MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c482ebed5672bdbc0cca51b79bbb7babaa82a678142d981a7dd009ad813c20d7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BitRAT


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c482ebed5672bdbc0cca51b79bbb7babaa82a678142d981a7dd009ad813c20d7
SHA3-384 hash: 93b8e59abe93e9da7d6ffac0f5675306e87db11af58390c731987fccbacdef30148ff6fd5ab06872d8ffbfd1e6455bbc
SHA1 hash: 1c291d536eb64bce28094c0940e24985596ae992
MD5 hash: d0946249b861c18765875f25655f19ed
humanhash: ink-spaghetti-fourteen-fifteen
File name:d0946249b861c18765875f25655f19ed.exe
Download: download sample
Signature BitRAT
Create hunting rule
File size:5'138'644 bytes
First seen:2021-02-26 07:53:02 UTC
Last seen:2021-02-28 07:13:32 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash d6ac9616587efac71db41aa72947d988 (6 x BitRAT, 1 x QuasarRAT)
ssdeep 98304:YuWNQ0kKDhLa1xecuMJWJ4qnP6x0V2ucdIlpzJwkU2V:diQ0Nirvk2qSxHyzJwkn
Threatray 100 similar samples on MalwareBazaar
TLSH 4936E023AE049FE0EA4309F50A469949BA40741DD49FFD8768859608D23F9C7F4FF7A8
Reporter abuse_ch
Tags:BitRAT exe RAT


Avatar
abuse_ch
BitRAT C2:
185.157.161.223:1973

Intelligence

File Origin
# of uploads :
3
# of downloads :
147
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
dogovor.doc
Verdict:
Malicious activity
Analysis date:
2021-02-26 06:40:10 UTC
Tags:
exploit CVE-2017-11882 loader
Link:
https://app.any.run/tasks/2378726e-0499-47e5-8011-37e1f2f090e3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
BitRAT
Create hunting rule
Link:
https://www.capesandbox.com/analysis/119360/
Detection(s):
SecuriteInfo.com.Variant.Johnnie.311909.27980.9255.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %AppData% subdirectories
Unauthorized injection to a recently created process
Setting a global event handler
Sending a UDP request
Sending a custom TCP request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Setting a global event handler for the keyboard
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
BitRAT Xmrig
Create hunting rule
Detection:
malicious
Classification:
troj.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/619482
Signature
Contain functionality to detect virtual machines
Contains functionality to hide a thread from the debugger
Contains functionality to inject code into remote processes
Creates files in alternative data streams (ADS)
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected BitRAT
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c482ebed5672bdbc0cca51b79bbb7babaa82a678142d981a7dd009ad813c20d7/
Threat name:
Win32.Trojan.Strictor
Create hunting rule
Status:
Malicious
First seen:
2021-02-26 07:53:06 UTC
File Type:
PE (Exe)
Extracted files:
17
AV detection:
21 of 24 (87.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ysbox3kwok63ydgkkg3zxo33vovifjtycqwzqgt52ae23aj4edlq._file
Verdict:
malicious
Similar samples:
16d2779eb519c6c58ac8e4b95595737f9f71f37bf214d6220036abf0fe7908b6
BitRAT
360dc7aa2889b1ed05b553eccab73348de2fae89cd7742e64422712298b670ca
BitRAT
533aa4375a4eac85feb6d0ab962c38a68775ed412d056ed12535605fd5c1f415
BitRAT
68087284713cf5b3080650a0f37fa67db5eff1b18c7cac032e0fa0c19752c118
BitRAT
6c212901b861bddfecd68559ceecc3a35898d965b4e56aeb67febbfa65dc9d52
BitRAT
6c2a2251861a6d2701814843fadac940cf4d34db9f446f0698352fd866b31739
BitRAT
7277f1d3ddf844d18b2b0f95b620c8617736ad6703234fee2cb46299590180fe
BitRAT
a294e980bb7b7e74981a67379dd4c589803d0d5c17946b3b00ce561791ecfc63
BitRAT
a52ed9486d2ccdf0a9e29fe70ea7df8ddcb8bc06f9329664a310ae32d1308d6f
BitRAT
db7619d7304cbb9c7ad4bf8c74836f241aecac1fda067f3ffadadf7ee6d44930
BitRAT
+ 90 additional samples on MalwareBazaar
Result
Malware family:
bitrat
Create hunting rule
Score:
  10/10
Tags:
family:bitrat persistence trojan upx
Link:
https://tria.ge/reports/210226-qb8afakxv2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
UPX packed file
BitRAT
BitRAT Payload
Unpacked files
SH256 hash:
37c01202caeee2ec8f93708e5be0163b25a1c9872b8cac1b8308442e7fd1265e
MD5 hash:
5bcaf4d960b73ef5e5b93fc8aabbf7e3
SHA1 hash:
76e16be57fd17dcb17c413152738afc21ee1b2f9
Link:
https://www.unpac.me/results/9f9fbbc8-7969-4af9-b22d-b5c724e3621c/
SH256 hash:
c482ebed5672bdbc0cca51b79bbb7babaa82a678142d981a7dd009ad813c20d7
MD5 hash:
d0946249b861c18765875f25655f19ed
SHA1 hash:
1c291d536eb64bce28094c0940e24985596ae992
Link:
https://www.unpac.me/results/9f9fbbc8-7969-4af9-b22d-b5c724e3621c/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Email_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Email in files like avemaria
Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:MALWARE_Win_BitRAT
Create hunting rule
Author:ditekSHen
Description:Detects BitRAT RAT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

BitRAT

Executable exe c482ebed5672bdbc0cca51b79bbb7babaa82a678142d981a7dd009ad813c20d7

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1031102/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/119360/

Comments