Threat Research

BitRAT Disguised as Windows Product Key Verification Tool Being Distributed – ASEC BLOG

Securonix

Security researchers at ASEC uncovered BitRAT distributed via Korean webhards, masquerading as a Windows license verification tool. The attack chain uses a multi-stage dropper that hides a downloader, which then fetches BitRAT and broader capabilities, including persistence, C2 communication, and data theft. #BitRAT #W10DigitalActivation #TinyNuke #AveMaria #Kimsuky #Webhard #HiddenDesktop

Keypoints

  • BitRAT is distributed through webhards and disguised as a Windows 10 license verification tool, targeting users who download illegal crack tools.
  • A compressed Program.zip (password 1234) contains W10DigitalActivation.exe (7z SFX) and W10DigitalActivation_Temp.msi, which together install the downloader and BitRAT.
  • The downloader installs into the Windows startup folder and removes itself, then launches BitRAT from the %TEMP% path as Software_Reporter_Tool.exe.
  • The downloader uses Defender evasion by adding the startup folder and the BitRAT process to Windows Defender exclusions via a PowerShell command.
  • BitRAT provides extensive capabilities: remote control (including hVNC/Hidden Desktop), info-stealing (keylogging, clipboard, webcam, audio, browser credentials), proxies, Tor/TLS communication, coin mining, and even DDoS/UAC bypass/Defender deactivation.
  • The malware appears to reuse TinyNuke’s code for hVNC/Hidden Desktop, and indicators suggest a Korean-speaking operator behind the campaign.
  • Users are advised to avoid running executables from file-sharing sites and to download software only from official sources.

MITRE Techniques

  • [T1105] Ingress Tool Transfer – Downloader connects to C&C servers to fetch the payload. Quote: “…it connects to following C&C servers it harbors internally, exchanging encrypted strings. Afterward, it decrypts the strings to ultimately acquire a download URL for the additional payload.”
  • [T1036] Masquerading – Disguised as Windows license verification tool. Quote: “The attacker disguised the malware as Windows 10 license verification tool from the development stage.”
  • [T1027] Obfuscated/Compressed Files and Information – The Program.zip is password-protected (1234) and contains a downloader and the actual tool. Quote: “a compressed file named ‘Program.zip’ is downloaded, and it is compressed and locked with a password ‘1234’.”
  • [T1547] Boot or Logon Autostart Execution – The downloader installs the malware into the Windows startup program folder. Quote: “The downloader installs the malware into the Windows startup program folder and deletes itself.”
  • [T1562] Impair Defenses – Defender exclusion: adds startup folder and the BitRAT process to Windows Defender exclusions. Quote: “…add the Windows startup program folder—where the downloader will be installed—as an exclusion path for Windows Defender, and adding the BitRAT process name ‘Software_Reporter_Tool.exe’ as an exclusion process for Windows Defender.”
  • [T1021] Remote Services – Remote Desktop / hVNC (Hidden Desktop). Quote: “– Remote desktop – hVNC (Hidden Desktop)”
  • [T1056] Input Capture – Keylogging. Quote: “Keylogging” (along with clipboard, webcam, and audio logging listed under Information Theft).
  • [T1115] Clipboard Data – Clipboard logging as part of Information Theft. Quote: “Clipboard logging”
  • [T1125] Video Capture – Webcam logging. Quote: “Webcam logging”
  • [T1123] Audio Capture – Audio logging. Quote: “Audio logging”
  • [T1555] Credentials from Web Browsers – Browser credential theft. Quote: “Application (e.g. Web browsers) account credential theft”
  • [T1496] Resource Hijacking – Coin mining (XMRig). Quote: “XMRig CoinMiner”
  • [T1499] Service Denial of Service / DoS – DDoS capability. Quote: “DDoS attack”
  • [T1548] Abuse Elevation Control Mechanism – UAC Bypass. Quote: “UAC Bypass”
  • [T1562.001] Impair Defenses – Defender deactivation. Quote: “Windows Defender deactivation”
  • [T1041] Exfiltration Over C2 / Encrypted Channel – C2 traffic encrypted via TLS and Tor. Quote: “Encrypted communication using TLS 1.2” and “Communication using Tor”
  • [T1105] Ingress Tool Transfer (Second instance) – Additional payload URLs retrieved after initial downlink (repeat of T1105 for downloader/BitRAT payloads). Quote: “Additional Payload Download URL – Downloader” and “Additional Payload Download URL – BitRAT”

Indicators of Compromise

  • [File] W10DigitalActivation.exe – Windows license verification tool (downloader payload). Context: primary executable in the ZIP dropper.
  • [File] W10DigitalActivation_Temp.msi – Malicious downloader payload. Context: downloaded alongside the legitimate tool.
  • [File] Software_Reporter_Tool.exe – BitRAT component placed in %TEMP% (startup chain). Context: used as the persistent BitRAT loader.
  • [MD5] 6befd2bd3005a0390153f643ba248e25 – Dropper MD5. Context: first-stage dropper.
  • [MD5] 60ee7740c4b7542701180928ef6f0d53 – Downloader MD5. Context: downloader payload.
  • [MD5] c4740d6a8fb6e17e8d2b21822c45863b – Downloader MD5. Context: downloader payload.
  • [MD5] b8c39c252aeb7c264607a053f368f6eb – BitRAT MD5. Context: BitRAT binary.
  • [MD5] e03a79366acb221fd5206ab4987406f2 – BitRAT MD5. Context: BitRAT binary.
  • [MD5] ea1b987a7fdfc2996d5f314a20fd4d99 – BitRAT MD5. Context: BitRAT binary.
  • [MD5] 54ef1804c22f6b24a930552cd51a4ae2 – BitRAT MD5. Context: BitRAT binary.
  • [Domain] cothdesigns.com – C2 domain (80 port). Context: one of the C2 endpoints.
  • [Domain] jmuquwk.duckdns.org – C2 domain. Context: one of the C2 endpoints.
  • [Domain] nnmmdlc.duckdns.org – C2 domain. Context: one of the C2 endpoints.
  • [IP] 108.61.207.100 – C2/download URL host. Context: used in payload URLs.
  • [URL] http://kx3nz98.duckdns.org:443/v/V_1267705.exe – Downloader payload URL. Context: primary secondary download.
  • [URL] http://108.61.207.100:443/v/V_5248849.exe – Downloader payload URL. Context: secondary URL.
  • [URL] http://kx3nz98.duckdns.org:443/v/A_1992262.exe – BitRAT payload URL. Context: additional payload for BitRAT.
  • [URL] http://108.61.207.100:443/result/A_1146246.exe – BitRAT payload URL. Context: additional payload for BitRAT.
  • [Domain] z59okz.duckdns.org:5223 – BitRAT C2. Context: BitRAT C2 endpoint.

Read more: https://asec.ahnlab.com/en/32781/