BitRAT — Discord CDN Payload Hosting Jvvlpovxdup.dat, .NET Socket Tabanli RAT | Yuksek

Manuel Statik Analiz (LLM Okumali) — BitRAT | Tehdit: YUKSEK

Dosya Kimligi

SHA256	`41ed808a203e53bf5ad402ddf8af2f4434a1756c49a835e6d8e09e8dd1a2ca3f`
Boyut	66.560 byte
String Sayisi	768

Discord CDN Payload Hosting

BitRAT, sifreli ikinci asama payload'ini Discord CDN uzerinde barndindirir. Bu yontem, kurumsal guvenlik duvarlarinin Discord trafiğine izin vermesinden faydalanir.

Payload URL:
https://cdn.discordapp.com/attachments/1160855778916319336/1196248399096328242/Jvvlpovxdup.dat

Kanal ID: 1160855778916319336
Ek ID:    1196248399096328242
Dosya:    Jvvlpovxdup.dat  (obfuske edilmis isim)

Teknik Yaklasim

Dead-drop via Discord CDN: Sifreli config/payload Discord dosya paylasiminda sakli
HTTPS trafikle kamufle: cdn.discordapp.com HTTPS trafiklendiginden IDS tespiti guclesir
System.Net.Sockets, TcpClient — .NET socket baglantisi
ConnectWrapper, ConnectDispatcher, RunDispatcher — asinkon baglanti yonetimi

BitRAT Yetenekleri

Kategori	Detay
Uzak Erisim	Dosya yonetimi, komut satiri, registry duzenleyici
Sistem Izleme	Proses listesi, ag baglantilari
Kripto Mining	XMR miner gonulluk yonetimi
DDoS	TCP/UDP flood modulleri
Proxy	SOCKS5 proxy islevleri

IOC

SHA256	`41ed808a203e53bf5ad402ddf8af2f4434a1756c49a835e6d8e09e8dd1a2ca3f`
Payload URL	https://cdn.discordapp.com/attachments/1160855778916319336/1196248399096328242/Jvvlpovxdup.dat
Yontem	Discord CDN dead-drop payload hosting

BitRAT — Malware Profile

BitRAT commercial RAT. golink.com dead drop C2. Windows Defender/SmartScreen/Security Guard full disable. SCMConfig LSA manipulation.

Malware Type

RAT

Programming Language

C++

C2 Protocol

TCP

Target Systems

Windows

Technical Details

C++, AES-256 sifreleme, TCP, Hidden VNC (UltraVNC tabanli), HVNC, Keylogger, Stealer, XMRig miner dahili, UAC bypass (CMSTPLUA/COMPUTERDEFAULTS), DDoS modulu

Capabilities & Behavior

Uzaktan Erişim & Kontrol

Keylogger

Ekran Görüntüsü

Webcam Erişimi

Dosya Yönetimi

Süreç Yönetimi

Komut Yürütme

Kalıcılık Mekanizması

IOC List (1 indicators)

IOC — BitRAT

# SHA256
41ed808a203e53bf5ad402ddf8af2f4434a1756c49a835e6d8e09e8dd1a2ca3f

Type	Value	Note
sha256	41ed808a203e53bf5ad402ddf8af2f4434a1756c49a835e6d8e09e8dd1a2ca3f

BitRAT — Go to Full Profile →

C2 Servers (3 recorded servers for this family)

Address	Type	Port	Protocol	Status	Country
cdn.discordapp.com	domain	443	—	active	—
185.246.188.67	ip	9999	TCP	inactive	RU
cdn.discordapp.com/attachments/1217028370865455188/1222062384437526538/Fdliipctaw.mp3	domain	443	—	inactive	—

C2 addresses are provided only from malware samples manually verified by the KEYDAL team. Commercial use is prohibited.