Loading malware…
BitRAT is a commercial remote access trojan targeting Microsoft Windows, sold on underground cybercriminal forums since 2020. It provides remote desktop and hidden virtual network computing (hVNC) access, process and service management, file transfer, and execution of additional payloads. Its hVNC implementation incorporates code derived from TinyNuke. Networking features include SOCKS5 proxying, UPnP port forwarding, and reverse SOCKS4 proxying.
BitRAT supports credential theft from browsers and other applications, keylogging, clipboard monitoring, screen surveillance, webcam access, and microphone recording. It can exfiltrate stolen information, deploy XMRig for Monero mining, and conduct DDoS attacks, including Slowloris attacks. It also includes UAC bypass and Windows Defender deactivation functionality. Analyzed variants have stored captured keystrokes and clipboard data in alternate data streams. BitRAT uses encrypted configuration data and TLS-protected command-and-control communications, including self-signed certificates.
Distribution methods include phishing and spear-phishing emails, malicious Office documents, trojanized software, watering-hole attacks, fake browser updates, and unofficial Windows activation tools. Campaigns have used financial and payment-themed documents, stolen bank customer information, and NFT-themed lures. Multistage delivery chains frequently employ obfuscated scripts, PowerShell, crypters, and loaders to execute BitRAT in memory or inject it into legitimate Windows processes. Startup-folder and registry-based mechanisms have been used to maintain access.
BitRAT is used by multiple unrelated threat actors rather than a single operator. Documented users include OPERA1ER and Blind Eagle, also known as APT-C-36. Campaigns involving BitRAT have targeted African financial institutions, South American government and commercial organizations, and German automotive businesses, alongside individual Windows users.
4 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
“With help of bitrat, 888_rat, VenomRAT, BlackNET, NanoCore or common RDP OPERA1ER made fraudulent transactions and later withdrew money from ATMs.”
“After deobfuscating the executable file within the password-protected archive, we are presented with a RAT called BitRAT.”
In some cases, the final stage PowerShell script contained up to seven various RATs. These are typically NjRat, BitRat, Nanocore RAT, QuasarRat, LimeRat, and Warzone.
all of them have been associated with off-the-shelf malware like QuasarRAT, BitRat, and similar.
63 distinct techniques documented for this family, organized by ATT&CK tactic.
T1583.003 — Acquire Infrastructure: Virtual Private Server (Resource Development)
While investigating multiple lures for BitRAT we identified that, an adversary had hijacked a Columbian cooperative bank’s infrastructure.
T1587.001 — Develop Capabilities: Malware (Resource Development)
T1588.001 — Obtain Capabilities: Malware (Resource Development)
...it can be employed in various operations, such as trojanized software, phishing and watering hole attacks.
...it can be employed in various operations, such as trojanized software, phishing and watering hole attacks.
Attachment : Payment_receipt.img (contains "Payment Confirmation Paper - Customer Copy_pdf.exe")
Hovering over the link will show that the link was generated from a URL shortener.
it decodes a command string and executes it using a WMI (Windows Management Instrumentation) object.
It then runs schtasks to create a schedule task named “calendersw” in the system “Task Scheduler“... It is also a persistence mechanism. Once it starts, back.htm adds more scheduled tasks.
2022-01-23 ⋅ forensicitguy ⋅ Tony Lambert HCrypt Injecting BitRAT using PowerShell, HTAs, and .NET
2022-01-23 ⋅ forensicitguy ⋅ Tony Lambert HCrypt Injecting BitRAT using PowerShell, HTAs, and .NET
The .inf file contains a hex encoded second stage dll payload which is decoded via certutil, written to %temp%\ and executed by rundll32.
It contains an auto-start Macro that starts using a VBA (Visual Basic Application) method called “Auto_Open()” when the Excel file is opened.
The HTML file contains a piece of JavaScript code... It creates an object, “Wscript.Shell”... In Figure 3.1 we can see it runs five command-line applications.
The code contains references to kernel32, LoadLibraryA, and GetProcAddress. These references mean the code likely imports additional native, non-.NET DLL functions at runtime for its injection operations.
Upon pressing the faux “Activate Windows 10” button, victims trigger the download of the BitRAT payload
The recipient is asked to open the email attachment named “attached picture.jpg” and use the password “foto” to view its contents.
It then runs schtasks to create a schedule task named “calendersw” in the system “Task Scheduler“... It is also a persistence mechanism. Once it starts, back.htm adds more scheduled tasks.
NFTEXE.exe copies itself as C:\Users\[username]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Adobe\Cloud.exe, which runs at every startup to maintain persistence.
The BitRAT sample starts and relocates the loader to user’s startup for persistence.
It then runs schtasks to create a schedule task named “calendersw” in the system “Task Scheduler“... It is also a persistence mechanism. Once it starts, back.htm adds more scheduled tasks.
“Once decrypted, the embedded payload is loaded into the current process or injected into a newly spawned WerFault.exe process.”
It then performs process hollowing to inject the malware payload into a newly-created process of “aspnet_compiler.exe”.
NFTEXE.exe copies itself as C:\Users\[username]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Adobe\Cloud.exe, which runs at every startup to maintain persistence.
The BitRAT sample starts and relocates the loader to user’s startup for persistence.
we were able to see that BitRAT can bypass User Account Control (UAC)
The malicious tool can perform a wide range of operations, including data exfiltration, UAC bypass...
The loaded executables are obfuscated with various techniques.
The output says the binary was packed with UPX, and we can unpack the binary using UPX in REMnux!
GetType("System.Activator").GetMethods()[2].Invoke() will be called
The downloaded file is a password-protected archive, the password for which is mentioned in the email, the email attachment, or both.
The criminals behind the campaign reportedly distribute the payloads in the guise of Windows 10 Pro license activators... The malicious file, named W10DigitalActiviation.exe, mimics a simple, one-button unofficial Windows 10 activator.
“Once decrypted, the embedded payload is loaded into the current process or injected into a newly spawned WerFault.exe process.”
It then performs process hollowing to inject the malware payload into a newly-created process of “aspnet_compiler.exe”.
After the downloader performs the operations above, it deletes itself from the infected computer in an attempt to wipe its tracks.
“After the delay, it decrypts the embedded malware payload.”
At the end of each malware code segment, the code calls the “Load()” method to load the inner .Net module... then calls the Invoke() method to invoke the “projFUD.PA.Execute()” function... with two parameters, which are an exe file’s full path and a fileless malware payload.
2022-01-23 ⋅ forensicitguy ⋅ Tony Lambert HCrypt Injecting BitRAT using PowerShell, HTAs, and .NET
The .inf file contains a hex encoded second stage dll payload which is decoded via certutil, written to %temp%\ and executed by rundll32.
The malicious tool can perform a wide range of operations, including ... clipboard monitoring, gaining unauthorized webcam access, credential theft, audio recording...
org.a6() the function will call CompareString to compare your username, with the attempt to detect the virtual machine. or.VD() the function will call Contains to compare the sample name with the attempt to detect an analysis environment.
One trait of the BitRAT sample that FortiGuard Labs analyzed is its usage of Hidden VNC (HVNC). HVNC provides an attacker with remote access to the compromised machine.
this variant of BitRAT stores collected data (keystrokes, clipboard data, etc.) in an alternate data stream (ADS) file that is majority encoded in Base64.
Sure enough, at the end of the script contents we can see [Reflection.Assembly]::Load(). This call loads the contents of the $H5 binary into memory for use. These contents are likely a .NET DLL.
configured to run at excluded from Windows Defender’s detection mechanisms
The malicious tool can perform a wide range of operations, including ... generic keylogging.
The malicious tool can perform a wide range of operations, including ... credential theft ...
It also runs taskkill to kill processes, if existing, of MS Word (WinWord.exe), MS Excel (Excel.exe), and MS Pointpoint (POWERPNT.exe).
The malicious tool can perform a wide range of operations, including ... clipboard monitoring, gaining unauthorized webcam access, credential theft, audio recording...
org.a6() the function will call CompareString to compare your username, with the attempt to detect the virtual machine. or.VD() the function will call Contains to compare the sample name with the attempt to detect an analysis environment.
...исследователи наблюдали использование LiteManager, BitRAT и вредоносов с функциональностью hVNC. Последние позволяют управлять системой через виртуальный рабочий стол, скрывая активность хакеров от пользователя.
The malicious tool can perform a wide range of operations, including ... generic keylogging.
We also found that this variant can also monitor the screen
The malicious tool can perform a wide range of operations, including ... clipboard monitoring ...
The malicious tool can perform a wide range of operations, including ... audio recording ...
The malicious tool can perform a wide range of operations, including ... gaining unauthorized webcam access ...
Password-protected archives: 7733b09b... d010ef65... 9438c974... 5cada311...
I used the REST API to manage comments on issues and pull requests... built a GitHub-specific URL to post a comment on an issue, added a Bearer token header... | As you can see, any API service can be used as a C2 and Github is not the exception.
The configuration is decrypted to the following string, as shown in Figure 11, including a command-and-control (C&C) server and a port.
Proxy – SOCKS5 Proxy: port forwarding feature using UPnP – Reverse Proxy: SOCKS4 Proxy
It uses the WinHTTP library to download BitRAT embedded payloads from GitHub to the %temp% directory.
Other BitRAT functionality includes: ... Uploading and downloading additional files to the compromised machine | It then uses a PowerShell script to download another file from Discord, NFTEXE.exe... and then pull down yet another file, NFTEXE.png, from Discord.
stores collected data (keystrokes, clipboard data, etc.) in an alternate data stream (ADS) file that is majority encoded in Base64.
Remote Control – Remote desktop – hVNC (Hidden Desktop)
The use of dynamic DNS domains for C2 communications is a central technique in the arsenal of the DDGroup actor.
When run, it connects to following C&C servers it harbors internally, exchanging encrypted strings... BitRAT provides: Encrypted communication using TLS 1.2.
sending systeminfo via legit URL. GitHub API... get systeminfo and send as comment via GitHub API logic
The malicious tool can perform a wide range of operations, including data exfiltration, UAC bypass, DDoS attacks, clipboard monitoring, gaining unauthorized webcam access, credential theft, audio recording, XMRig coin mining and generic keylogging.
The malicious tool can perform a wide range of operations, including ... XMRig coin mining ...
7. etc. – DDoS attack
After the strings were decrypted, it also became apparent that BitRAT uses Slowloris for its DDoS capabilities.
267 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
38 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.