MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 051fc99ae126193d3336a2539b566507f7fef112ca6c5738c404a9e56e3aeaff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DCRat


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 051fc99ae126193d3336a2539b566507f7fef112ca6c5738c404a9e56e3aeaff
SHA3-384 hash: 65a2c7d9686a131483075140e8f26a2440d2c5ae902f396734301c5dfc03f43eb5570749ee8b3cb7e9a36aeb895daa3f
SHA1 hash: 808e5013efb052b74ad8d76c2bc47085f9c3c947
MD5 hash: 2c4f5612efef78a08226ac5f49b10486
humanhash: oxygen-hawaii-cat-sodium
File name:2c4f5612efef78a08226ac5f49b10486.exe
Download: download sample
Signature DCRat
Create hunting rule
File size:326'403 bytes
First seen:2021-09-19 06:06:17 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 202ed20a6eb7f03326e5ec59aed0dbcb (1 x DCRat)
ssdeep 3072:DEn4pskzOAd4vZlFOiYzHGSZCzDyWv0JEmkmheZmd/F9F+1H8YBeiug:YIiAdszOiiGSgneEmkqrZaH8Xg
Threatray 677 similar samples on MalwareBazaar
TLSH T1C0645A60B694AC5AF316C8749CD5C31E3A22EECA5F874B072634F73D4576398ADF0924
File icon (PE):PE icon
dhash icon beeee6b2b2d8ecf2 (1 x DCRat)
Reporter abuse_ch
Tags:DCRat exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
208
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
2c4f5612efef78a08226ac5f49b10486.exe
Verdict:
No threats detected
Analysis date:
2021-09-19 06:10:38 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/2690b7a5-ac20-4591-8968-c7525fe8cca0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/189013/
Detection(s):
Win.Exploit.Deepscan-9857891-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Running batch commands
Creating a process with a hidden window
Creating a file in the %AppData% directory
Creating a file in the %temp% directory
Launching a process
Creating a file
Self-deleting of the BAT file
Creating a process from a recently created file
Connection attempt
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Enabling autorun by creating a file
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8f941595-c6e0-4ab5-b30e-8f3a0307d229
Result
Threat name:
AsyncRAT
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/853419
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Connects to many ports of the same IP (likely port scanning)
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AsyncRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 485850 Sample: 8BlkzGM5n8.exe Startdate: 19/09/2021 Architecture: WINDOWS Score: 100 44 Found malware configuration 2->44 46 Antivirus / Scanner detection for submitted sample 2->46 48 Multi AV Scanner detection for submitted file 2->48 50 3 other signatures 2->50 8 flash.exe 1 3 2->8         started        12 8BlkzGM5n8.exe 8 2->12         started        process3 dnsIp4 40 14.17.115.109, 12356, 49735 CHINATELECOM-GUANGDONG-IDCGuangdongCN China 8->40 52 Antivirus detection for dropped file 8->52 54 Multi AV Scanner detection for dropped file 8->54 56 Machine Learning detection for dropped file 8->56 15 conhost.exe 8->15         started        36 C:\Users\user\AppData\Roaming\flash.exe, PE32+ 12->36 dropped 38 C:\Users\user\AppData\...\8BlkzGM5n8.exe.log, ASCII 12->38 dropped 17 cmd.exe 1 12->17         started        20 cmd.exe 1 12->20         started        22 conhost.exe 12->22         started        file5 signatures6 process7 signatures8 42 Uses schtasks.exe or at.exe to add and modify task schedules 17->42 24 schtasks.exe 1 17->24         started        26 conhost.exe 17->26         started        28 flash.exe 4 20->28         started        30 conhost.exe 20->30         started        32 timeout.exe 1 20->32         started        process9 process10 34 conhost.exe 24->34         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/051fc99ae126193d3336a2539b566507f7fef112ca6c5738c404a9e56e3aeaff/
Threat name:
Win64.Hacktool.Wovdnut
Create hunting rule
Status:
Malicious
First seen:
2021-08-25 15:47:00 UTC
AV detection:
15 of 28 (53.57%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=aup4tgxbeymt2mzwujjzwvtfa73754iszjwfoogeasu6k3r25l7q._file
Verdict:
malicious
Similar samples:
0afa59785e40dc850fdc42bf1ee2a070ab99210b94966b650e410cea4d2729f4
DCRat
0c70de48f9178011a4272f7fea015700922f210d1952e149e72f6c1e16e334c3
DCRat
1b11ae98b85bb0645abe36adcd852e6e84b51c6b5c811729f3c19f14f32d4e4f
DCRat
51e6527daa5a10028c434c7ceaed1570ddd95e1de0eafa702f77860cec3d0b7c
DCRat
585cf15c667a0e3b4d3d328a962aa012c09298fdc084e2d69a650c0d1d5a258b
DCRat
62609aac613627ef79c08360049cdc59584d71d8e662f890dedbe4318da8beb5
DCRat
860ac4a282dcf987884eb102266644b6442e3cd4bdbfbfbca897f673c89fa82a
DCRat
bc06c918fab5afbb61d15611dedadbc9012cf9e4979e9d3f261a9046c306bb87
DCRat
be2db75e1284c24016ccba39196d71e883b2e13ad6091ac2b56ed62dc199ef11
DCRat
f51fc0ab96d1aee49950b8ca91ef67c330b8593340cc3002513100ac9bf163b0
DCRat
+ 667 additional samples on MalwareBazaar
Result
Malware family:
asyncrat
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat botnet:default rat
Link:
https://tria.ge/reports/210919-gvbr6sbfh7/
Behaviour
Creates scheduled task(s)
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Loads dropped DLL
Executes dropped EXE
Async RAT payload
AsyncRat
Malware Config
C2 Extraction:
14.17.115.109:8848
14.17.115.109:12356
14.17.115.109:55555
14.17.115.109:22222
Unpacked files
SH256 hash:
051fc99ae126193d3336a2539b566507f7fef112ca6c5738c404a9e56e3aeaff
MD5 hash:
2c4f5612efef78a08226ac5f49b10486
SHA1 hash:
808e5013efb052b74ad8d76c2bc47085f9c3c947
Link:
https://www.unpac.me/results/4a2417b3-f134-4e11-8728-ef29bd26c007/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/051fc99ae126193d3336a2539b566507f7fef112ca6c5738c404a9e56e3aeaff

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/189013/

Comments