General
-
Target
UpdateClean.js
-
Size
5KB
-
Sample
240425-1vdfjsff4x
-
MD5
d6942e22893e95deea7bbe9d9f9e2a94
-
SHA1
4d002c2b134d52d0ce8a6715e1ab75b4dd36d4d9
-
SHA256
b3bdd33dcaf6d7453e5aca839f814ba5754b7b4f5b119890c8f4a16bf149c9ad
-
SHA512
b1969093839283c68928bd38f8ee0788d85ce71272e18e59316897b223b6d94178464360d7d0e204bd78ea315bfc452607f22a4fbc30686c8439f125124d3b80
-
SSDEEP
96:rBup4W/ul47KmtSzemZYSBTJABlaxVRo/JR3Ui7RDqG1+qnA++B+k+++8H+e7it5:rBu6W/N+qS1ZjJAixVRo/JR3N7RLr+ru
Malware Config
Extracted
http://77.221.151.31/a/z.png
Extracted
http://77.221.151.31/a/s.png
Extracted
bitrat
1.38
77.221.151.31:4444
-
communication_password
7b13ff385b95cf25d53088d6b7c5d890
-
tor_process
tor
Extracted
lumma
https://strollheavengwu.shop/api
https://productivelookewr.shop/api
https://tolerateilusidjukl.shop/api
https://shatterbreathepsw.shop/api
https://shortsvelventysjo.shop/api
https://incredibleextedwj.shop/api
https://alcojoldwograpciw.shop/api
https://liabilitynighstjsko.shop/api
https://demonstationfukewko.shop/api
Targets
-
-
Target
UpdateClean.js
-
Size
5KB
-
MD5
d6942e22893e95deea7bbe9d9f9e2a94
-
SHA1
4d002c2b134d52d0ce8a6715e1ab75b4dd36d4d9
-
SHA256
b3bdd33dcaf6d7453e5aca839f814ba5754b7b4f5b119890c8f4a16bf149c9ad
-
SHA512
b1969093839283c68928bd38f8ee0788d85ce71272e18e59316897b223b6d94178464360d7d0e204bd78ea315bfc452607f22a4fbc30686c8439f125124d3b80
-
SSDEEP
96:rBup4W/ul47KmtSzemZYSBTJABlaxVRo/JR3Ui7RDqG1+qnA++B+k+++8H+e7it5:rBu6W/N+qS1ZjJAixVRo/JR3N7RLr+ru
Score10/10-
BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
-
Lumma Stealer
An infostealer written in C++ first seen in August 2022.
-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-