MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 018c98c56b688182ad1e9a2e6e6de3c5ca656340771ead60edab2d9697d86bef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DCRat


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 018c98c56b688182ad1e9a2e6e6de3c5ca656340771ead60edab2d9697d86bef
SHA3-384 hash: 3b6caa06b68d0f8e5038d5499dae08a1ac263c6f95b2dc13d2410b1c34a7ffbf66de9249aed0f4a3cc4efb830e4cd163
SHA1 hash: 730fbb3b62e266a49e871532f529478f507a9cbb
MD5 hash: 79503913c3e1d724e7f66314ba4623e0
humanhash: spaghetti-carpet-cola-early
File name:file
Download: download sample
Signature DCRat
Create hunting rule
File size:3'192'832 bytes
First seen:2022-12-01 13:33:53 UTC
Last seen:2022-12-01 15:34:23 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 4cea7ae85c87ddc7295d39ff9cda31d1 (85 x RedLineStealer, 71 x LummaStealer, 62 x Rhadamanthys)
ssdeep 49152:J03/11EAen+jm39LK9Aejeb9rbKv7dvNU54zvRewHAx9cW2dVrlN:u/11N2X3JsAeib9rbwdv6aeJ9cW6N
TLSH T14CE545C063489967EE536AB84E4393DA871CFC90FA65324B3770F75E063A9D3AE15708
TrID 41.1% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
26.1% (.EXE) Win64 Executable (generic) (10523/12/4)
12.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.1% (.ICL) Windows Icons Library (generic) (2059/9)
5.0% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon e8d4b27269f0f0e8 (1 x DCRat)
Reporter andretavare5
Tags:DCRat exe


Avatar
andretavare5
Sample downloaded from https://vk.com/doc760750097_657226142?hash=723EHx1UjVZREOkv1NZJVAOcbCtGBlziBD3wGRJOCo4&dl=G43DANZVGAYDSNY:1669901136:pgSlCgS4JYxxqvjveU1f22S3rGnY0CzA2XoSRdS8L1g&api=1&no_preview=1#t

Intelligence

File Origin
# of uploads :
31
# of downloads :
205
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
No threats detected
Analysis date:
2022-12-01 13:36:09 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/c1114f73-e682-4685-a474-ddd68caf4bd5

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
DCRat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/341124/
Detection(s):
SecuriteInfo.com.Trojan.TR.Crypt.CFI.Gen.12752.22690.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
DNS request
Creating a process from a recently created file
Creating a process with a hidden window
Sending a custom TCP request
Launching a process
Creating a window
Сreating synchronization primitives
Unauthorized injection to a recently created process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
advpack.dll packed rundll32.exe setupapi.dll shell32.dll
Link:
https://www.filescan.io/uploads/6388ad4cfa645277f5036e99/reports/c5489eed-2634-499b-9a59-2fc8a11df23d/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/eb40c98d-876f-4afc-8f2f-e067877d2636
Result
Threat name:
DCRat
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1125393
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Creates processes via WMI
Drops PE files with benign system names
Encrypted powershell cmdline option found
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Sigma detected: Schedule system process
Snort IDS alert for network traffic
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected DCRat
Yara detected Generic Downloader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 758117 Sample: file.exe Startdate: 01/12/2022 Architecture: WINDOWS Score: 100 58 Snort IDS alert for network traffic 2->58 60 Malicious sample detected (through community Yara rule) 2->60 62 Antivirus / Scanner detection for submitted sample 2->62 64 4 other signatures 2->64 8 file.exe 1 3 2->8         started        11 WmiPrvSE.exe 2->11         started        14 spoolsv.exe 2 2->14         started        16 4 other processes 2->16 process3 file4 56 C:\Users\user\AppData\Local\...\FEELIN~2.EXE, PE32 8->56 dropped 18 FEELIN~2.EXE 4 8->18         started        74 Uses schtasks.exe or at.exe to add and modify task schedules 11->74 21 schtasks.exe 11->21         started        23 schtasks.exe 11->23         started        25 schtasks.exe 11->25         started        31 17 other processes 11->31 76 Antivirus detection for dropped file 14->76 27 powershell.exe 14->27         started        29 powershell.exe 16->29         started        signatures5 process6 signatures7 66 Antivirus detection for dropped file 18->66 68 Encrypted powershell cmdline option found 18->68 70 Creates processes via WMI 18->70 72 2 other signatures 18->72 33 FEELIN~2.EXE 1 23 18->33         started        36 powershell.exe 16 18->36         started        38 powershell.exe 13 18->38         started        40 FEELIN~2.EXE 18->40         started        42 conhost.exe 27->42         started        44 conhost.exe 29->44         started        process8 file9 50 unknown (copy), PE32 33->50 dropped 52 C:\Users\Public\Downloads\spoolsv.exe, PE32 33->52 dropped 54 C:\Users\Default\Desktop\Registry.exe, PE32 33->54 dropped 46 conhost.exe 36->46         started        48 conhost.exe 38->48         started        process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/018c98c56b688182ad1e9a2e6e6de3c5ca656340771ead60edab2d9697d86bef/
Threat name:
Win64.Trojan.Witch
Create hunting rule
Status:
Malicious
First seen:
2022-12-01 13:35:37 UTC
File Type:
PE+ (Exe)
Extracted files:
94
AV detection:
12 of 26 (46.15%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=aggjrrllncayfli6tixg43pdyxfgky2ao4pk2yhnvmwznf6ynpxq._file
Verdict:
malicious
Label(s):
asyncrat
Create hunting rule
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence
Link:
https://tria.ge/reports/221201-qt62cscf34/
Behaviour
Suspicious use of WriteProcessMemory
Adds Run key to start application
Executes dropped EXE
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/5afbb9c6-5936-44a8-bd9e-6a7a6ec407b6
Unpacked files
SH256 hash:
018c98c56b688182ad1e9a2e6e6de3c5ca656340771ead60edab2d9697d86bef
MD5 hash:
79503913c3e1d724e7f66314ba4623e0
SHA1 hash:
730fbb3b62e266a49e871532f529478f507a9cbb
Link:
https://www.unpac.me/results/51df48dc-c888-41bd-8301-ddf6f64b0f3e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/018c98c56b688182ad1e9a2e6e6de3c5ca656340771ead60edab2d9697d86bef

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/341124/

Comments