MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0daea272c1fa7bb54113cfc6948f10b9346f2cf05000ac5b57aaed5cef8dae05. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DCRat


Vendor detections: 15


Intelligence 15 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0daea272c1fa7bb54113cfc6948f10b9346f2cf05000ac5b57aaed5cef8dae05
SHA3-384 hash: 41c72e852f2920c8d0f4175a2a9b8574acbfb030ad3af87ad54161a1c4dd8905a6a177e7799605a92108877c7f40f972
SHA1 hash: f2f7fe6dc3ccf125f912041f50adbeb0d59ecc9d
MD5 hash: bb1918c93c2a8f8afdc85c766e707349
humanhash: massachusetts-utah-cardinal-maryland
File name:HEUR-Backdoor.MSIL.LightStone.gen-0daea272c1f.exe
Download: download sample
Signature DCRat
Create hunting rule
File size:1'544'303 bytes
First seen:2023-06-26 03:50:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash fcf1390e9ce472c7270447fc5c61a0c1 (863 x DCRat, 118 x NanoCore, 94 x njrat)
ssdeep 24576:u2G/nvxW3WieCVDqgcjRDt0CD6eB/cqN8qpl55cr/BT7+4a:ubA3j9Uftcqnn5iRqb
Threatray 570 similar samples on MalwareBazaar
TLSH T161654AA27E46DD12D169163BC9EF886407B8FE002BA6CB1B7E9F335D65113A31D0D1CA
TrID 54.2% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39)
40.3% (.CPL) Windows Control Panel Item (generic) (197083/11/60)
2.1% (.EXE) Win64 Executable (generic) (10523/12/4)
1.0% (.EXE) Win16 NE executable (generic) (5038/12/1)
0.9% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 9494b494d4aeaeac (832 x DCRat, 172 x RedLineStealer, 134 x CryptOne)
Reporter abuse_ch
Tags:DCRat exe


Avatar
abuse_ch
DCRat C2:
http://185.146.157.245/Mathlog/program/LinePhp_apidb.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
308
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
dcrat
Create hunting rule
ID:
1
File name:
HEUR-Backdoor.MSIL.LightStone.gen-0daea272c1f.exe
Verdict:
Malicious activity
Analysis date:
2023-06-26 03:53:00 UTC
Tags:
rat backdoor dcrat
Link:
https://app.any.run/tasks/8da77cce-f428-437e-a7e1-3e08cea30c0b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/402739/
Detection(s):
SecuriteInfo.com.VBS.Encrypted.Gen.UNOFFICIAL
Create hunting rule

Win.Malware.Uztuby-9848412-0
Create hunting rule

Win.Packed.Uztuby-9851623-0
Create hunting rule

Win.Trojan.Uztuby-9855059-0
Create hunting rule

Win.Ransomware.Clinix-9868408-0
Create hunting rule

Win.Packed.Uztuby-9875336-0
Create hunting rule

Win.Packed.Uztuby-9877681-0
Create hunting rule

Win.Packed.Uztuby-9892756-0
Create hunting rule

Win.Packed.Basic-9897090-0
Create hunting rule

Win.Packed.Uztuby-9937390-0
Create hunting rule

Win.Malware.Uztuby-9939317-0
Create hunting rule

Win.Packed.Basic-9952747-0
Create hunting rule

SecuriteInfo.com.Trojan.Rasftuby.Gen.14.10239.27368.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file
Creating a process from a recently created file
Running batch commands
Creating a process with a hidden window
Creating a file in the Windows subdirectories
Using the Windows Management Instrumentation requests
Launching a process
Creating a file in the Program Files subdirectories
Creating a file in the system32 subdirectories
Sending an HTTP GET request
DNS request
Sending a custom TCP request
Unauthorized injection to a recently created process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun by creating a file
Unauthorized injection to a system process
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/92684/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug anti-vm cmd.exe coinminer explorer.exe greyware hacktool lolbin lolbin makop net overlay packed packed schtasks.exe setupapi.dll shdocvw.dll shell32.dll stealer wscript
Link:
https://www.filescan.io/uploads/64990b26a85ef0b719518141/reports/41c54463-0327-48ca-aa55-ca86dfa806fc/overview
Verdict:
Malicious
Labled as:
Trojan.MSIL.Basic.8.Gen;Trojan.Uztuby
Link:
https://www.hybrid-analysis.com/sample/0daea272c1fa7bb54113cfc6948f10b9346f2cf05000ac5b57aaed5cef8dae05
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6e5d777f-3f4b-4bc7-b1e7-f4472efac6db
Result
Threat name:
DCRat
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1261207
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Creates an autostart registry key pointing to binary in C:\Windows
Creates multiple autostart registry keys
Creates processes via WMI
Drops executable to a common third party application directory
Drops executables to the windows directory (C:\Windows) and starts them
Drops PE files with benign system names
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Schedule system process
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected DCRat
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 894227 Sample: HEUR-Backdoor.MSIL.LightSto... Startdate: 26/06/2023 Architecture: WINDOWS Score: 100 46 git.megahub.me 2->46 54 Found malware configuration 2->54 56 Malicious sample detected (through community Yara rule) 2->56 58 Antivirus detection for dropped file 2->58 60 10 other signatures 2->60 10 HEUR-Backdoor.MSIL.LightStone.gen-0daea272c1f.exe 3 6 2->10         started        13 fontdrvhost.exe 2 2->13         started        16 smss.exe 3 2->16         started        18 11 other processes 2->18 signatures3 process4 dnsIp5 42 C:\...\fontintoSessionFontperf.exe, PE32 10->42 dropped 44 C:\fontintoSession\1AGrZ1unMb.vbe, data 10->44 dropped 21 wscript.exe 1 10->21         started        70 Antivirus detection for dropped file 13->70 72 Multi AV Scanner detection for dropped file 13->72 74 Machine Learning detection for dropped file 13->74 48 git.megahub.me 18->48 file6 signatures7 process8 process9 23 cmd.exe 1 21->23         started        process10 25 fontintoSessionFontperf.exe 6 18 23->25         started        29 conhost.exe 23->29         started        file11 34 C:\Windows\System32\sppobjs\smartscreen.exe, PE32 25->34 dropped 36 C:\Windows\System32\...\fontdrvhost.exe, PE32 25->36 dropped 38 C:\ProgramData\dbg\smss.exe, PE32 25->38 dropped 40 3 other malicious files 25->40 dropped 62 Antivirus detection for dropped file 25->62 64 Multi AV Scanner detection for dropped file 25->64 66 Machine Learning detection for dropped file 25->66 68 6 other signatures 25->68 31 fontdrvhost.exe 14 3 25->31         started        signatures12 process13 dnsIp14 50 git.megahub.me 185.146.157.245, 443, 49692, 49693 THEFIRST-ASRU Russian Federation 31->50 52 192.168.2.1 unknown unknown 31->52
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0daea272c1fa7bb54113cfc6948f10b9346f2cf05000ac5b57aaed5cef8dae05/
Threat name:
ByteCode-MSIL.Trojan.SpyNoon
Create hunting rule
Status:
Malicious
First seen:
2021-09-13 00:51:00 UTC
File Type:
PE (Exe)
Extracted files:
21
AV detection:
25 of 37 (67.57%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bwxke4wb7j53kqitz7djjdyqxe2g6lhqkaakyw2xvlwvz34nvycq._file
Verdict:
malicious
Similar samples:
3927622ef8e0a99764011d9f98f47bf0eb1a39df514a7e02e78d3cc7773c4944
DCRat
49f8f8d74fc5f81ada3b288e56297334e35d07b0fc912f73aa9ba1b971639937
DCRat
4cced7c39444bc55a0cd79b0384b24517e355e0d70ab20019af96f2a7c181cd8
DCRat
51b8434c68594113a4036358e477fe1ae1b4cc0b99d653b224250e24537d87e2
DCRat
6176ead880248cbccdf7df359034699e937249e13608b788be1b25158b09c1ca
DCRat
6e491124fc83eb50eae434f1aafe070f9dba30d2ed03d10abd7cc2d91fcfc4dd
DCRat
+ 560 additional samples on MalwareBazaar
Result
Malware family:
dcrat
Create hunting rule
Score:
  10/10
Tags:
family:dcrat infostealer persistence rat
Link:
https://tria.ge/reports/230626-eegx5shc3w/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Creates scheduled task(s)
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Enumerates physical storage devices
Drops file in System32 directory
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
DCRat payload
DcRat
Process spawned unexpected child process
Unpacked files
SH256 hash:
5e19c4b3486ed7902779d92c105f129d7dd36f642841cc6bde3c6213a0ddabea
MD5 hash:
fd56d047d6ad68623b46f78459fa2f5b
SHA1 hash:
cd4abb9c2ab8cf5777875d4958215ab71b3c1708
Link:
https://www.unpac.me/results/db5c6303-d44e-4601-930f-b1bd48539394/
SH256 hash:
5e19c4b3486ed7902779d92c105f129d7dd36f642841cc6bde3c6213a0ddabea
MD5 hash:
fd56d047d6ad68623b46f78459fa2f5b
SHA1 hash:
cd4abb9c2ab8cf5777875d4958215ab71b3c1708
Link:
https://www.unpac.me/results/db5c6303-d44e-4601-930f-b1bd48539394/
SH256 hash:
49dd10bf34acb11a37a3b3250ab70f542b1739f74ef7ab4e90634520e7994795
MD5 hash:
9d9c165c33e6fc4fa90ab538695b74c3
SHA1 hash:
cb6a70b457625e5eeafd12464e883b7c9c78229c
Link:
https://www.unpac.me/results/db5c6303-d44e-4601-930f-b1bd48539394/
SH256 hash:
49dd10bf34acb11a37a3b3250ab70f542b1739f74ef7ab4e90634520e7994795
MD5 hash:
9d9c165c33e6fc4fa90ab538695b74c3
SHA1 hash:
cb6a70b457625e5eeafd12464e883b7c9c78229c
Link:
https://www.unpac.me/results/db5c6303-d44e-4601-930f-b1bd48539394/
SH256 hash:
f4dbaec73ccd5c6431cf902d7327ddb9f2c87de2434226bb18948ba4ee5755ed
MD5 hash:
b45e9d751c574567757174ac44bf54a1
SHA1 hash:
642fc5f04600f8a8ba6feeec08cf94f281c40d0d
Detections:
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
Link:
https://www.unpac.me/results/db5c6303-d44e-4601-930f-b1bd48539394/
Parent samples :
56b97987918aafadb2b070083e19236388c3ac087b80a8d548c07ff31252eb17
6176ead880248cbccdf7df359034699e937249e13608b788be1b25158b09c1ca
3927622ef8e0a99764011d9f98f47bf0eb1a39df514a7e02e78d3cc7773c4944
0daea272c1fa7bb54113cfc6948f10b9346f2cf05000ac5b57aaed5cef8dae05
e0fa9c62364826149547d32728d06d155bdc6a54e90554695f8039bd7b73d036
SH256 hash:
f4dbaec73ccd5c6431cf902d7327ddb9f2c87de2434226bb18948ba4ee5755ed
MD5 hash:
b45e9d751c574567757174ac44bf54a1
SHA1 hash:
642fc5f04600f8a8ba6feeec08cf94f281c40d0d
Detections:
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
Link:
https://www.unpac.me/results/db5c6303-d44e-4601-930f-b1bd48539394/
Parent samples :
56b97987918aafadb2b070083e19236388c3ac087b80a8d548c07ff31252eb17
6176ead880248cbccdf7df359034699e937249e13608b788be1b25158b09c1ca
3927622ef8e0a99764011d9f98f47bf0eb1a39df514a7e02e78d3cc7773c4944
0daea272c1fa7bb54113cfc6948f10b9346f2cf05000ac5b57aaed5cef8dae05
e0fa9c62364826149547d32728d06d155bdc6a54e90554695f8039bd7b73d036
SH256 hash:
3927622ef8e0a99764011d9f98f47bf0eb1a39df514a7e02e78d3cc7773c4944
MD5 hash:
1945e9b9e7b54901fb4443d1850f2223
SHA1 hash:
10cc5512e921e4d617f0c917589812f6179bf90b
Link:
https://www.unpac.me/results/db5c6303-d44e-4601-930f-b1bd48539394/
SH256 hash:
3927622ef8e0a99764011d9f98f47bf0eb1a39df514a7e02e78d3cc7773c4944
MD5 hash:
1945e9b9e7b54901fb4443d1850f2223
SHA1 hash:
10cc5512e921e4d617f0c917589812f6179bf90b
Link:
https://www.unpac.me/results/db5c6303-d44e-4601-930f-b1bd48539394/
SH256 hash:
5e19c4b3486ed7902779d92c105f129d7dd36f642841cc6bde3c6213a0ddabea
MD5 hash:
fd56d047d6ad68623b46f78459fa2f5b
SHA1 hash:
cd4abb9c2ab8cf5777875d4958215ab71b3c1708
Link:
https://www.unpac.me/results/db5c6303-d44e-4601-930f-b1bd48539394/
SH256 hash:
49dd10bf34acb11a37a3b3250ab70f542b1739f74ef7ab4e90634520e7994795
MD5 hash:
9d9c165c33e6fc4fa90ab538695b74c3
SHA1 hash:
cb6a70b457625e5eeafd12464e883b7c9c78229c
Link:
https://www.unpac.me/results/db5c6303-d44e-4601-930f-b1bd48539394/
SH256 hash:
f4dbaec73ccd5c6431cf902d7327ddb9f2c87de2434226bb18948ba4ee5755ed
MD5 hash:
b45e9d751c574567757174ac44bf54a1
SHA1 hash:
642fc5f04600f8a8ba6feeec08cf94f281c40d0d
Detections:
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
Link:
https://www.unpac.me/results/db5c6303-d44e-4601-930f-b1bd48539394/
Parent samples :
56b97987918aafadb2b070083e19236388c3ac087b80a8d548c07ff31252eb17
6176ead880248cbccdf7df359034699e937249e13608b788be1b25158b09c1ca
3927622ef8e0a99764011d9f98f47bf0eb1a39df514a7e02e78d3cc7773c4944
0daea272c1fa7bb54113cfc6948f10b9346f2cf05000ac5b57aaed5cef8dae05
e0fa9c62364826149547d32728d06d155bdc6a54e90554695f8039bd7b73d036
SH256 hash:
3927622ef8e0a99764011d9f98f47bf0eb1a39df514a7e02e78d3cc7773c4944
MD5 hash:
1945e9b9e7b54901fb4443d1850f2223
SHA1 hash:
10cc5512e921e4d617f0c917589812f6179bf90b
Link:
https://www.unpac.me/results/db5c6303-d44e-4601-930f-b1bd48539394/
SH256 hash:
5e19c4b3486ed7902779d92c105f129d7dd36f642841cc6bde3c6213a0ddabea
MD5 hash:
fd56d047d6ad68623b46f78459fa2f5b
SHA1 hash:
cd4abb9c2ab8cf5777875d4958215ab71b3c1708
Link:
https://www.unpac.me/results/db5c6303-d44e-4601-930f-b1bd48539394/
SH256 hash:
49dd10bf34acb11a37a3b3250ab70f542b1739f74ef7ab4e90634520e7994795
MD5 hash:
9d9c165c33e6fc4fa90ab538695b74c3
SHA1 hash:
cb6a70b457625e5eeafd12464e883b7c9c78229c
Link:
https://www.unpac.me/results/db5c6303-d44e-4601-930f-b1bd48539394/
SH256 hash:
f4dbaec73ccd5c6431cf902d7327ddb9f2c87de2434226bb18948ba4ee5755ed
MD5 hash:
b45e9d751c574567757174ac44bf54a1
SHA1 hash:
642fc5f04600f8a8ba6feeec08cf94f281c40d0d
Detections:
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
DCRatMiscInfoGrabberPlugin
Create hunting rule
Link:
https://www.unpac.me/results/db5c6303-d44e-4601-930f-b1bd48539394/
Parent samples :
56b97987918aafadb2b070083e19236388c3ac087b80a8d548c07ff31252eb17
6176ead880248cbccdf7df359034699e937249e13608b788be1b25158b09c1ca
3927622ef8e0a99764011d9f98f47bf0eb1a39df514a7e02e78d3cc7773c4944
0daea272c1fa7bb54113cfc6948f10b9346f2cf05000ac5b57aaed5cef8dae05
e0fa9c62364826149547d32728d06d155bdc6a54e90554695f8039bd7b73d036
SH256 hash:
3927622ef8e0a99764011d9f98f47bf0eb1a39df514a7e02e78d3cc7773c4944
MD5 hash:
1945e9b9e7b54901fb4443d1850f2223
SHA1 hash:
10cc5512e921e4d617f0c917589812f6179bf90b
Link:
https://www.unpac.me/results/db5c6303-d44e-4601-930f-b1bd48539394/
SH256 hash:
0daea272c1fa7bb54113cfc6948f10b9346f2cf05000ac5b57aaed5cef8dae05
MD5 hash:
bb1918c93c2a8f8afdc85c766e707349
SHA1 hash:
f2f7fe6dc3ccf125f912041f50adbeb0d59ecc9d
Link:
https://www.unpac.me/results/db5c6303-d44e-4601-930f-b1bd48539394/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/0daea272c1fa/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0daea272c1fa7bb54113cfc6948f10b9346f2cf05000ac5b57aaed5cef8dae05

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SelfExtractingRAR
Create hunting rule
Author:Xavier Mertens
Description:Detects an SFX archive with automatic script execution
Rule name:SUSP_NET_Msil_Suspicious_Use_StrReverse
Create hunting rule
Author:dr4k0nia, modified by Florian Roth
Description:Detects mixed use of Microsoft.CSharp and VisualBasic to use StrReverse
Reference:https://github.com/dr4k0nia/yara-rules

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/402739/

Comments