MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0a35a89e0391c87d832c2f287a57dcceb7de478706958b3871015154b4601f3c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DCRat


Vendor detections: 11


Intelligence 11 IOCs 1 YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0a35a89e0391c87d832c2f287a57dcceb7de478706958b3871015154b4601f3c
SHA3-384 hash: d4896441af99391f725990b920edd027d4aefb5d6787d9fee9c16910d239ac7e1a03a000391a562a11deab44f993b0ba
SHA1 hash: 7536c0a5aec783985ebf97e3692d8744cd81dd64
MD5 hash: a957a04c551dc6658307509e4772f239
humanhash: cup-nebraska-michigan-mango
File name:a957a04c551dc6658307509e4772f239.exe
Download: download sample
Signature DCRat
Create hunting rule
File size:866'931 bytes
First seen:2021-10-24 10:25:56 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash fcf1390e9ce472c7270447fc5c61a0c1 (863 x DCRat, 118 x NanoCore, 94 x njrat)
ssdeep 24576:U2G/nvxW3Ww0tU+OZ8043L8vgVcC9Po5ov1zK:UbA30PyI84gSc
Threatray 1'073 similar samples on MalwareBazaar
TLSH T17C05AE013AE86931F1BF5B39D4F569695B39B8227B62EF4F02C0129E1A23780DD50B77
File icon (PE):PE icon
dhash icon 9494b494d4aeaeac (832 x DCRat, 172 x RedLineStealer, 134 x CryptOne)
Reporter abuse_ch
Tags:DCRat exe


Avatar
abuse_ch
DCRat C2:
http://91.240.85.41/binboot/Python/core/rulehtopcore/screenbootrecordscreen/prodPrefrecord/rulesystem/recordsearcher/cuttrace/prodhtoprecordWar/supportMathCamPython/baseUniversal.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://91.240.85.41/binboot/Python/core/rulehtopcore/screenbootrecordscreen/prodPrefrecord/rulesystem/recordsearcher/cuttrace/prodhtoprecordWar/supportMathCamPython/baseUniversal.php https://threatfox.abuse.ch/ioc/236945/

Intelligence

File Origin
# of uploads :
1
# of downloads :
543
Origin country :
n/a
Vendor Threat Intelligence
Detection:
DCRat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/199645/
Detection(s):
Win.Packed.Uztuby-9853721-0
Create hunting rule

Win.Trojan.Uztuby-9855059-0
Create hunting rule

Win.Packed.Uztuby-9864800-0
Create hunting rule

Win.Ransomware.Clinix-9868408-0
Create hunting rule

Win.Packed.Uztuby-9869253-0
Create hunting rule

Win.Packed.Basic-9876200-0
Create hunting rule

Win.Packed.Uztuby-9891175-0
Create hunting rule

Win.Packed.Uztuby-9901274-0
Create hunting rule

ditekSHen.MALWARE.Win.Trojan.AsyncRAT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.Rasftuby.Gen.14.10239.27368.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
Creating a file
Creating a process from a recently created file
Running batch commands
Creating a process with a hidden window
Launching a service
Connection attempt
Sending an HTTP GET request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-debug greyware hacktool overlay packed packed stealer
Link:
https://www.filescan.io/uploads/617537269a5a1e91c5d209ad/reports/3e267f84-96bc-4d19-b0d1-8562c7c4ea66/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7a67ee11-1ebe-478a-9c9b-169a5982426c
Result
Threat name:
DCRat
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/875787
Signature
.NET source code contains potential unpacker
.NET source code contains very large strings
.NET source code references suspicious native API functions
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected DCRat
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 508220 Sample: 0JFuaCx8h0.exe Startdate: 24/10/2021 Architecture: WINDOWS Score: 92 29 Found malware configuration 2->29 31 Multi AV Scanner detection for submitted file 2->31 33 Yara detected DCRat 2->33 35 4 other signatures 2->35 8 0JFuaCx8h0.exe 3 6 2->8         started        process3 file4 21 C:\reviewHost\reviewHostmonitorsvc.exe, PE32 8->21 dropped 11 wscript.exe 1 8->11         started        process5 process6 13 cmd.exe 1 11->13         started        process7 15 reviewHostmonitorsvc.exe 14 3 13->15         started        19 conhost.exe 13->19         started        dnsIp8 23 91.240.85.41, 49752, 80 THEFIRST-ASRU Russian Federation 15->23 25 Multi AV Scanner detection for dropped file 15->25 27 Machine Learning detection for dropped file 15->27 signatures9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0a35a89e0391c87d832c2f287a57dcceb7de478706958b3871015154b4601f3c/
Threat name:
ByteCode-MSIL.Trojan.SpyNoon
Create hunting rule
Status:
Malicious
First seen:
2021-10-22 15:31:02 UTC
AV detection:
23 of 36 (63.89%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bi22rhqdsheh3azmf4uhuv64z2354r4ha2kywodrafivjndad46a._file
Verdict:
malicious
Similar samples:
4b648c17bb169cf81da7a4d1182238b96463ed58474ef6b539818fdb19291a32
DCRat
4e591ca9530450eca3c227d9292c3496d54d022c83d8b9c5372d91b97fed3203
DCRat
6a0d05477e23fc1152067fc51d50a044bccf0e0a0654dbae1864df792400e935
DCRat
88771c803925c9b53a6eeedbf38e34bbb20cc6ab5861ca8789b1efbdda0cbbb2
DCRat
aaa3cda8d3f4bc7ff94a3e4f0fd37aced9d484b663bc15f198e6e25482f60443
DCRat
c310aca2959669fdb69fdec4c1336353d84b7ae9b8767a1086be3591b4af32f0
DCRat
e1168abd0c24c43423463607b92547d5a2365d7fcbd8e6264f7a1b2f91328d6c
DCRat
e3df75eda0f3fff88f4ab98a687f7ec50b1adde27dbb1bb0947f96892eebf493
DCRat
+ 1'063 additional samples on MalwareBazaar
Result
Malware family:
dcrat
Create hunting rule
Score:
  10/10
Tags:
family:dcrat infostealer rat suricata
Link:
https://tria.ge/reports/211024-mgh7zsegbr/
Behaviour
Modifies registry class
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Loads dropped DLL
Executes dropped EXE
DCRat Payload
DcRat
suricata: ET MALWARE DCRAT Activity (GET)
Unpacked files
SH256 hash:
e405befa08f0ee0b8fb060262e23f4bc363367637e6f8ce03f3fbcf2b12fa645
MD5 hash:
e767251a55ebba8bc7ccf675280d67b8
SHA1 hash:
9c974584a738653cfb50110ba657ec4d2bc7dcce
Link:
https://www.unpac.me/results/9a835467-df6b-4a14-bebd-55ba33e2f1ec/
SH256 hash:
6b25f0b87436e2558319451d833270cf4b0f8fd546c23a664b42eff81ed98208
MD5 hash:
390a8d2129e0337aca3775dd27c72302
SHA1 hash:
92baad40691b6629e2b6e820825e5def0336d023
Link:
https://www.unpac.me/results/9a835467-df6b-4a14-bebd-55ba33e2f1ec/
SH256 hash:
0a35a89e0391c87d832c2f287a57dcceb7de478706958b3871015154b4601f3c
MD5 hash:
a957a04c551dc6658307509e4772f239
SHA1 hash:
7536c0a5aec783985ebf97e3692d8744cd81dd64
Link:
https://www.unpac.me/results/9a835467-df6b-4a14-bebd-55ba33e2f1ec/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0a35a89e0391c87d832c2f287a57dcceb7de478706958b3871015154b4601f3c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File
Create hunting rule
Author:ditekSHen
Description:Detects executables containing bas64 encoded gzip files
Rule name:INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
Author:ditekSHen
Description:Detects Windows executables referencing non-Windows User-Agents
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:MALWARE_Win_AsyncRAT
Create hunting rule
Author:ditekSHen
Description:Detects AsyncRAT
Rule name:MALWARE_Win_DCRat
Create hunting rule
Author:ditekSHen
Description:DCRat payload

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/199645/

Comments