MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 826c93b5f8974e81c812e7f11c63d33b8cfdc84f45c402ae22e7794dc81e5893. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	826c93b5f8974e81c812e7f11c63d33b8cfdc84f45c402ae22e7794dc81e5893
SHA3-384 hash:	8f4fd880ac1b95fb483a2afabee2432f404029838500de30b4fde3534cfa60d6437e8b1e9824085851028daee7761615
SHA1 hash:	bcaf3bf2c9b3c7b244e012e3047e3b8ee5c29ff9
MD5 hash:	7a47cac75096b77be7d7d36d0e72556a
humanhash:	item-hawaii-tennessee-vermont
File name:	7a47cac75096b77be7d7d36d0e72556a.exe
Download:	download sample
Signature	DCRat Alert Create hunting rule
File size:	1'393'152 bytes
First seen:	2023-12-18 06:14:33 UTC
Last seen:	2023-12-18 08:17:12 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	4f2f006e2ecf7172ad368f8289dc96c1 (40 x LummaStealer, 18 x SalatStealer, 17 x CobaltStrike)
ssdeep	24576:xZI+D4Lbj9Abgf7S0X98igyoiMScSYyIyMSsCH3kjK2zlU/guYS19rf6:xZI6IjGbgeYkjrWIiy
Threatray	9 similar samples on MalwareBazaar
TLSH	T1C355494BBC9045BAD4BA92324DA251927B62FC091F3223D72EA0F3782F76BD09D75744
TrID	44.4% (.EXE) Win64 Executable (generic) (10523/12/4) 21.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 8.7% (.ICL) Windows Icons Library (generic) (2059/9) 8.5% (.EXE) OS/2 Executable (generic) (2029/13) 8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter	abuse_ch
Tags:	DCRat exe RAT

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

321

Origin country :

NL

Vendor Threat Intelligence

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/468220/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan.WinGo.Rozena.10947.3482.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Creating a window

Running batch commands

Creating a process with a hidden window

Creating a file in the %AppData% directory

Creating a file in the %temp% directory

Creating a file

Launching a process

Sending a custom TCP request

Creating a process from a recently created file

Using the Windows Management Instrumentation requests

Enabling autorun by creating a file

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

golang monero

Link:

https://www.filescan.io/uploads/657fe367f4b6e5e1634e82a9/reports/aaf32bb6-7aa7-413f-b721-097bcb4f92d8/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/826c93b5f8974e81c812e7f11c63d33b8cfdc84f45c402ae22e7794dc81e5893

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer GoTitan

Malware family:

GoTitan

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/83a10f41-52ae-4fd0-9ff4-629f72a81f5a

Joe Sandbox AsyncRAT, DcRat

Result

Threat name:

AsyncRAT, DcRat

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1363781

Signature

Found malware configuration

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Potentially malicious time measurement code found

Protects its processes via BreakOnTermination flag

Snort IDS alert for network traffic

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected AsyncRAT

Yara detected DcRat

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/826c93b5f8974e81c812e7f11c63d33b8cfdc84f45c402ae22e7794dc81e5893

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/826c93b5f8974e81c812e7f11c63d33b8cfdc84f45c402ae22e7794dc81e5893/

ReversingLabs TitaniumCloud Win64.Trojan.Smokeloader

Threat name:

Win64.Trojan.Smokeloader

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-18 06:15:07 UTC

File Type:

PE+ (Exe)

AV detection:

17 of 23 (73.91%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qjwjhnpys5hidsas47yryy6thogp3scpixcaflrc454u3sa6lcjq._file

Threatray unknown

Verdict:

unknown

Similar samples:

3a7ac66fcf7fee4625ed4d90a107782e80226ff28a4763743fe4c8559b4c80fd

DCRat

4a20d88652a74ef776db2ace59a63815f3c446fb62f7d443145a97158ec19436

DCRat

5c32062a372ad19dafb9464f68c4861989d2b784fb2e52183fcb6d9e789b210e

DCRat

64ac6e203cc0ad51cf3f1fa12f8097c44baf63d542c32576c0d9630d696231da

DCRat

c1354dcaa9389550c2013e23418bb5c71474b6c368f8e68e51e31faa64ba4ea1

DCRat

Hatching Triage asyncrat

Result

Malware family:

asyncrat

Alert

Create hunting rule

Score:

  10/10

Tags:

family:asyncrat botnet:default rat

Link:

https://tria.ge/reports/231218-gzwm5safh8/

Behaviour

Creates scheduled task(s)

Delays execution with timeout.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Enumerates physical storage devices

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Async RAT payload

AsyncRat

Malware Config

C2 Extraction:

127.0.0.1:3000
5.75.147.113:3000

UnpacMe

Unpacked files

SH256 hash:

826c93b5f8974e81c812e7f11c63d33b8cfdc84f45c402ae22e7794dc81e5893

MD5 hash:

7a47cac75096b77be7d7d36d0e72556a

SHA1 hash:

bcaf3bf2c9b3c7b244e012e3047e3b8ee5c29ff9

Link:

https://www.unpac.me/results/dd15d2bf-5d5d-46c6-900d-042aefef48ee/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI iSpy Keylogger

Threat name:

iSpy Keylogger

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/826c93b5f8974e81c812e7f11c63d33b8cfdc84f45c402ae22e7794dc81e5893

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/468220/