MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2443613407a5446d2903068af37ad22a559393bf78673c3ce42a64dd7605b5dd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DCRat


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2443613407a5446d2903068af37ad22a559393bf78673c3ce42a64dd7605b5dd
SHA3-384 hash: 1984c20af24c813dcf9a237c69e9c6f97c31ac3367bf4c593838bfb6196e1cd9ea93535e49e206cf67f8199747e08a3a
SHA1 hash: 164e579529896eeda74546a4f3867640911cc4e7
MD5 hash: 18ecc18f69e7894c5dc41a49bc8742fb
humanhash: river-sweet-william-juliet
File name:2443613407a5446d2903068af37ad22a559393bf78673c3ce42a64dd7605b5dd
Download: download sample
Signature DCRat
Create hunting rule
File size:1'307'388 bytes
First seen:2021-09-30 07:40:13 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash fcf1390e9ce472c7270447fc5c61a0c1 (863 x DCRat, 118 x NanoCore, 94 x njrat)
ssdeep 24576:U2G/nvxW3Ww0t9rT7iaNedPjW2v2SNT5UsqCcHJCb+4n:UbA308D91q9JJC
Threatray 813 similar samples on MalwareBazaar
TLSH T119555A127A84DD12D26A1B3BC9EF405447BCBD017A62CB1A7EAE336E65113A74E0D1CF
File icon (PE):PE icon
dhash icon 9494b494d4aeaeac (832 x DCRat, 172 x RedLineStealer, 134 x CryptOne)
Reporter JAMESWT_WT
Tags:DCRat exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
138
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/193396/
Detection(s):
Win.Malware.Uztuby-9848412-0
Create hunting rule

Win.Packed.Uztuby-9851623-0
Create hunting rule

Win.Trojan.Uztuby-9855059-0
Create hunting rule

Win.Ransomware.Clinix-9868408-0
Create hunting rule

Win.Packed.Uztuby-9875336-0
Create hunting rule

SecuriteInfo.com.Trojan.Rasftuby.Gen.14.10239.27368.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
Creating a file
Creating a process from a recently created file
Running batch commands
Creating a process with a hidden window
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3c40222d-f40d-451d-b303-9faf7d07c5fb
Result
Threat name:
DCRat
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/862276
Signature
Creates an autostart registry key pointing to binary in C:\Windows
Creates multiple autostart registry keys
Creates processes via WMI
Drops executables to the windows directory (C:\Windows) and starts them
Drops PE files with benign system names
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected DCRat
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 494712 Sample: 4EUZxy2O7S Startdate: 30/09/2021 Architecture: WINDOWS Score: 100 43 us-east-1.route-1.000webhost.awex.io 2->43 45 ip-api.com 2->45 47 cunctatory-milk.000webhostapp.com 2->47 59 Multi AV Scanner detection for dropped file 2->59 61 Multi AV Scanner detection for submitted file 2->61 63 Yara detected DCRat 2->63 65 4 other signatures 2->65 10 4EUZxy2O7S.exe 3 6 2->10         started        13 dllhost.exe 7 3 2->13         started        17 msiexec.exe 3 2->17         started        19 4 other processes 2->19 signatures3 process4 dnsIp5 41 FontDriverSessionR...iverSavesCommon.exe, PE32 10->41 dropped 21 wscript.exe 1 10->21         started        49 us-east-1.route-1.000webhost.awex.io 145.14.145.223, 49757, 49759, 49776 AWEXUS Netherlands 13->49 51 ip-api.com 208.95.112.1, 49758, 49760, 49785 TUT-ASUS United States 13->51 57 2 other IPs or domains 13->57 75 System process connects to network (likely due to code injection or exploit) 13->75 77 Multi AV Scanner detection for dropped file 13->77 79 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 13->79 81 Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines) 13->81 83 May check the online IP address of the machine 17->83 53 cunctatory-milk.000webhostapp.com 19->53 55 cunctatory-milk.000webhostapp.com 19->55 file6 signatures7 process8 process9 23 cmd.exe 1 21->23         started        process10 25 FontDriverSessionRuntimedriverSavesCommon.exe 6 15 23->25         started        29 conhost.exe 23->29         started        file11 33 C:\Windows\System32\wbem\...\WmiPrvSE.exe, PE32 25->33 dropped 35 C:\Windows\SchCache\dllhost.exe, PE32 25->35 dropped 37 C:\Recovery\msiexec.exe, PE32 25->37 dropped 39 2 other malicious files 25->39 dropped 67 Multi AV Scanner detection for dropped file 25->67 69 Creates multiple autostart registry keys 25->69 71 Creates an autostart registry key pointing to binary in C:\Windows 25->71 73 2 other signatures 25->73 31 FontDriverSessionRuntimedriverSavesCommon.exe 2 25->31         started        signatures12 process13
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2443613407a5446d2903068af37ad22a559393bf78673c3ce42a64dd7605b5dd/
Threat name:
ByteCode-MSIL.Trojan.ZmutzyLscpt
Create hunting rule
Status:
Malicious
First seen:
2021-09-28 03:54:27 UTC
AV detection:
23 of 45 (51.11%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
07df44c8c194ae93a713ff62e81a65f7deba348f322029b97db182520e57c86b
DCRat
0dc975463ed56da75689bc1dbee1f22007743a1beaf5417951c186b967a597f8
DCRat
0e439b622658ab71228c7388ec456c7baf041046d7eff1a37bc9c02177c324ed
DCRat
4cba3cb0188c4a064f6dd99ead74f76156d73019e15eec1a3653b28c8ac7a112
DCRat
51b8434c68594113a4036358e477fe1ae1b4cc0b99d653b224250e24537d87e2
DCRat
6923f777931474820c95c6efa6229ecfa4d03409435f1509d196cff7c4289043
DCRat
95155b1eb26b2f4d548de9b64239aa4339c191a56b9f1e61697351dced1c9bc7
DCRat
99b234ed5fcab5f1e2ebbc0a26fd5e94a3efa69fadb275065592ea7cba636e16
DCRat
b88350726e9a1dc492b8fde7c03fdd0f5c7669b6919e1c25ddbcb8a69125c330
DCRat
ff1cf221e44187ccf5382ba91b26991722b97d2dd0ef25ae0b5fda12425a4a93
DCRat
+ 803 additional samples on MalwareBazaar
Result
Malware family:
dcrat
Create hunting rule
Score:
  10/10
Tags:
family:dcrat infostealer persistence rat
Link:
https://tria.ge/reports/210930-jh6swsghe7/
Behaviour
Creates scheduled task(s)
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Drops file in Windows directory
Drops file in System32 directory
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
DCRat Payload
DcRat
Process spawned unexpected child process
Unpacked files
SH256 hash:
66e4732f64f15bd8d5c13dcba1bd533d12d759b41254ba0ed8d8b8ec2cc33135
MD5 hash:
d97b75d4f73f1ac378780cb64daa8d66
SHA1 hash:
5c430c9c63c1352af6f1b8b3f5270c9e3d53426b
Link:
https://www.unpac.me/results/080b3a79-fe82-459b-8bd8-12b9400962e5/
SH256 hash:
4428c1eafc37dee3696d8880cd3b6dba44f6adca96ec9f3cfda26dda7ced5c73
MD5 hash:
8c396f9170cec8710592e5ce6e453af6
SHA1 hash:
a2ab801565b2797584712cbaa576b1e5b6acc59c
Link:
https://www.unpac.me/results/080b3a79-fe82-459b-8bd8-12b9400962e5/
SH256 hash:
2443613407a5446d2903068af37ad22a559393bf78673c3ce42a64dd7605b5dd
MD5 hash:
18ecc18f69e7894c5dc41a49bc8742fb
SHA1 hash:
164e579529896eeda74546a4f3867640911cc4e7
Link:
https://www.unpac.me/results/080b3a79-fe82-459b-8bd8-12b9400962e5/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2443613407a5446d2903068af37ad22a559393bf78673c3ce42a64dd7605b5dd

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/193396/

Comments