SYMBOLCOMMON_NAMEaka. SYNONYMS
win.bit_rat (Back to overview)

BitRAT

VTCollection    

According to Bitdefender, BitRAT is a notorious remote access trojan (RAT) marketed on underground cybercriminal web markets and forums. Its price tag of $20 for lifetime access makes it irresistible to cybercriminals and helps the malicious payload spread.

Furthermore, each buyer’s modus operandi makes BitRAT even harder to stop, considering it can be employed in various operations, such as trojanized software, phishing and watering hole attacks.

BitRAT’s popularity arises from its versatility. The malicious tool can perform a wide range of operations, including data exfiltration, UAC bypass, DDoS attacks, clipboard monitoring, gaining unauthorized webcam access, credential theft, audio recording, XMRig coin mining and generic keylogging.

References
2023-09-08 ⋅ Gi7w0rm
Uncovering DDGroup — A long-time threat actor
AsyncRAT Ave Maria BitRAT DBatLoader NetWire RC Quasar RAT XWorm
2023-08-01 ⋅ Palo Alto Networks Unit 42 ⋅ Lior Rochberger
NodeStealer 2.0 – The Python Version: Stealing Facebook Business Accounts
BitRAT NodeStealer XWorm
2023-01-03 ⋅ Qualys ⋅ Akshat Pradhan
BitRAT Now Sharing Sensitive Bank Data as a Lure
BitRAT
2022-05-20 ⋅ SANS ISC ⋅ Xavier Mertens
A 'Zip Bomb' to Bypass Security Controls & Sandboxes
BitRAT
2022-05-19 ⋅ Blackberry ⋅ The BlackBerry Research & Intelligence Team
.NET Stubs: Sowing the Seeds of Discord (PureCrypter)
Aberebot AbstractEmu AdoBot 404 Keylogger Agent Tesla Amadey AsyncRAT Ave Maria BitRAT BluStealer Formbook LimeRAT Loki Password Stealer (PWS) Nanocore RAT Orcus RAT Quasar RAT Raccoon RedLine Stealer WhisperGate
2022-05-12 ⋅ FortiGuard Labs ⋅ Xiaopeng Zhang
Phishing Campaign Delivering Three Fileless Malware: AveMariaRAT / BitRAT / PandoraHVNC – Part I
Ave Maria BitRAT Pandora RAT
2022-05-10 ⋅ Checkpoint ⋅ Checkpoint
Info-stealer Campaign targets German Car Dealerships and Manufacturers
Azorult BitRAT Raccoon
2022-03-22 ⋅ Bitdefender ⋅ Vlad Constantinescu
BitRAT Malware Seen Spreading Through Unofficial Microsoft Windows Activators
BitRAT
2022-03-21 ⋅ AhnLab ⋅ ASEC Analysis Team
BitRAT Disguised as Windows Product Key Verification Tool Being Distributed
BitRAT TinyNuke
2022-03-21 ⋅ Bleeping Computer ⋅ Bill Toulas
BitRAT malware now spreading as a Windows 10 license activator
BitRAT
2022-02-14 ⋅ Fortinet ⋅ Fred Gutierrez, James Slaughter, Shunichi Imano
NFT Lure Used to Distribute BitRAT
BitRAT
2022-02-14 ⋅ Morphisec ⋅ Arnold Osipov, Hido Cohen
Journey of a Crypto Scammer - NFT-001
AsyncRAT BitRAT Remcos
2022-02-07 ⋅ RiskIQ ⋅ RiskIQ
RiskIQ: Malicious Infrastructure Connected to Particular Windows Host Certificates
AsyncRAT BitRAT Nanocore RAT
2022-01-23 ⋅ forensicitguy ⋅ Tony Lambert
HCrypt Injecting BitRAT using PowerShell, HTAs, and .NET
BitRAT
2022-01-09 ⋅ YouTube (0xca7) ⋅ 0xca7
Cat vs. RAT II - Bitrat
BitRAT
2021-11-23 ⋅ Morphisec ⋅ Arnold Osipov, Hido Cohen
Babadeda Crypter targeting crypto, NFT, and DeFi communities
Babadeda BitRAT LockBit Remcos
2021-09-20 ⋅ Trend Micro ⋅ Aliakbar Zahravi, William Gamazo Sanchez
Water Basilisk Uses New HCrypt Variant to Flood Victims with RAT Payloads
Ave Maria BitRAT LimeRAT Nanocore RAT NjRAT Quasar RAT
2021-09-13 ⋅ Trend Micro ⋅ Daniel Lunghi, Jaromír Hořejší
APT-C-36 Updates Its Spam Campaign Against South American Entities With Commodity RATs (IOCs)
AsyncRAT Ave Maria BitRAT Imminent Monitor RAT LimeRAT NjRAT Remcos
2021-09-13 ⋅ Trend Micro ⋅ Daniel Lunghi, Jaromír Hořejší
APT-C-36 Updates Its Spam Campaign Against South American Entities With Commodity RATs
AsyncRAT Ave Maria BitRAT Imminent Monitor RAT LimeRAT NjRAT Remcos
2021-09-03 ⋅ Trend Micro ⋅ Mohamad Mokbel
The State of SSL/TLS Certificate Usage in Malware C&C Communications
AdWind ostap AsyncRAT BazarBackdoor BitRAT Buer Chthonic CloudEyE Cobalt Strike DCRat Dridex FindPOS GootKit Gozi IcedID ISFB Nanocore RAT Orcus RAT PandaBanker Qadars QakBot Quasar RAT Rockloader ServHelper Shifu SManager TorrentLocker TrickBot Vawtrak Zeus Zloader
2021-07-12 ⋅ Cipher Tech Solutions ⋅ Claire Zaboeva, Dan Dash, Melissa Frydrych
RoboSki and Global Recovery: Automation to Combat Evolving Obfuscation
404 Keylogger Agent Tesla AsyncRAT Ave Maria Azorult BitRAT Formbook HawkEye Keylogger Loki Password Stealer (PWS) Nanocore RAT NetWire RC NjRAT Quasar RAT RedLine Stealer Remcos
2021-07-12 ⋅ IBM ⋅ Claire Zaboeva, Dan Dash, Melissa Frydrych
RoboSki and Global Recovery: Automation to Combat Evolving Obfuscation
404 Keylogger Agent Tesla AsyncRAT Ave Maria Azorult BitRAT Formbook HawkEye Keylogger Loki Password Stealer (PWS) Nanocore RAT NetWire RC NjRAT Quasar RAT RedLine Stealer Remcos
2021-03-17 ⋅ HP ⋅ HP Bromium
Threat Insights Report Q4-2020
Agent Tesla BitRAT ComodoSec Dridex Emotet Ficker Stealer Formbook Zloader
2021-02-16 ⋅ Check Point ⋅ Check Point Research
ApoMacroSploit: Apocalyptical FUD race
BitRAT
2021-01-22 ⋅ Github (Finch4) ⋅ Finch
Malware Analysis Report No2
BitRAT
2020-09-04 ⋅ KrabsOnSecurity ⋅ Mr. Krabs
BitRAT pt. 2: Hidden Browser, SOCKS5 proxy, and UnknownProducts Unmasked
BitRAT WebMonitor RAT
2020-08-22 ⋅ KrabsOnSecurity ⋅ Mr. Krabs
BitRAT – The Latest in Copy-pasted Malware by Incompetent Developers
BitRAT
Yara Rules
[TLP:WHITE] win_bit_rat_auto (20230808 | Detects win.bit_rat.)
rule win_bit_rat_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-12-06"
        version = "1"
        description = "Detects win.bit_rat."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bit_rat"
        malpedia_rule_date = "20231130"
        malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
        malpedia_version = "20230808"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 85c9 753f 6a00 6a00 68c1000000 6809020000 6a28 }
            // n = 7, score = 200
            //   85c9                 | test                ecx, ecx
            //   753f                 | jne                 0x41
            //   6a00                 | push                0
            //   6a00                 | push                0
            //   68c1000000           | push                0xc1
            //   6809020000           | push                0x209
            //   6a28                 | push                0x28

        $sequence_1 = { ff7608 ff74241c e8???????? 8be8 83c408 85ed 7425 }
            // n = 7, score = 200
            //   ff7608               | push                dword ptr [esi + 8]
            //   ff74241c             | push                dword ptr [esp + 0x1c]
            //   e8????????           |                     
            //   8be8                 | mov                 ebp, eax
            //   83c408               | add                 esp, 8
            //   85ed                 | test                ebp, ebp
            //   7425                 | je                  0x27

        $sequence_2 = { e8???????? 8be8 83c408 85ed 7930 6a00 6a00 }
            // n = 7, score = 200
            //   e8????????           |                     
            //   8be8                 | mov                 ebp, eax
            //   83c408               | add                 esp, 8
            //   85ed                 | test                ebp, ebp
            //   7930                 | jns                 0x32
            //   6a00                 | push                0
            //   6a00                 | push                0

        $sequence_3 = { 8be5 5d c3 8b4510 8320b7 c7400400000000 33c0 }
            // n = 7, score = 200
            //   8be5                 | mov                 esp, ebp
            //   5d                   | pop                 ebp
            //   c3                   | ret                 
            //   8b4510               | mov                 eax, dword ptr [ebp + 0x10]
            //   8320b7               | and                 dword ptr [eax], 0xffffffb7
            //   c7400400000000       | mov                 dword ptr [eax + 4], 0
            //   33c0                 | xor                 eax, eax

        $sequence_4 = { e8???????? 83c408 85c0 74cf 894704 8b450c 895f10 }
            // n = 7, score = 200
            //   e8????????           |                     
            //   83c408               | add                 esp, 8
            //   85c0                 | test                eax, eax
            //   74cf                 | je                  0xffffffd1
            //   894704               | mov                 dword ptr [edi + 4], eax
            //   8b450c               | mov                 eax, dword ptr [ebp + 0xc]
            //   895f10               | mov                 dword ptr [edi + 0x10], ebx

        $sequence_5 = { f20f114af8 f20f1142f0 0fbf06 660f6ec8 0fbf46fe 83c608 f30fe6c9 }
            // n = 7, score = 200
            //   f20f114af8           | movsd               qword ptr [edx - 8], xmm1
            //   f20f1142f0           | movsd               qword ptr [edx - 0x10], xmm0
            //   0fbf06               | movsx               eax, word ptr [esi]
            //   660f6ec8             | movd                xmm1, eax
            //   0fbf46fe             | movsx               eax, word ptr [esi - 2]
            //   83c608               | add                 esi, 8
            //   f30fe6c9             | cvtdq2pd            xmm1, xmm1

        $sequence_6 = { f644242401 895c2410 7413 83faff 0f84f5000000 42 89542414 }
            // n = 7, score = 200
            //   f644242401           | test                byte ptr [esp + 0x24], 1
            //   895c2410             | mov                 dword ptr [esp + 0x10], ebx
            //   7413                 | je                  0x15
            //   83faff               | cmp                 edx, -1
            //   0f84f5000000         | je                  0xfb
            //   42                   | inc                 edx
            //   89542414             | mov                 dword ptr [esp + 0x14], edx

        $sequence_7 = { eb12 6a00 6a00 6a06 6a79 6a2c e8???????? }
            // n = 7, score = 200
            //   eb12                 | jmp                 0x14
            //   6a00                 | push                0
            //   6a00                 | push                0
            //   6a06                 | push                6
            //   6a79                 | push                0x79
            //   6a2c                 | push                0x2c
            //   e8????????           |                     

        $sequence_8 = { f00fc14108 48 7505 8b01 ff5004 8b4df4 64890d00000000 }
            // n = 7, score = 200
            //   f00fc14108           | lock xadd           dword ptr [ecx + 8], eax
            //   48                   | dec                 eax
            //   7505                 | jne                 7
            //   8b01                 | mov                 eax, dword ptr [ecx]
            //   ff5004               | call                dword ptr [eax + 4]
            //   8b4df4               | mov                 ecx, dword ptr [ebp - 0xc]
            //   64890d00000000       | mov                 dword ptr fs:[0], ecx

        $sequence_9 = { c70100000000 83c104 83c204 3bce 75e8 8bc2 5e }
            // n = 7, score = 200
            //   c70100000000         | mov                 dword ptr [ecx], 0
            //   83c104               | add                 ecx, 4
            //   83c204               | add                 edx, 4
            //   3bce                 | cmp                 ecx, esi
            //   75e8                 | jne                 0xffffffea
            //   8bc2                 | mov                 eax, edx
            //   5e                   | pop                 esi

    condition:
        7 of them and filesize < 19405824
}
[TLP:WHITE] win_bit_rat_w0   (20200828 | String-based rule for detecting BitRAT malware payload)
rule win_bit_rat_w0 {
    meta:
        author = "KrabsOnSecurity"
        date = "2020-8-22"
        description = "String-based rule for detecting BitRAT malware payload"
        source = "https://krabsonsecurity.com/2020/08/22/bitrat-the-latest-in-copy-pasted-malware-by-incompetent-developers/"
    malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bit_rat"
    malpedia_version = "20200828"
    malpedia_license = "CC BY-NC-SA 4.0"
    malpedia_sharing = "TLP:WHITE"
    strings:
        $tinynuke_paste1 = "TaskbarGlomLevel"
        $tinynuke_paste2 = "profiles.ini"
        $tinynuke_paste3 = "RtlCreateUserThread"
        $tinynuke_paste4 = "127.0.0.1"
        $tinynuke_paste5 = "Shell_TrayWnd"
        $tinynuke_paste6 = "cmd.exe /c start "
        $tinynuke_paste7 = "nss3.dll"
        $tinynuke_paste8 = "IsRelative="
        $tinynuke_paste9 = "-no-remote -profile "
        $tinynuke_paste10 = "AVE_MARIA"
        
        $commandline1 = "-prs" wide
        $commandline2 = "-wdkill" wide
        $commandline3 = "-uac" wide
        $commandline4 = "-fwa" wide
    condition:
        (8 of ($tinynuke_paste*)) and (3 of ($commandline*))
}
Download all Yara Rules