Manuel Statik Analiz (LLM Okumali) — BitRAT | Tehdit: YUKSEK

文件 Kimligi

SHA25641ed808a203e53bf5ad402ddf8af2f4434a1756c49a835e6d8e09e8dd1a2ca3f
大小66.560 byte
String Sayisi768

Discord CDN Payload Hosting

BitRAT, sifreli ikinci asama payload'ini Discord CDN uzerinde barndindirir. Bu yontem, kurumsal guvenlik duvarlarinin Discord trafiğine izin vermesinden faydalanir. 
Payload URL:
https://cdn.discordapp.com/attachments/1160855778916319336/1196248399096328242/Jvvlpovxdup.dat

Kanal ID: 1160855778916319336
Ek ID:    1196248399096328242
Dosya:    Jvvlpovxdup.dat  (obfuske edilmis isim)

Teknik Yaklasim

  • Dead-drop via Discord CDN: Sifreli config/payload Discord dosya paylasiminda sakli
  • HTTPS trafikle kamufle: cdn.discordapp.com HTTPS trafiklendiginden IDS tespiti guclesir
  • System.Net.Sockets, TcpClient — .NET socket baglantisi
  • ConnectWrapper, ConnectDispatcher, RunDispatcher — asinkon baglanti yonetimi

BitRAT Yetenekleri

KategoriDetay
Uzak Erisim文件 yonetimi, komut satiri, registry duzenleyici
Sistem IzlemeProses listesi, ag baglantilari
Kripto MiningXMR miner gonulluk yonetimi
DDoSTCP/UDP flood modulleri
ProxySOCKS5 proxy islevleri

IOC

SHA25641ed808a203e53bf5ad402ddf8af2f4434a1756c49a835e6d8e09e8dd1a2ca3f
Payload URLhttps://cdn.discordapp.com/attachments/1160855778916319336/1196248399096328242/Jvvlpovxdup.dat
YontemDiscord CDN dead-drop payload hosting

BitRAT — 恶意软件档案

BitRAT commercial RAT. golink.com dead drop C2. Windows Defender/SmartScreen/Security Guard full disable. SCMConfig LSA manipulation.

恶意软件类型
RAT
编程语言
C++
C2协议
TCP
目标系统
Windows

技术细节

C++, AES-256 sifreleme, TCP, Hidden VNC (UltraVNC tabanli), HVNC, Keylogger, Stealer, XMRig miner dahili, UAC bypass (CMSTPLUA/COMPUTERDEFAULTS), DDoS modulu

能力与行为

Uzaktan Erişim & Kontrol
Keylogger
Ekran Görüntüsü
Webcam Erişimi
Dosya Yönetimi
Süreç Yönetimi
Komut Yürütme
Kalıcılık Mekanizması

IOC列表 (1 个指标)

IOC — BitRAT
# SHA256 41ed808a203e53bf5ad402ddf8af2f4434a1756c49a835e6d8e09e8dd1a2ca3f
类型值备注
sha256 41ed808a203e53bf5ad402ddf8af2f4434a1756c49a835e6d8e09e8dd1a2ca3f
BitRAT — 查看完整档案 →

C2服务器 (该家族共有 3 台已记录服务器)

地址 类型 端口 协议 状态 国家
cdn.discordapp.com domain 443 — active —
185.246.188.67 ip 9999 TCP inactive RU
cdn.discordapp.com/attachments/1217028370865455188/1222062384437526538/Fdliipctaw.mp3 domain 443 — inactive —

C2 地址仅来自 KEYDAL 团队人工验证的恶意软件样本。禁止用于商业用途。

标签
bitratdiscord-cdnpayload-hostingnet-socketsratindir