MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2e148f224d98e0b49554d3612f6f49a690324906c3abb65cf67d8059d644254e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DCRat


Vendor detections: 14


Intelligence 14 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2e148f224d98e0b49554d3612f6f49a690324906c3abb65cf67d8059d644254e
SHA3-384 hash: 5b507452666c7107813454123eadd178f9cdfa8a16c3238072c883d7c817ba3d5fabd226d3da363595375664f2f3d96c
SHA1 hash: 23e7fc5c14d3b31da577c7fa45454021adb940e9
MD5 hash: 6e5b1d8423522d91271f5321764a0fd6
humanhash: black-tennis-kansas-papa
File name:6E5B1D8423522D91271F5321764A0FD6
Download: download sample
Signature DCRat
Create hunting rule
File size:1'697'881 bytes
First seen:2022-11-30 15:15:13 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash fcf1390e9ce472c7270447fc5c61a0c1 (863 x DCRat, 118 x NanoCore, 94 x njrat)
ssdeep 24576:P2G/nvxW3W50ZpX/gYXrbYrH6XmJcgwRXzoEM55VD7H/BxC4dqFHCFaw2:PbA3TZCkMH6swtOJ7H3C4MNCc
Threatray 3'869 similar samples on MalwareBazaar
TLSH T12E757C017E408991F0192E33CAAF4504A7B49C546AA6E31FF9B933ED2527392FD0D5EB
TrID 91.0% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39)
3.6% (.EXE) Win64 Executable (generic) (10523/12/4)
1.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
1.5% (.EXE) Win32 Executable (generic) (4505/5/1)
0.6% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 10808a8c8c8a8010 (77 x Formbook, 51 x AgentTesla, 44 x RemcosRAT)
Reporter rabbit84061341
Tags:DCRat exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
104
Origin country :
SG SG
Vendor Threat Intelligence
Malware family:
dcrat
Create hunting rule
ID:
1
File name:
6E5B1D8423522D91271F5321764A0FD6
Verdict:
Malicious activity
Analysis date:
2022-12-01 00:18:24 UTC
Tags:
trojan rat backdoor dcrat
Link:
https://app.any.run/tasks/0037ab91-5940-4a64-bf48-e92c3939cb52

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
DCRat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/340250/
Detection(s):
Win.Trojan.Uztuby-9855059-0
Create hunting rule

Win.Ransomware.Clinix-9868408-0
Create hunting rule

Win.Packed.Msilmamut-9950860-0
Create hunting rule

Win.Packed.Basic-9952747-0
Create hunting rule

Win.Packed.Uztuby-9963900-0
Create hunting rule

Win.Packed.Uztuby-9969968-0
Create hunting rule

Win.Malware.Uztuby-9972880-0
Create hunting rule

Win.Trojan.DarkKomet-9976180-0
Create hunting rule

SecuriteInfo.com.Trojan.Rasftuby.Gen.14.10239.27368.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file
Creating a process from a recently created file
Sending a custom TCP request
Running batch commands
Creating a process with a hidden window
Using the Windows Management Instrumentation requests
Launching a process
Creating a file in the Windows subdirectories
Unauthorized injection to a recently created process
Enabling autorun by creating a file
Sending an HTTP GET request to an infection source
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware overlay packed packed setupapi.dll shdocvw.dll shell32.dll
Link:
https://www.filescan.io/uploads/638773b89c57db591d891f10/reports/300cd1e2-9665-41e5-b95f-155a04d52564/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d5e1fcd4-4daf-4b29-a8b2-4d43ad1dc39e
Result
Threat name:
DCRat
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1125246
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Creates processes via WMI
Drops executables to the windows directory (C:\Windows) and starts them
Drops PE files with benign system names
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected DCRat
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 757968 Sample: 2wMTWZdrOO.exe Startdate: 01/12/2022 Architecture: WINDOWS Score: 100 40 Antivirus detection for URL or domain 2->40 42 Antivirus detection for dropped file 2->42 44 Antivirus / Scanner detection for submitted sample 2->44 46 8 other signatures 2->46 8 2wMTWZdrOO.exe 3 6 2->8         started        11 Registry.exe 2 2->11         started        14 lsass.exe 2->14         started        16 27 other processes 2->16 process3 file4 36 C:\portbrowser\comBrowsersaves.exe, PE32 8->36 dropped 38 C:\portbrowser\24UIYZyN.vbe, data 8->38 dropped 18 wscript.exe 1 8->18         started        56 Antivirus detection for dropped file 11->56 58 Machine Learning detection for dropped file 11->58 signatures5 process6 process7 20 cmd.exe 1 18->20         started        process8 22 comBrowsersaves.exe 1 20 20->22         started        26 conhost.exe 20->26         started        file9 28 C:\portbrowser\fontdrvhost.exe, PE32 22->28 dropped 30 C:\portbrowser\csrss.exe, PE32 22->30 dropped 32 C:\Windows\Prefetch\lsass.exe, PE32 22->32 dropped 34 5 other malicious files 22->34 dropped 48 Antivirus detection for dropped file 22->48 50 Machine Learning detection for dropped file 22->50 52 Creates processes via WMI 22->52 54 Drops PE files with benign system names 22->54 signatures10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2e148f224d98e0b49554d3612f6f49a690324906c3abb65cf67d8059d644254e/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2022-05-25 13:34:07 UTC
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fyki6isntdqljfku2nqs632ju2idesigyov3mxhwpwaftvseevha._file
Verdict:
malicious
Label(s):
asyncrat
Create hunting rule
Similar samples:
04135780f196e873e66305a4c74aa13920a13a04047459e3fb4a7beaf029c19f
DCRat
3900163fd89de58034a893e72448e0f823e2e3c676f93cf62ac65dcbf33bc5fa
DCRat
8de91a0a553b5e674bef172e43b59bd57bb14f80bf172a3869cb6e20b439fb9f
DCRat
989e25e4e59ab6778b3d50459aeaec98c97211ee9cbdea8b75c140bda008770b
DCRat
bf135724716fdb8f935249e97e33949db73caa02b89e7044fc273f4ae630b2d4
DCRat
+ 3'859 additional samples on MalwareBazaar
Result
Malware family:
dcrat
Create hunting rule
Score:
  10/10
Tags:
family:dcrat infostealer rat
Link:
https://tria.ge/reports/221130-snjd8abd84/
Behaviour
Creates scheduled task(s)
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Drops file in Windows directory
Checks computer location settings
Loads dropped DLL
Executes dropped EXE
DCRat payload
DcRat
Process spawned unexpected child process
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/91d6ba87-02f0-4996-a4b7-cdf3569747bb
Unpacked files
SH256 hash:
f63e2c1b90217f2bb18217d8499f596bb476deaf53b98a3ea22f4fdd39db7686
MD5 hash:
fb9b26b3ffbceea92f4574d050700375
SHA1 hash:
fe93136bc13b3f202dab4378e30d3046d2cb576e
Link:
https://www.unpac.me/results/b4407e0c-bb1f-4a11-a493-01445202de74/
SH256 hash:
18b3e8f3e520a9cc9d08c0c0862dcee20a56cb31a15e9c5447b49c0d7d16a31c
MD5 hash:
083b5e561a6ddf6507ded12d598a1813
SHA1 hash:
c256a0ed966d8e82b02b5ecbecf740fc0eaf5370
Link:
https://www.unpac.me/results/b4407e0c-bb1f-4a11-a493-01445202de74/
SH256 hash:
2e148f224d98e0b49554d3612f6f49a690324906c3abb65cf67d8059d644254e
MD5 hash:
6e5b1d8423522d91271f5321764a0fd6
SHA1 hash:
23e7fc5c14d3b31da577c7fa45454021adb940e9
Link:
https://www.unpac.me/results/b4407e0c-bb1f-4a11-a493-01445202de74/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2e148f224d98e0b49554d3612f6f49a690324906c3abb65cf67d8059d644254e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:sfx_pdb
Create hunting rule
Author:@razvialex
Description:Detect interesting files containing sfx with pdb paths.
Rule name:sfx_pdb_winrar_restrict
Create hunting rule
Author:@razvialex
Description:Detect interesting files containing sfx with pdb paths.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/340250/

Comments