3
BitRAT
c829aa312e2ea1c043566e26517b2bf90e9c12ed68e9d7d24577ebc13f2cf3b1
BitRAT
+ 16 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
upx
Link:
https://tria.ge/reports/201112-wynhwpbm6j/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Looks up external IP address via web service
Loads dropped DLL
Executes dropped EXE
UPX packed file
Unpacked files
SH256 hash:
c074b02a7c31f653ce16773fe3d97884a5d4cefed346918b79db7f060661f9f0
MD5 hash:
1e06aeba99c329ca66985146d3422a58
SHA1 hash:
28d261bf8f37944007b61b37a24e8b79e4821db3
Detections:
win_bit_rat_w0
Create hunting rule
Link:
https://www.unpac.me/results/30456440-0500-46e0-b2f7-cfa7fe0d2ef4/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:win_bit_rat_w0
Create hunting rule
Author:KrabsOnSecurity
Description:String-based rule for detecting BitRAT malware payload

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

BitRAT

Executable exe c074b02a7c31f653ce16773fe3d97884a5d4cefed346918b79db7f060661f9f0

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/810002/

Comments