MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e7f018a097a4041995e6d95f9de421d36605140b3c648e1c46af0a0df08b3aef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

BitRAT

Vendor detections: 5

Intelligence 5 IOCs YARA 2 File information Comments

SHA256 hash:	e7f018a097a4041995e6d95f9de421d36605140b3c648e1c46af0a0df08b3aef
SHA3-384 hash:	3930ad793d9c4d2ae2b484f785d73978ab52dd198c3e522dad566352d07f715b3bb2695dab5ad323f0ffeff943029b23
SHA1 hash:	054ce24e6674b19477fce3e158b2cc881c2881d9
MD5 hash:	cad70078636cc2bc01019e66c90c8144
humanhash:	maine-low-queen-equal
File name:	cad70078636cc2bc01019e66c90c8144.exe
Download:	download sample
Signature	BitRAT Create hunting rule
File size:	1'768'374 bytes
First seen:	2020-10-22 08:32:41 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	7c2c71dfce9a27650634dc8b1ca03bf0 (160 x Loki, 58 x Formbook, 55 x Adware.Generic)
ssdeep	49152:UBJq9nDtT+dw9iasNI4mTc+oQ1SR5LjVQIxar1lzV5Qo:BJ+drN5DDj9I7V53
Threatray	308 similar samples on MalwareBazaar
TLSH	3A85331461B9846BCF44C0391DFE5DFBB2B4A52F1EAFA5B71608B24C74E78090F2C6A5
Reporter	abuse_ch
Tags:	BitRAT exe RAT

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/74598/

Detection(s):

PUA.Win.Downloader.Soft32downloader-6691270-0

PUA.Win.Adware.Browserio-6725861-0

SecuriteInfo.com.Artemis162931E90DCF.4593.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Creating a file

Sending a UDP request

Creating a file in the %AppData% subdirectories

Launching a process

Launching cmd.exe command interpreter

Deleting a recently created file

Creating a window

Setting a global event handler

Connection attempt

Forced shutdown of a system process

Unauthorized injection to a system process

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Setting a global event handler for the keyboard

Enabling autorun

Result

Threat name:

BitRAT

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/506943

Signature

Antivirus detection for dropped file

Contains functionality to hide a thread from the debugger

Contains functionality to inject code into remote processes

Creates an undocumented autostart registry key

Creates files in alternative data streams (ADS)

Hides threads from debuggers

Hijacks the control flow in another process

Maps a DLL or memory area into another process

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Tries to detect virtualization through RDTSC time measurements

Yara detected BitRAT

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e7f018a097a4041995e6d95f9de421d36605140b3c648e1c46af0a0df08b3aef/

Threat name:

Win32.Trojan.Wacatac

Status:

Suspicious

First seen:

2020-10-22 07:54:35 UTC

AV detection:

25 of 29 (86.21%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=47ybriexuqcbtfpg3fpz3zbb2ntakfalhrsi4hcgv4fa34elhlxq._file

Verdict:

unknown

Result

Malware family:

n/a

Score:

8/10

Tags:

upx persistence

Link:

https://tria.ge/reports/201022-1p6624fk9j/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of NtSetInformationThreadHideFromDebugger

Adds Run key to start application

Loads dropped DLL

Blacklisted process makes network request

UPX packed file

Unpacked files

SH256 hash:

e7f018a097a4041995e6d95f9de421d36605140b3c648e1c46af0a0df08b3aef

MD5 hash:

cad70078636cc2bc01019e66c90c8144

SHA1 hash:

054ce24e6674b19477fce3e158b2cc881c2881d9

Link:

https://www.unpac.me/results/53c4bf1a-cbf2-4246-b0f2-4456f6791b19/

SH256 hash:

358d530e6d5b48f9a57a4aaefe7b2cbbbf8d385f9e04f3745f9bb1ab292dd91b

MD5 hash:

313bc82cdc7f3253989fe738f13a028b

SHA1 hash:

fcca86e13f9555b5012fa928bc6aa08ab3b206b2

Link:

https://www.unpac.me/results/53c4bf1a-cbf2-4246-b0f2-4456f6791b19/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	suspicious_packer_section Create hunting rule
Author:	@j0sm1
Description:	The packer/protector section names/keywords
Reference:	http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/