MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d72f60a529f8e6785ce5ca2b781a9a42c951469de5019fadaae5919c36346868. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BitRAT


Vendor detections: 9


Intelligence 9 IOCs 1 YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d72f60a529f8e6785ce5ca2b781a9a42c951469de5019fadaae5919c36346868
SHA3-384 hash: e4f0e1a485ca8631b9bcd11b7888f2bff2579f624686a0b0f157af784085ba2e98a9dab5d42276ed856b6ad1286a223b
SHA1 hash: ac3da8d003ea4d6ec2f5133d4d466fb09baeba56
MD5 hash: 6db6014bde65859667fd064b10e22bba
humanhash: king-twelve-muppet-equal
File name:RazerK.exe
Download: download sample
Signature BitRAT
Create hunting rule
File size:1'560'576 bytes
First seen:2022-02-01 17:31:17 UTC
Last seen:2022-02-01 20:20:33 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:9PEBmrEBmfEBmOcM3b+5uvgTykfZQQlfQHdqCcc5EPJsgJS9htvfUs2gRaH8sOz8:9PEBmrEBmfEBmvM3bYHWu6QlfQHdCPJX
Threatray 1'712 similar samples on MalwareBazaar
TLSH T1F975E06EE4E34518FD2E1275422B90001FFE3E305423D35AB4A7B3995AF5FA146A27E3
Reporter abuse_ch
Tags:BitRAT exe RAT


Avatar
abuse_ch
BitRAT C2:
20.112.83.244:2222

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
20.112.83.244:2222 https://threatfox.abuse.ch/ioc/374010/

Intelligence

File Origin
# of uploads :
2
# of downloads :
185
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/229274/
Detection(s):
SecuriteInfo.com.Variant.Lazy.111955.5523.1705.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Сreating synchronization primitives
Sending a custom TCP request
Launching a process
Creating a file
Setting a global event handler
Forced shutdown of a system process
Setting a global event handler for the keyboard
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
obfuscated packed update.exe
Link:
https://www.filescan.io/uploads/61f96e9da0f6a794b3310251/reports/ac51223d-0d76-4398-bdda-b10336665253/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/abaf2850-b02e-4c7b-97e1-b79152dca5a7
Result
Threat name:
BitRAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/931905
Signature
.NET source code contains potential unpacker
Allocates memory in foreign processes
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Writes to foreign memory regions
Yara detected BitRAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d72f60a529f8e6785ce5ca2b781a9a42c951469de5019fadaae5919c36346868/
Threat name:
ByteCode-MSIL.Trojan.KryptikAGen
Create hunting rule
Status:
Malicious
First seen:
2022-02-01 17:32:14 UTC
File Type:
PE (.Net Exe)
Extracted files:
22
AV detection:
22 of 28 (78.57%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=24xwbjjj7dthqxhfzivxqgu2ilevcru54uaz7lnk4wizynrunbua._file
Verdict:
malicious
Similar samples:
3a3ff370dac609a17ea67e35e81a3b82702afe6660bb3439a489ff8f4350d607
BitRAT
7d57902ed9cc59fc539984a27e96e6310b42f1cd3ae1206c0d3505ab0d062f1f
BitRAT
881003326302ab243f71138e2e39517677c9117fd73e50f8989ee9b39e86407b
BitRAT
8d3637cd959d0ea44c713b76b6ad46614b8f91a58398cad0f5929cf179cf9e80
BitRAT
921f2ab9efbdf8b31267044ad0090666510f22d740d55aeeef27262c89e7a5e3
BitRAT
ad29674b1a2bcc3ff4ef5746d9317740ab72b016ee3b89ac9aa9871bcb378b6b
BitRAT
d022bbc1f478e3302c250cc39e727f11621304736c0c1dfb607110e28d5824e4
BitRAT
f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736
BitRAT
+ 1'702 additional samples on MalwareBazaar
Result
Malware family:
bitrat
Create hunting rule
Score:
  10/10
Tags:
family:bitrat trojan upx
Link:
https://tria.ge/reports/220201-v4ahcsadd4/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Downloads MZ/PE file
UPX packed file
BitRAT
Malware Config
C2 Extraction:
zopp.nerdpol.ovh:2222
Unpacked files
SH256 hash:
d72f60a529f8e6785ce5ca2b781a9a42c951469de5019fadaae5919c36346868
MD5 hash:
6db6014bde65859667fd064b10e22bba
SHA1 hash:
ac3da8d003ea4d6ec2f5133d4d466fb09baeba56
Link:
https://www.unpac.me/results/d11179b3-318a-46b1-ab14-5f1158ab3f0c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/d72f60a529f8e6785ce5ca2b781a9a42c951469de5019fadaae5919c36346868

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_DiscordURL
Create hunting rule
Author:ditekSHen
Description:Detects executables Discord URL observed in first stage droppers
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_Encoded_Discord_Attachment_Oct21_1
Create hunting rule
Author:Florian Roth
Description:Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN)
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/229274/

Comments