MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 37082f0b757d6c249b870c29872a9bf8e38e344150735d9b6d2a64364b18b226. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DCRat


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 37082f0b757d6c249b870c29872a9bf8e38e344150735d9b6d2a64364b18b226
SHA3-384 hash: 9c4d352c6b81f29d0827741e1dc2fc4bb38b9825bb16916073e9e87854a080760db65d050ac3ca85fb1e507eb98b4ee1
SHA1 hash: c26d73d2e6c921d13904e472c3abaeabbe635b2c
MD5 hash: a8754096cc985cad9eb65e303a07a348
humanhash: hawaii-winter-yellow-spring
File name:setup_4.21.exe
Download: download sample
Signature DCRat
Create hunting rule
File size:288'256 bytes
First seen:2022-12-30 09:48:13 UTC
Last seen:2022-12-30 11:39:08 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'647 x AgentTesla, 19'451 x Formbook, 12'201 x SnakeKeylogger)
ssdeep 6144:e5S8E4TF+fiXzBbnDEV+bvFFDc8dOB21RjSgO03cRXR/9VhaRLSbDsfWrk:UE4TwKXSVwFFDc8dOB21RjSgO03cRXRc
Threatray 3'664 similar samples on MalwareBazaar
TLSH T14254999D726072EFC85BD472DEA82C68EA5074BB931F4213A02715ADEE4D897CF144F2
TrID 45.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.4% (.EXE) Win64 Executable (generic) (10523/12/4)
9.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.6% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter DonPasci
Tags:DCRat exe


Avatar
DonPasci
Downloaded from https://adobereaders.co/ -> https://bravebrowsers.cc/setup_4.21.exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
172
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
setup_4.21.exe
Verdict:
Malicious activity
Analysis date:
2022-12-29 22:54:58 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/ab8eca13-9b5a-4ebf-9b0f-e39db25d68b2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
PUA.Win.Packed.ConfuserEx-6391397-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
DNS request
Sending a custom TCP request
Running batch commands
Creating a process with a hidden window
Creating a file in the %temp% directory
Creating a file
Launching a process
Creating a process from a recently created file
Using the Windows Management Instrumentation requests
Unauthorized injection to a recently created process
Enabling autorun by creating a file
Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Tags:
njrat packed rat
Link:
https://www.filescan.io/uploads/63aeb40fb9b1c173751ff925/reports/7596bce5-7ed1-4a95-9ae0-1dc405de6a3e/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6320a692-5b3c-461a-a768-3ad78d1ca280
Result
Threat name:
DcRat
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1143009
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has nameless sections
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected DcRat
Yara detected Generic Downloader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 775734 Sample: setup_4.21.exe Startdate: 30/12/2022 Architecture: WINDOWS Score: 100 46 Antivirus / Scanner detection for submitted sample 2->46 48 Multi AV Scanner detection for submitted file 2->48 50 Yara detected DcRat 2->50 52 3 other signatures 2->52 7 Setup_4.21.exe 2 2->7         started        11 setup_4.21.exe 14 7 2->11         started        process3 dnsIp4 34 system-checki.com 7->34 54 Antivirus detection for dropped file 7->54 56 Multi AV Scanner detection for dropped file 7->56 58 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 7->58 60 Machine Learning detection for dropped file 7->60 36 keyauth.win 188.114.96.3, 443, 49691, 49692 CLOUDFLARENETUS European Union 11->36 38 system-checki.com 11->38 30 C:\Users\user\AppData\...\Setup_4.21.exe, PE32 11->30 dropped 32 C:\Users\user\AppData\...\setup_4.21.exe.log, ASCII 11->32 dropped 62 Detected unpacking (changes PE section rights) 11->62 14 cmd.exe 1 11->14         started        17 cmd.exe 1 11->17         started        file5 signatures6 process7 signatures8 64 Uses schtasks.exe or at.exe to add and modify task schedules 14->64 19 conhost.exe 14->19         started        21 schtasks.exe 1 14->21         started        23 Setup_4.21.exe 1 2 17->23         started        26 conhost.exe 17->26         started        28 timeout.exe 1 17->28         started        process9 dnsIp10 40 78.47.195.75, 4449, 49701 HETZNER-ASDE Germany 23->40 42 188.114.97.3, 443, 49699, 49700 CLOUDFLARENETUS European Union 23->42 44 2 other IPs or domains 23->44
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/37082f0b757d6c249b870c29872a9bf8e38e344150735d9b6d2a64364b18b226/
Threat name:
Win32.Trojan.Woreflint
Create hunting rule
Status:
Malicious
First seen:
2022-12-29 08:15:24 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
23 of 26 (88.46%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=g4ec6c3vpvwcjg4hbquyoku37dry4ncbkbzv3g3nfjsdmsyywita._file
Verdict:
malicious
Similar samples:
319eebfe268b98849276901a885c1764cd0d964691fbe0d58689ef2a62f051c9
DCRat
703b1802d40218a99be7cad5d4661db3d988bf23bd9fcae5f3f851089e4c2c24
DCRat
c0bd5fcd7a91eb868dddb6172f5e576b5efa1a4c57a7f5cade8f4cef236fb001
DCRat
c0bf6bfcde19ac2738ba721e9d293961bea4881f624283de876aa919eb5c0df0
DCRat
c37384635caee6d22483b5d86d237886e7aaa086882eca66fddcb93936fbc51b
DCRat
c43676781fca6b654af09543db51c110a90669ab8ebc3e3958f97457674f21ab
DCRat
c7dc6a8a03f4b02dd7bd2171adf105d40af49cd5a5d58d890aec160f3bc8ab3b
DCRat
caa904d7e0d470975318568eec0840cbf46b58e122c64e6d41c903399569a7b0
DCRat
+ 3'654 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/221230-ltb4rsfd23/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/0ac5fbc8-a6c6-4647-a20c-976e2976f2d6
Unpacked files
SH256 hash:
5d6d2096762250bd2778b645548714cd5be58a22e0db53eb73c733fdd5907a20
MD5 hash:
34f9da0015d272a713328785a7b5ef4f
SHA1 hash:
4779e4d1c6cbb763ca94ba14ed29928c52102d29
Link:
https://www.unpac.me/results/513e986f-be34-4160-b1be-05064238c3a3/
SH256 hash:
37082f0b757d6c249b870c29872a9bf8e38e344150735d9b6d2a64364b18b226
MD5 hash:
a8754096cc985cad9eb65e303a07a348
SHA1 hash:
c26d73d2e6c921d13904e472c3abaeabbe635b2c
Link:
https://www.unpac.me/results/513e986f-be34-4160-b1be-05064238c3a3/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.92
Link:
https://yomi.yoroi.company/submissions/37082f0b757d6c249b870c29872a9bf8e38e344150735d9b6d2a64364b18b226

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_ConfuserEx
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ConfuserEx Mod
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DCRat

Executable exe 37082f0b757d6c249b870c29872a9bf8e38e344150735d9b6d2a64364b18b226

(this sample)

anyrun
any.run
https://app.any.run/tasks/76950c8f-ce06-441d-84e5-7ff2eb3e3a40
  
Delivery method
Distributed via web download

Comments


Avatar
DonPasci commented on 2022-12-30 10:26:11 UTC

Also mentioned here: https://twitter.com/Unit42_Intel/status/1608567622856998912