MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e312af68203fd80a2dd86a69460941ce29709424310abffd66fd7323a2b8ef6e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

BitRAT

Vendor detections: 11

Intelligence 11 IOCs 3 YARA File information Comments

SHA256 hash:	e312af68203fd80a2dd86a69460941ce29709424310abffd66fd7323a2b8ef6e
SHA3-384 hash:	4671ae6f5349c3ac00d27f656bf53fe858cf654815867916023bd013e96ba2659ea51618e10fb1b95e15b4f1ce6b7e02
SHA1 hash:	d992d4c7ff035d4dc730620924625d58be4bd4a6
MD5 hash:	e5cf31523f01f3791bf0d2dbf2a232c4
humanhash:	xray-early-mockingbird-friend
File name:	e5cf31523f01f3791bf0d2dbf2a232c4.exe
Download:	download sample
Signature	BitRAT Create hunting rule
File size:	184'320 bytes
First seen:	2021-09-29 03:31:20 UTC
Last seen:	2021-11-25 12:23:58 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	d34c2e9386a3eb95da4c6fd4346f4c9d (4 x ArkeiStealer, 3 x RedLineStealer, 1 x CoinMiner)
ssdeep	3072:AjkQUZ8zPRPLEAjvbgO+kv03cFGf8BzrcPI1ZeVPr8EuSzQz:AjwibDgO+kvmcFo0cPI1KPtuSzC
Threatray	4'974 similar samples on MalwareBazaar
TLSH	T1B704AE00BD98D2B1C701017E6825CAECD52EB9ACFFE066772B6426DFEE783A37511251
File icon (PE):
dhash icon	4839b234e8c38890 (121 x RaccoonStealer, 54 x RedLineStealer, 51 x ArkeiStealer)
Reporter	abuse_ch
Tags:	BitRAT exe RAT

abuse_ch

BitRAT C2:
193.56.146.60:18243

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
193.56.146.60:18243	https://threatfox.abuse.ch/ioc/227509/
http://185.215.113.13/g4MbvE/index.php	https://threatfox.abuse.ch/ioc/227531/
65.108.23.97:1234	https://threatfox.abuse.ch/ioc/227665/

Intelligence

File Origin

# of uploads :

# of downloads :

132

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

e5cf31523f01f3791bf0d2dbf2a232c4.exe

Verdict:

Suspicious activity

Analysis date:

2021-09-29 03:35:48 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/584461a1-3897-4127-a9e8-cdb94bc272fe

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Sharik

Link:

https://www.capesandbox.com/analysis/192763/

Detection(s):

SecuriteInfo.com.Variant.Fragtor.26425.29691.27045.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/fd4ce0f3-d397-46d1-9155-28539048cf28

Result

Threat name:

RedLine SmokeLoader Tofsee

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/860510

Signature

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains very large array initializations

.NET source code references suspicious native API functions

Antivirus detection for dropped file

Antivirus detection for URL or domain

Benign windows process drops PE files

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Contains functionality to inject code into remote processes

Contains functionality to register a low level keyboard hook

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Hides threads from debuggers

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Maps a DLL or memory area into another process

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sigma detected: Copying Sensitive Files with Credential Data

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Uses known network protocols on non-standard ports

Yara detected AntiVM3

Yara detected RedLine Stealer

Yara detected SmokeLoader

Yara detected Tofsee

Yara detected UAC Bypass using CMSTP

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e312af68203fd80a2dd86a69460941ce29709424310abffd66fd7323a2b8ef6e/

Threat name:

Win32.Trojan.Racealer

Status:

Malicious

First seen:

2021-09-29 03:32:05 UTC

AV detection:

26 of 45 (57.78%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=4mjk62bah7mauloynjuumckbzyuxbfbegefl77lg7vzshivy55xa._file

Verdict:

malicious

Result

Malware family:

xmrig

Score:

10/10

Tags:

family:arkei family:raccoon family:redline family:smokeloader family:tofsee family:xmrig botnet:5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4 botnet:777777 botnet:z0rm1onbuild agilenet backdoor discovery evasion infostealer miner persistence spyware stealer suricata themida trojan upx

Link:

https://tria.ge/reports/210929-d3mmvsdfbj/

Behaviour

Checks SCSI registry key(s)

Delays execution with timeout.exe

Modifies data under HKEY_USERS

Modifies system certificate store

Suspicious behavior: CmdExeWriteProcessMemorySpam

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Views/modifies file attributes

Enumerates physical storage devices

Program crash

Drops file in Windows directory

Launches sc.exe

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Checks installed software on the system

Checks whether UAC is enabled

Enumerates connected drives

Checks BIOS information in registry

Deletes itself

Drops startup file

Loads dropped DLL

Obfuscated with Agile.Net obfuscator

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Themida packer

Windows security modification

Creates new service(s)

Downloads MZ/PE file

Executes dropped EXE

Modifies Windows Firewall

Sets service image path in registry

UPX packed file

Arkei Stealer Payload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Nirsoft

XMRig Miner Payload

Arkei

Modifies Windows Defender Real-time Protection settings

Raccoon

RedLine

RedLine Payload

SmokeLoader

Tofsee

Turns off Windows Defender SpyNet reporting

Windows security bypass

suricata: ET MALWARE Amadey CnC Check-In

suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

suricata: ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download)

suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt

xmrig

Malware Config

C2 Extraction:

http://naghenrietti1.top/
http://kimballiett2.top/
http://xadriettany3.top/
http://jebeccallis4.top/
http://nityanneron5.top/
http://umayaniela6.top/
http://lynettaram7.top/
http://sadineyalas8.top/
http://geenaldencia9.top/
http://aradysiusep10.top/
92.246.89.6:38437
45.156.21.209:56326
193.56.146.60:18243