MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 19f9835c63341d5bc4b2a8832c984e499fb712e2cbac4e1d4b40460eb1cd9d4d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DCRat


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 19f9835c63341d5bc4b2a8832c984e499fb712e2cbac4e1d4b40460eb1cd9d4d
SHA3-384 hash: e7777bc6323396b82aab7321e4b3d5a1f86c67b3d13948b86397254f591c018a1f37643167573e7e84ba352191c855ad
SHA1 hash: 5a3433c1ab51afaf89ee36bad21844e806458606
MD5 hash: 9bf95e2b426fa17931960f2ddc10b9c0
humanhash: cup-video-vermont-violet
File name:19f9835c63341d5bc4b2a8832c984e499fb712e2cbac4e1d4b40460eb1cd9d4d
Download: download sample
Signature DCRat
Create hunting rule
File size:3'206'164 bytes
First seen:2021-02-28 07:26:28 UTC
Last seen:2021-02-28 08:59:40 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 4328f7206db519cd4e82283211d98e83 (533 x RedLineStealer, 18 x Arechclient2, 15 x DCRat)
ssdeep 98304:8i0pwcwvFf52XBVv5O5EQilrvobxJmBHM:J0jIfK4u9rSDmBHM
Threatray 231 similar samples on MalwareBazaar
TLSH 1CE5336799E1E274D8C7DFF9D21413F8643C4EB47E83A22F7E242E409760B8579DA284
Reporter JAMESWT_WT
Tags:DCRat

Intelligence

File Origin
# of uploads :
2
# of downloads :
797
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
19f9835c63341d5bc4b2a8832c984e499fb712e2cbac4e1d4b40460eb1cd9d4d
Verdict:
Malicious activity
Analysis date:
2021-02-28 08:25:00 UTC
Tags:
rat backdoor dcrat trojan evasion
Link:
https://app.any.run/tasks/d58c7a4a-994d-4226-92ec-61ca97e9ff51

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/119976/
Detection(s):
SecuriteInfo.com.Variant.Symmi.96352.7983.18474.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Searching for analyzing tools
Searching for the window
Using the Windows Management Instrumentation requests
Creating a file
Launching a process
Creating a file in the Program Files subdirectories
Creating a process from a recently created file
Sending an HTTP GET request
Creating a window
Creating a file in the %temp% directory
Deleting a recently created file
Reading critical registry keys
DNS request
Sending a custom TCP request
Setting a global event handler for the keyboard
Stealing user critical data
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
DCRat
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/620742
Signature
.NET source code contains in memory code execution
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code references suspicious native API functions
Detected unpacking (changes PE section rights)
Drops executable to a common third party application directory
Drops PE files to the user root directory
Drops PE files with benign system names
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to harvest and steal browser information (history, passwords, etc)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected DCRat
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 359364 Sample: nMDBqK8n9e Startdate: 28/02/2021 Architecture: WINDOWS Score: 100 53 Found malware configuration 2->53 55 Multi AV Scanner detection for dropped file 2->55 57 Multi AV Scanner detection for submitted file 2->57 59 13 other signatures 2->59 7 nMDBqK8n9e.exe 2 17 2->7         started        11 backgroundTaskHost.exe 3 2->11         started        13 csrss.exe 3 2->13         started        15 5 other processes 2->15 process3 dnsIp4 39 C:\Users\user\WmiPrvSE.exe, PE32 7->39 dropped 41 C:\Users\Public\Downloads\csrss.exe, PE32 7->41 dropped 43 C:\Users\Default\...\backgroundTaskHost.exe, PE32 7->43 dropped 45 5 other malicious files 7->45 dropped 69 Detected unpacking (changes PE section rights) 7->69 71 Query firmware table information (likely to detect VMs) 7->71 73 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 7->73 85 4 other signatures 7->85 18 WmiPrvSE.exe 7->18         started        21 schtasks.exe 1 7->21         started        23 schtasks.exe 1 7->23         started        25 5 other processes 7->25 75 Multi AV Scanner detection for dropped file 11->75 77 Machine Learning detection for dropped file 11->77 79 Hides threads from debuggers 11->79 81 Tries to detect sandboxes / dynamic malware analysis system (registry check) 13->81 47 188.120.255.162, 49716, 49727, 49729 THEFIRST-ASRU Russian Federation 15->47 49 ipinfo.io 216.239.32.21, 443, 49728 GOOGLEUS United States 15->49 51 192.168.2.1 unknown unknown 15->51 83 Tries to harvest and steal browser information (history, passwords, etc) 15->83 file5 signatures6 process7 signatures8 61 Multi AV Scanner detection for dropped file 18->61 63 Detected unpacking (changes PE section rights) 18->63 65 Query firmware table information (likely to detect VMs) 18->65 67 4 other signatures 18->67 27 conhost.exe 21->27         started        29 conhost.exe 23->29         started        31 conhost.exe 25->31         started        33 conhost.exe 25->33         started        35 conhost.exe 25->35         started        37 2 other processes 25->37 process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/19f9835c63341d5bc4b2a8832c984e499fb712e2cbac4e1d4b40460eb1cd9d4d/
Threat name:
Win32.Backdoor.LightStone
Create hunting rule
Status:
Malicious
First seen:
2021-02-28 07:27:17 UTC
AV detection:
19 of 47 (40.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dh4ygxddgqovxrfsvcbszgcojgp3oexczowe4hklibda5montvgq._file
Verdict:
malicious
Similar samples:
36cbc77a5caaf8f805bc7347ee4cd27657fca600ea5e202e633aca7a09d73297
DCRat
593f9422a79559ab792b98a272ebd5db883b8a85f34de6a6f05f1c900b221dc5
DCRat
7499c45e246fe759ff4180bd864252689b1cbadc7825d007c7e25aa39c6a4450
DCRat
7f2da313a75add2d2762a6f8ef8ca2828fb96661ab726b8aaad79ae5f89577c9
DCRat
8086d2b05316a9b44f55971a6c90da8ecb069d075973654f5f914229dc3070f6
DCRat
ae3974aeea651951c5c5802cf7a556c7626529790db1fd34f29be31c29f58ce2
DCRat
c0e6f7a4aa809d2b93ba137245380ada0a44ac5576935e13e165d02b1b937583
DCRat
c120fd3e62a0ecd299625f3fbf622fb8a56b534828b6788fe766f1bc36ac7a68
DCRat
cbf41a6d78de6866a9f86a9d1b2b63720f4ea5f63c9be909764154e6bd674f66
DCRat
f05d76c071555f48ff240556f6d0d3d895493c3c411e182648d256f83ad657e5
DCRat
+ 221 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  9/10
Tags:
evasion spyware themida trojan
Link:
https://tria.ge/reports/210228-ny5bk6cjke/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Drops file in Windows directory
Drops file in System32 directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks whether UAC is enabled
Looks up external IP address via web service
Checks BIOS information in registry
Loads dropped DLL
Reads user/profile data of web browsers
themida
Executes dropped EXE
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Unpacked files
SH256 hash:
dcb842f5e0da9d486cad34d4b809dcaadf9ec4d6991fdb22bdc9aea66489ad1a
MD5 hash:
c02a029c978f13b753c6b578b1588c75
SHA1 hash:
e125d59451e7f467bfd329a00a506decbcd91d83
Link:
https://www.unpac.me/results/905cf13d-3768-4ce2-8088-75c904d103f9/
SH256 hash:
19f9835c63341d5bc4b2a8832c984e499fb712e2cbac4e1d4b40460eb1cd9d4d
MD5 hash:
9bf95e2b426fa17931960f2ddc10b9c0
SHA1 hash:
5a3433c1ab51afaf89ee36bad21844e806458606
Link:
https://www.unpac.me/results/905cf13d-3768-4ce2-8088-75c904d103f9/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/19f9835c63341d5bc4b2a8832c984e499fb712e2cbac4e1d4b40460eb1cd9d4d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_Themida
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with Themida

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/119976/

Comments