MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0af4243d29cc211b18071fdacf963a1dbfea5ff09bd9b947d4d021e80fabccd4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DCRat


Vendor detections: 12


Intelligence 12 IOCs 1 YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0af4243d29cc211b18071fdacf963a1dbfea5ff09bd9b947d4d021e80fabccd4
SHA3-384 hash: 35c40f2b213a5cfe07779315cec767330fe688cb176d404ba0a6739ebeea827a8847f104d0b31411e9beee08b900c752
SHA1 hash: ddba9778bea6313cb4d62b64107c5a43ecbd6fd8
MD5 hash: 09c22c3901e19f445a5d172e98d1ae53
humanhash: east-one-fish-kilo
File name:09c22c3901e19f445a5d172e98d1ae53.exe
Download: download sample
Signature DCRat
Create hunting rule
File size:2'562'560 bytes
First seen:2022-08-09 12:30:24 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 49152:5exSevZ13BirHQLQshjT+wOBSAnPzFwfbijxPvoQUJFuv7na:oxSevb34HQLtZa9jPzwitn4JFuTna
TLSH T108C5E1C9363DDF893233F84A535F2395D9BA9E1A0E2DE539F00138DA1C764A9D105AF8
TrID 38.0% (.EXE) Win64 Executable (generic) (10523/12/4)
23.8% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
16.3% (.EXE) Win32 Executable (generic) (4505/5/1)
7.3% (.EXE) OS/2 Executable (generic) (2029/13)
7.2% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter abuse_ch
Tags:DCRat exe


Avatar
abuse_ch
DCRat C2:
http://146.19.233.133/panel.loc/ProviderapiTest.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://146.19.233.133/panel.loc/ProviderapiTest.php https://threatfox.abuse.ch/ioc/842152/

Intelligence

File Origin
# of uploads :
1
# of downloads :
298
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
09c22c3901e19f445a5d172e98d1ae53.exe
Verdict:
Suspicious activity
Analysis date:
2022-08-09 12:33:03 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/996fbfc4-e1d7-42a7-b59f-3921a5da32e6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/297311/
Detection(s):
Win.Packed.Msilheracles-9943143-0
Create hunting rule

Win.Packed.Lazy-9951384-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% directory
Сreating synchronization primitives
Launching a process
Searching for synchronization primitives
Creating a window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/62f253c7f6ec33747d8c9011/reports/d762dd2e-04b8-4995-9ee5-4fcaa5381276/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Eternity Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/21136c83-bab1-46a4-9770-7903f87e84d8
Result
Threat name:
Eternity Worm
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/1048471
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Yara detected Costura Assembly Loader
Yara detected Eternity Worm
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0af4243d29cc211b18071fdacf963a1dbfea5ff09bd9b947d4d021e80fabccd4/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-08-02 23:57:07 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
23 of 25 (92.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bl2cipjjzqqrwgahd7nm7fr2dw76ux7qtpm3sr6u2aq6qd5lztka._file
Verdict:
malicious
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:dcrat family:eternity family:redline evasion infostealer persistence rat trojan worm
Link:
https://tria.ge/reports/220809-pp2qeaacem/
Behaviour
Checks processor information in registry
Creates scheduled task(s)
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies registry class
Runs ping.exe
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
System policy modification
Enumerates physical storage devices
Drops file in Program Files directory
Drops file in Windows directory
Drops file in System32 directory
Suspicious use of SetThreadContext
Adds Run key to start application
Checks whether UAC is enabled
Looks up external IP address via web service
Checks computer location settings
Loads dropped DLL
Downloads MZ/PE file
Executes dropped EXE
DCRat payload
DcRat
Eternity
Modifies WinLogon for persistence
Process spawned unexpected child process
RedLine
RedLine payload
UAC bypass
Malware Config
C2 Extraction:
http://rlcjba7wduej3xcstcjo577eqgjsjvcjfsw4i23fqvf2y27ylylhmhad.onion
213.226.123.155:2014
Unpacked files
SH256 hash:
404701d8790885fdb8d9d2a819006fdcccc4f31e0e38c4eec0f7d67274e50fb8
MD5 hash:
15de4c4bc7244eddc4e88c0b1cf23224
SHA1 hash:
cf3762fc2968641e4bb6e1b3f03fc35c92a75700
Link:
https://www.unpac.me/results/8406d4ee-8a96-4f22-b41f-b3037ba79fc4/
SH256 hash:
77c1d9b5c973b35b45bea1eeee3fc135f95b3f7a5d04c8bf8f0e70c6e09a6705
MD5 hash:
7181a70cfdebacb78716f006a85cd4c6
SHA1 hash:
9d6b7748fd64527d2b62d0e3ed1321626926c504
Link:
https://www.unpac.me/results/8406d4ee-8a96-4f22-b41f-b3037ba79fc4/
SH256 hash:
a36e5c8960f27edfe6faac02d2b5912317dce0b9ab558378680303e1b15503de
MD5 hash:
90261f729f296a8a65488286f9c52df1
SHA1 hash:
a75e01a587ba922b186d9eab167bddfcd29decc5
Link:
https://www.unpac.me/results/8406d4ee-8a96-4f22-b41f-b3037ba79fc4/
SH256 hash:
7da3f0e77c4dddc82df7c16c8c781fade599b7c91e3d32eefbce215b8f06b12a
MD5 hash:
944ce5123c94c66a50376e7b37e3a6a6
SHA1 hash:
a1936ac79c987a5ba47ca3d023f740401f73529b
Link:
https://www.unpac.me/results/8406d4ee-8a96-4f22-b41f-b3037ba79fc4/
SH256 hash:
48f144f744a9ce60659ee8cc7094610252aecbabf95492fbc612db919d144918
MD5 hash:
d9e08ec1c571d8139255cf305e3fef40
SHA1 hash:
72aea7c18c901a3246eb276258e3b37a95048b4e
Link:
https://www.unpac.me/results/8406d4ee-8a96-4f22-b41f-b3037ba79fc4/
SH256 hash:
0af4243d29cc211b18071fdacf963a1dbfea5ff09bd9b947d4d021e80fabccd4
MD5 hash:
09c22c3901e19f445a5d172e98d1ae53
SHA1 hash:
ddba9778bea6313cb4d62b64107c5a43ecbd6fd8
Link:
https://www.unpac.me/results/8406d4ee-8a96-4f22-b41f-b3037ba79fc4/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/0af4243d29cc/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
DCRat
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0af4243d29cc211b18071fdacf963a1dbfea5ff09bd9b947d4d021e80fabccd4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/297311/

Comments