MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 10f96939c15a6f55b87d79d5fb6550196a599c5fbe223bca7bedeafdb0f5266e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DCRat


Vendor detections: 13


Intelligence 13 IOCs YARA 23 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 10f96939c15a6f55b87d79d5fb6550196a599c5fbe223bca7bedeafdb0f5266e
SHA3-384 hash: e565cb26a3657a85df5d5e0a43450ea17c905dcbb46b5017e2608c8b12bc0b3811cc803a58669ebde5c170c7025ee4bd
SHA1 hash: 7a32f4a7c8e6395861f4e9e47066e77db252a2f1
MD5 hash: 29494ca96f86c8b9dc724c4a684f0fa5
humanhash: blue-sad-nitrogen-mirror
File name:29494ca96f86c8b9dc724c4a684f0fa5.exe
Download: download sample
Signature DCRat
Create hunting rule
File size:1'973'181 bytes
First seen:2023-10-10 11:15:42 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 12e12319f1029ec4f8fcbed7e82df162 (390 x DCRat, 52 x RedLineStealer, 51 x Formbook)
ssdeep 49152:kBqBIebbTZN6BSp8qPswvCS078TB2XccO0V+vmHQbl4TaB6:u/evTb6BSPN1qG8l+WM/6
Threatray 764 similar samples on MalwareBazaar
TLSH T1159512E1FFE4B872D01120727564A63C73FABD149F2548EBE38BE90EB4204C1A575A5B
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4505/5/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 00414f4f4f4f4700 (14 x CoinMiner, 12 x RedLineStealer, 12 x NodeLoader)
Reporter abuse_ch
Tags:DCRat exe


Avatar
abuse_ch
DCRat C2:
http://n9shteam2.top/nyashsupport.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
310
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
dcrat
Create hunting rule
ID:
1
File name:
dawyjdsegr.exe
Verdict:
Malicious activity
Analysis date:
2023-07-07 03:19:55 UTC
Tags:
rat backdoor dcrat stealer
Link:
https://app.any.run/tasks/103214d0-c554-48a9-95e4-6543a9cee0c4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.38920448.13962.7593.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file in the %temp% subdirectories
Running batch commands
Creating a process from a recently created file
Creating a file in the Program Files subdirectories
Using the Windows Management Instrumentation requests
Launching a process
Creating a file
Creating a file in the Windows subdirectories
Sending a custom TCP request
Creating a process with a hidden window
Sending a UDP request
Enabling autorun by creating a file
Gathering data
Gathering data
Verdict:
Malicious
Labled as:
Trojan.Rasftuby.Generic
Link:
https://www.hybrid-analysis.com/sample/10f96939c15a6f55b87d79d5fb6550196a599c5fbe223bca7bedeafdb0f5266e
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2e26d58f-b080-40e8-81b0-c0c4fc6d30ac
Result
Threat name:
DCRat
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1322807
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Creates processes via WMI
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Hides threads from debuggers
Machine Learning detection for dropped file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has nameless sections
Sigma detected: Schedule system process
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected DCRat
Yara detected Generic Downloader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1322807 Sample: i7BnE7JIYI.exe Startdate: 10/10/2023 Architecture: WINDOWS Score: 100 41 Found malware configuration 2->41 43 Malicious sample detected (through community Yara rule) 2->43 45 Antivirus detection for URL or domain 2->45 47 11 other signatures 2->47 8 i7BnE7JIYI.exe 13 2->8         started        11 schtasks.exe 2->11         started        13 schtasks.exe 2->13         started        15 31 other processes 2->15 process3 file4 31 C:\Users\user\AppData\Local\Temp\...\work.exe, PE32 8->31 dropped 17 cmd.exe 1 8->17         started        process5 process6 19 work.exe 9 17->19         started        23 conhost.exe 17->23         started        file7 29 C:\Users\user\AppData\Local\Temp\...\fesw.exe, PE32 19->29 dropped 49 Multi AV Scanner detection for dropped file 19->49 25 fesw.exe 1 27 19->25         started        signatures8 process9 file10 33 C:\Windows\...\gQMsZGtqcEDwzZlCdOj.exe, PE32 25->33 dropped 35 C:\Windows\Panther\UnattendGC\sihost.exe, PE32 25->35 dropped 37 C:\Windows\...\gQMsZGtqcEDwzZlCdOj.exe, PE32 25->37 dropped 39 9 other malicious files 25->39 dropped 51 Antivirus detection for dropped file 25->51 53 Multi AV Scanner detection for dropped file 25->53 55 Detected unpacking (changes PE section rights) 25->55 57 4 other signatures 25->57 signatures11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/10f96939c15a6f55b87d79d5fb6550196a599c5fbe223bca7bedeafdb0f5266e/
Threat name:
Win32.Trojan.Rasftuby
Create hunting rule
Status:
Malicious
First seen:
2023-07-07 05:46:19 UTC
File Type:
PE (Exe)
Extracted files:
38
AV detection:
18 of 38 (47.37%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cd4wsoobljxvlod5phk7wzkqdfvfthc7xyrdxst35xvp3mhvezxa._file
Verdict:
malicious
Similar samples:
1ee69c42df83049fca14e2560bacb7fef8e412f7da3cf2215c83e668b5673c4d
DCRat
4ae98d07149ba3a2d9e00594f4da6e65c0386a6e95c0fb168a05607cbb0d2a65
DCRat
75ae798473d4f1a4025f1a07e44fa307a0a317903a42b7e93a9a63b543efa255
DCRat
82e31b9bef8bdc34385c82db1239f570fccdb0b96a8f1ae0dcd4fa7abcc9ca25
DCRat
996c4e5418405912b929e7916def0a6c0aaedf77065ec5725f4782b00fb1464e
DCRat
cf96fa1da1fb359150e2e6d684a9457a7e01a794af2cbcdcdb23b67ceb1901ca
DCRat
d66671894b4128adf6ff365ef0769f831bfe4738c7452f1e094b0e35dda94b8a
DCRat
f1e4bb232f6e5e0bcfb68627aea7b09b114e8f6d15a57a6e2e938db455d768bb
DCRat
+ 754 additional samples on MalwareBazaar
Result
Malware family:
dcrat
Create hunting rule
Score:
  10/10
Tags:
family:dcrat infostealer rat spyware stealer
Link:
https://tria.ge/reports/231010-nc5e4ada5t/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Enumerates physical storage devices
Drops file in Program Files directory
Drops file in Windows directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
DCRat payload
DcRat
Process spawned unexpected child process
Unpacked files
SH256 hash:
10f96939c15a6f55b87d79d5fb6550196a599c5fbe223bca7bedeafdb0f5266e
MD5 hash:
29494ca96f86c8b9dc724c4a684f0fa5
SHA1 hash:
7a32f4a7c8e6395861f4e9e47066e77db252a2f1
Link:
https://www.unpac.me/results/f3396f86-bd2a-4416-85ac-888b1869c691/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/10f96939c15a6f55b87d79d5fb6550196a599c5fbe223bca7bedeafdb0f5266e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:DCRat
Create hunting rule
Author:Nikolaos 'n0t' Totosis
Description:DCRat Payload
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:EnigmaStub
Create hunting rule
Author:@bartblaze
Description:Identifies Enigma packer stub.
Rule name:INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File
Create hunting rule
Author:ditekSHen
Description:Detects executables containing bas64 encoded gzip files
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:maldoc_getEIP_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:MALWARE_Win_DCRat
Create hunting rule
Author:ditekSHen
Description:DCRat payload
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:Multifamily_RAT_Detection
Create hunting rule
Author:Lucas Acha (http://www.lukeacha.com)
Description:Generic Detection for multiple RAT families, PUPs, Packers and suspicious executables
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SelfExtractingRAR
Create hunting rule
Author:Xavier Mertens
Description:Detects an SFX archive with automatic script execution
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments