BitRAT — Discord CDN Payload Hosting Jvvlpovxdup.dat, .NET Socket Tabanli RAT | Yuksek

Manuel Statik Analiz (LLM Okumali) — BitRAT | Tehdit: YUKSEK

Fichier Kimligi

SHA256	`41ed808a203e53bf5ad402ddf8af2f4434a1756c49a835e6d8e09e8dd1a2ca3f`
Taille	66.560 byte
String Sayisi	768

Discord CDN Payload Hosting

BitRAT, sifreli ikinci asama payload'ini Discord CDN uzerinde barndindirir. Bu yontem, kurumsal guvenlik duvarlarinin Discord trafiğine izin vermesinden faydalanir.

Payload URL:
https://cdn.discordapp.com/attachments/1160855778916319336/1196248399096328242/Jvvlpovxdup.dat

Kanal ID: 1160855778916319336
Ek ID:    1196248399096328242
Dosya:    Jvvlpovxdup.dat  (obfuske edilmis isim)

Teknik Yaklasim

Dead-drop via Discord CDN: Sifreli config/payload Discord dosya paylasiminda sakli
HTTPS trafikle kamufle: cdn.discordapp.com HTTPS trafiklendiginden IDS tespiti guclesir
System.Net.Sockets, TcpClient — .NET socket baglantisi
ConnectWrapper, ConnectDispatcher, RunDispatcher — asinkon baglanti yonetimi

BitRAT Yetenekleri

Kategori	Detay
Uzak Erisim	Fichier yonetimi, komut satiri, registry duzenleyici
Sistem Izleme	Proses listesi, ag baglantilari
Kripto Mining	XMR miner gonulluk yonetimi
DDoS	TCP/UDP flood modulleri
Proxy	SOCKS5 proxy islevleri

IOC

SHA256	`41ed808a203e53bf5ad402ddf8af2f4434a1756c49a835e6d8e09e8dd1a2ca3f`
Payload URL	https://cdn.discordapp.com/attachments/1160855778916319336/1196248399096328242/Jvvlpovxdup.dat
Yontem	Discord CDN dead-drop payload hosting

BitRAT — Profil du malware

BitRAT commercial RAT. golink.com dead drop C2. Windows Defender/SmartScreen/Security Guard full disable. SCMConfig LSA manipulation.

Type de malware

RAT

Langage de programmation

C++

Protocole C2

TCP

Systèmes ciblés

Windows

Détails techniques

C++, AES-256 sifreleme, TCP, Hidden VNC (UltraVNC tabanli), HVNC, Keylogger, Stealer, XMRig miner dahili, UAC bypass (CMSTPLUA/COMPUTERDEFAULTS), DDoS modulu

Capacités et comportement

Uzaktan Erişim & Kontrol

Keylogger

Ekran Görüntüsü

Webcam Erişimi

Dosya Yönetimi

Süreç Yönetimi

Komut Yürütme

Kalıcılık Mekanizması

Liste IOC (1 indicateurs)

IOC — BitRAT

# SHA256
41ed808a203e53bf5ad402ddf8af2f4434a1756c49a835e6d8e09e8dd1a2ca3f

Type	Valeur	Note
sha256	41ed808a203e53bf5ad402ddf8af2f4434a1756c49a835e6d8e09e8dd1a2ca3f

BitRAT — Voir le profil complet →

Serveurs C2 (3 serveurs enregistrés pour cette famille)

Adresse	Type	Port	Protocole	Statut	Pays
cdn.discordapp.com	domain	443	—	active	—
185.246.188.67	ip	9999	TCP	inactive	RU
cdn.discordapp.com/attachments/1217028370865455188/1222062384437526538/Fdliipctaw.mp3	domain	443	—	inactive	—

Les adresses C2 proviennent uniquement d'échantillons de malwares vérifiés manuellement par l'équipe KEYDAL. Toute utilisation commerciale est interdite.