MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 f74f4131f6df73a2580afa842cf652393122fdcc9bcd7a88c0ea6403a96430a8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
BitRAT
Vendor detections: 9
| SHA256 hash: | f74f4131f6df73a2580afa842cf652393122fdcc9bcd7a88c0ea6403a96430a8 |
|---|---|
| SHA3-384 hash: | 7bdbd0d64b4815e24924435e00e4c076d439190425db859905d4dc79af83cb2a5b6260598fb22bdc417c83d8e111d4ee |
| SHA1 hash: | 1e47117cb1295c396a8c2c93a6a4acb149efb680 |
| MD5 hash: | 874e5764ac07c0bfd87afe60a0524b9d |
| humanhash: | december-nitrogen-massachusetts-blue |
| File name: | 874e5764ac07c0bfd87afe60a0524b9d |
| Download: | download sample |
| Signature | BitRAT |
| File size: | 2'416'640 bytes |
| First seen: | 2022-03-22 18:18:00 UTC |
| Last seen: | 2022-03-22 20:44:33 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger) |
| ssdeep | 49152:F4kduskZkROrPrv5BPNVsUU7N1g6/9A7yl3sp45wtlIRNSCMXiXd6Ce7:F4EquRO3vHlCX7XsQPvbg3 |
| Threatray | 672 similar samples on MalwareBazaar |
| TLSH | T189B5233E2054E381C8D4DA7BC4E9D5ED436CDFD1E6A3A71791C23D50287262E4299EF2 |
| File icon (PE): |  |
| dhash icon | 16174db2a88e9620 (26 x BitRAT, 16 x AsyncRAT, 9 x AveMariaRAT) |
| Reporter |  zbetcheckin |
| Tags: | 32 BitRAT exe |
Intelligence
File Origin
# of uploads :
2
# of downloads :
186
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
f74f4131f6df73a2580afa842cf652393122fdcc9bcd7a88c0ea6403a96430a8.zip
Verdict:
No threats detected
Analysis date:
2022-03-23 06:03:56 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
BitRAT
Result
Verdict:
Malware
Maliciousness:
Behaviour
Сreating synchronization primitives
Running batch commands
Creating a process with a hidden window
Launching a process
Creating a window
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
obfuscated packed
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Result
Threat name:
BitRAT
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Behaviour
Behavior Graph:
n/a
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2022-03-22 18:18:21 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
22 of 26 (84.62%)
Threat level:
5/5
Verdict:
malicious
Similar samples:
+ 662 additional samples on MalwareBazaar
Result
Malware family:
bitrat
Score:
10/10
Tags:
family:bitrat persistence trojan
Behaviour
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
BitRAT
Malware Config
C2 Extraction:
212.193.30.54:3680
Unpacked files
SH256 hash:
400a15622690d17b5f28d2bd3037f9f41a1019b0d48b59f08e28a180d51337bf
MD5 hash:
8e97db5d526887986018489acdc2d98c
SHA1 hash:
9746227bb712b463906d4bc07a70d65a13eb38d2
SH256 hash:
126d9dff7d2e4be714a5ec2526719b75961aca6ae5737e8aed7dd6341d38fec4
MD5 hash:
e8604baba04474270a3d78752a7a9da4
SHA1 hash:
f35f4a483edb4b6e099607c017bfb0e1f57835c7
SH256 hash:
8619563ffe40d2edbc22675378fe58cddf2bf454fcc7571f70584be45a395949
MD5 hash:
c651a8e0bcef5099b63ca40153acac91
SHA1 hash:
5da55e66e1d9c70c6d8e0bb3f92e0e1eb7ed943c
SH256 hash:
3c9301b834ccb20a6c2115d585cb20876486e5d4bbf2f0b4eef49adab5408561
MD5 hash:
baf55895827208a91c214009fabf0f6b
SHA1 hash:
55fa3cf589f3296b62ee7ce6cd02e3c4c3e88ecf
SH256 hash:
9657406489a55ecac93d74c3abc7c13c2f5c196d139f2562601733bc4543b38c
MD5 hash:
dbdc677ea64f6601e1235ec7d6a6d261
SHA1 hash:
d92f9d3b3cb58c454c087a78b966c59bc72bf678
SH256 hash:
f74f4131f6df73a2580afa842cf652393122fdcc9bcd7a88c0ea6403a96430a8
MD5 hash:
874e5764ac07c0bfd87afe60a0524b9d
SHA1 hash:
1e47117cb1295c396a8c2c93a6a4acb149efb680
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.url : hxxp://ddl8.data.hu/get/364900/13237812/ztstbt.exe