MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1f80a5027a30b618996426f0c02d630d7b275351f524fd9b5644e9f6db779be9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DCRat


Vendor detections: 15


Intelligence 15 IOCs YARA 22 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1f80a5027a30b618996426f0c02d630d7b275351f524fd9b5644e9f6db779be9
SHA3-384 hash: 0f6900a0a256357d956743427a8b2f5f582a7eb727d4f6393c38877369204068f4a2a57f48c0deb71dc8067a5691d1cc
SHA1 hash: 750a79c28091f2e1242f960f236b71f728b0fa85
MD5 hash: b6229695d985886bba02cff6677df2ca
humanhash: tennis-oscar-utah-stairway
File name:b6229695d985886bba02cff6677df2ca.exe
Download: download sample
Signature DCRat
Create hunting rule
File size:1'363'456 bytes
First seen:2024-01-12 13:45:22 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 2e5467cba76f44a088d39f78c5e807b6 (131 x DCRat, 112 x njrat, 79 x RedLineStealer)
ssdeep 24576:IvGLtTM3hq7t17N1E7Ey7pVPcdKGx36JWCHfA1GqagTmOBI5fK8TPrTrDIUJjv:Iv4qQH7N1OvVwh3E9NOLBmPX5
Threatray 185 similar samples on MalwareBazaar
TLSH T18A5533B0D6B64061CBCB1F741333CDCD0DFA1819C4A673B89E9A0D1F77644AA894BA5E
TrID 25.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
19.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.1% (.EXE) Win32 Executable (generic) (4505/5/1)
7.8% (.EXE) Win16/32 Executable Delphi generic (2072/23)
7.8% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter abuse_ch
Tags:DCRat exe


Avatar
abuse_ch
DCRat C2:
http://45.87.246.118/ProviderimageRequestWindowswpprivate.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
360
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
dcrat
Create hunting rule
ID:
1
File name:
1f80a5027a30b618996426f0c02d630d7b275351f524fd9b5644e9f6db779be9.exe
Verdict:
Malicious activity
Analysis date:
2024-01-12 14:12:52 UTC
Tags:
rat backdoor dcrat remote stealer
Link:
https://app.any.run/tasks/1b8ed84a-44b0-490c-985b-51882798dbd9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/470543/
Detection(s):
PUA.Win.Packer.EnigmaProtector-19
Create hunting rule

PUA.Win.Packer.EnigmaProtector-1
Create hunting rule

Win.Malware.Agen-7623769-0
Create hunting rule

PUA.Win.Packer.EnigmaProtector-9852682-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a file in the Program Files subdirectories
Creating a file
Creating a file in the %temp% directory
Running batch commands
Creating a process with a hidden window
Launching a process
Creating a process from a recently created file
Sending an HTTP POST request
Creating a window
Using the Windows Management Instrumentation requests
Searching for synchronization primitives
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
bladabindi enigma lolbin obfuscated packed packed shell32 zusy
Link:
https://www.filescan.io/uploads/65a142a659502c0e7b33ec0e/reports/b38a934c-a012-46d3-bbd3-271506bc36d6/overview
Verdict:
Malicious
Labled as:
Zusy.Generic
Link:
https://www.hybrid-analysis.com/sample/1f80a5027a30b618996426f0c02d630d7b275351f524fd9b5644e9f6db779be9
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/03db379f-3ee1-4034-93c2-7e6a64cbe713
Result
Threat name:
DCRat
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1373780
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Drops PE files with benign system names
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has nameless sections
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected DCRat
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1373780 Sample: btmE6N0Jqf.exe Startdate: 12/01/2024 Architecture: WINDOWS Score: 100 49 Snort IDS alert for network traffic 2->49 51 Antivirus detection for dropped file 2->51 53 Antivirus / Scanner detection for submitted sample 2->53 55 6 other signatures 2->55 8 btmE6N0Jqf.exe 4 22 2->8         started        process3 file4 29 C:\Windows\ModemLogs\MrsTcviOQTy.exe, PE32 8->29 dropped 31 C:\Windows\...\MrsTcviOQTy.exe, PE32 8->31 dropped 33 C:\Users\user\Recent\winlogon.exe, PE32 8->33 dropped 35 4 other malicious files 8->35 dropped 57 Detected unpacking (changes PE section rights) 8->57 59 Detected unpacking (overwrites its own PE header) 8->59 61 Hides threads from debuggers 8->61 63 Drops PE files with benign system names 8->63 12 cmd.exe 1 8->12         started        signatures5 process6 process7 14 winlogon.exe 15 11 12->14         started        19 w32tm.exe 1 12->19         started        21 conhost.exe 12->21         started        23 chcp.com 1 12->23         started        dnsIp8 39 45.87.246.118, 49699, 49700, 49703 IPOCEANUPLINKSR Russian Federation 14->39 37 C:\Users\user\Desktop\qGZDAfUC.log, PE32 14->37 dropped 41 Antivirus detection for dropped file 14->41 43 Multi AV Scanner detection for dropped file 14->43 45 Detected unpacking (changes PE section rights) 14->45 47 4 other signatures 14->47 25 WerFault.exe 19 16 14->25         started        27 w32tm.exe 1 19->27         started        file9 signatures10 process11
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/1f80a5027a30b618996426f0c02d630d7b275351f524fd9b5644e9f6db779be9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1f80a5027a30b618996426f0c02d630d7b275351f524fd9b5644e9f6db779be9/
Threat name:
Win32.Trojan.Zusy
Create hunting rule
Status:
Malicious
First seen:
2024-01-07 00:18:53 UTC
File Type:
PE (Exe)
AV detection:
28 of 37 (75.68%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=d6akkat2gc3brglee3ymalldbv5sou2r6usp3g2witu7nw3xtpuq._file
Verdict:
malicious
Similar samples:
2b1fed2ea6c60f4ab2e657bb20d60d0acda9deea0795efe50c4eb2e31f7312e9
DCRat
4ae98d07149ba3a2d9e00594f4da6e65c0386a6e95c0fb168a05607cbb0d2a65
DCRat
5250a7d14874c55bebe18f783f9534fae7a79174fdd93efa5a96e079dcaefe83
DCRat
9c8162115273ea9afdba3d35d7451f45913ba9764ad626a4cbebc8e9eb734396
DCRat
af8ed3e4cea6a4cae238eb0b8bac1d06eaba83000160588f826e2220089b9077
DCRat
b6b5276afcb6ce09d0b8a88a03d3b5f86200ac02954aa7fcab4601d1fbaf75fb
DCRat
eccaec76c66960ba7245ac0b0d60c5f79ed52603a8333da79668ef4e78f42059
DCRat
+ 175 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
spyware stealer
Link:
https://tria.ge/reports/240112-q2y1qahgh6/
Behaviour
Modifies registry class
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
cc70e04104c8e37c237a87a135049b5e71558dbe13cb8411a2e0e4b76f6f3f29
MD5 hash:
a9191b22d054e9bbc20d1138b3be696a
SHA1 hash:
4698a4131fc807207279af62ed3de7f7b5ecf458
Link:
https://www.unpac.me/results/1392f188-64cb-4eb6-81ec-078f821e7f14/
SH256 hash:
1f80a5027a30b618996426f0c02d630d7b275351f524fd9b5644e9f6db779be9
MD5 hash:
b6229695d985886bba02cff6677df2ca
SHA1 hash:
750a79c28091f2e1242f960f236b71f728b0fa85
Detections:
SUSP_XORed_URL_In_EXE
Create hunting rule
Link:
https://www.unpac.me/results/1392f188-64cb-4eb6-81ec-078f821e7f14/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1f80a5027a30b618996426f0c02d630d7b275351f524fd9b5644e9f6db779be9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BobSoftMiniDelphiBoBBobSoft
Create hunting rule
Author:malware-lu
Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:EnigmaProtector11X13XSukhovVladimirSergeNMarkin
Create hunting rule
Author:malware-lu
Rule name:EnigmaStub
Create hunting rule
Author:@bartblaze
Description:Identifies Enigma packer stub.
Rule name:INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File
Create hunting rule
Author:ditekSHen
Description:Detects executables containing bas64 encoded gzip files
Rule name:maldoc_getEIP_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_XORed_URL_In_EXE
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects an XORed URL in an executable
Reference:https://twitter.com/stvemillertime/status/1237035794973560834
Rule name:SUSP_XORed_URL_in_EXE_RID2E46
Create hunting rule
Author:Florian Roth
Description:Detects an XORed URL in an executable
Reference:https://twitter.com/stvemillertime/status/1237035794973560834
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/470543/

Comments