MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3927622ef8e0a99764011d9f98f47bf0eb1a39df514a7e02e78d3cc7773c4944. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DCRat


Vendor detections: 14


Intelligence 14 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3927622ef8e0a99764011d9f98f47bf0eb1a39df514a7e02e78d3cc7773c4944
SHA3-384 hash: 5051783a07c5c74dcb6ecc563c4b1583d635e7be0b294de976978c90819fb7b9ea3f9d251baf4a9cafd90484541f0a0a
SHA1 hash: 10cc5512e921e4d617f0c917589812f6179bf90b
MD5 hash: 1945e9b9e7b54901fb4443d1850f2223
humanhash: lactose-ack-kentucky-sweet
File name:HEUR-Backdoor.MSIL.LightStone.gen-3927622ef8e.exe
Download: download sample
Signature DCRat
Create hunting rule
File size:1'227'264 bytes
First seen:2023-06-25 13:50:08 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'748 x AgentTesla, 19'643 x Formbook, 12'245 x SnakeKeylogger)
ssdeep 24576:HDqgcjRDt0CD6eB/cqN8qpl55cr/BT7+4:jUftcqnn5iRq
Threatray 685 similar samples on MalwareBazaar
TLSH T14A452AA27E46DD02C16D163BC9DF886807A8EF417BA6DB1A7E5F335D24123A70D0D1CA
TrID 47.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
20.2% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
8.4% (.SCR) Windows screen saver (13097/50/3)
6.8% (.EXE) Win64 Executable (generic) (10523/12/4)
4.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
Reporter abuse_ch
Tags:DCRat exe


Avatar
abuse_ch
DCRat C2:
http://185.146.157.245/Mathlog/program/LinePhp_apidb.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
312
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
dcrat
Create hunting rule
ID:
1
File name:
HEUR-Backdoor.MSIL.LightStone.gen-3927622ef8e.exe
Verdict:
Malicious activity
Analysis date:
2023-06-25 13:52:54 UTC
Tags:
rat backdoor dcrat
Link:
https://app.any.run/tasks/a4272c54-59b4-4dc7-b192-648ea66778ac

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/402682/
Detection(s):
Win.Malware.Uztuby-9848412-0
Create hunting rule

Win.Packed.Uztuby-9851623-0
Create hunting rule

Win.Packed.Uztuby-9875336-0
Create hunting rule

Win.Packed.Uztuby-9877681-0
Create hunting rule

Win.Packed.Uztuby-9892756-0
Create hunting rule

Win.Packed.Basic-9897090-0
Create hunting rule

Win.Packed.Basic-9952747-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a file in the system32 subdirectories
Using the Windows Management Instrumentation requests
Launching a process
Creating a file
Creating a file in the Program Files subdirectories
Creating a process from a recently created file
Creating a process with a hidden window
Sending an HTTP GET request
DNS request
Sending a custom TCP request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug anti-vm cmd.exe explorer.exe hacktool lolbin net obfuscated packed schtasks.exe stealer
Link:
https://www.filescan.io/uploads/64984647aa4a3df2d5215e26/reports/ae59a8cf-4bde-41bd-aaef-8f8a1c3b31ac/overview
Verdict:
Malicious
Labled as:
Trojan[Backdoor]/MSIL.LightStone
Link:
https://www.hybrid-analysis.com/sample/3927622ef8e0a99764011d9f98f47bf0eb1a39df514a7e02e78d3cc7773c4944
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ea80c07b-6ddb-4255-bb2f-5f447a5e2ffb
Result
Threat name:
DCRat
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1261088
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Creates an autostart registry key pointing to binary in C:\Windows
Creates multiple autostart registry keys
Creates processes via WMI
Drops executables to the windows directory (C:\Windows) and starts them
Drops PE files to the user root directory
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Schedule system process
System process connects to network (likely due to code injection or exploit)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected DCRat
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 894108 Sample: HEUR-Backdoor.MSIL.LightSto... Startdate: 25/06/2023 Architecture: WINDOWS Score: 100 38 Found malware configuration 2->38 40 Malicious sample detected (through community Yara rule) 2->40 42 Antivirus detection for dropped file 2->42 44 12 other signatures 2->44 7 HEUR-Backdoor.MSIL.LightStone.gen-3927622ef8e.exe 9 27 2->7         started        11 dllhost.exe 7 2 2->11         started        14 fontdrvhost.exe 3 2->14         started        16 12 other processes 2->16 process3 dnsIp4 28 C:\Windows\System32\...\fontdrvhost.exe, PE32 7->28 dropped 30 C:\Windows\System32\ieui\RuntimeBroker.exe, PE32 7->30 dropped 32 C:\Windows\System32\...\dllhost.exe, PE32 7->32 dropped 34 9 other malicious files 7->34 dropped 46 Creates multiple autostart registry keys 7->46 48 Drops PE files to the user root directory 7->48 50 Creates an autostart registry key pointing to binary in C:\Windows 7->50 52 Creates processes via WMI 7->52 18 cmd.exe 1 7->18         started        36 git.megahub.me 185.146.157.245, 443, 49700, 49701 THEFIRST-ASRU Russian Federation 11->36 54 Antivirus detection for dropped file 11->54 56 System process connects to network (likely due to code injection or exploit) 11->56 58 Multi AV Scanner detection for dropped file 11->58 60 Machine Learning detection for dropped file 14->60 file5 signatures6 process7 process8 20 conhost.exe 18->20         started        22 chcp.com 1 18->22         started        24 w32tm.exe 18->24         started        26 mNfTNmFnkKXwawmiFqDxCOpZahNIC.exe 18->26         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3927622ef8e0a99764011d9f98f47bf0eb1a39df514a7e02e78d3cc7773c4944/
Threat name:
ByteCode-MSIL.Backdoor.DCRat
Create hunting rule
Status:
Malicious
First seen:
2021-09-12 20:21:00 UTC
File Type:
PE (.Net Exe)
AV detection:
26 of 37 (70.27%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hetwelxy4cuzozabdwpzr5d36dvruoo7kffh4axhru6mo5z4jfca._file
Verdict:
malicious
Similar samples:
49f8f8d74fc5f81ada3b288e56297334e35d07b0fc912f73aa9ba1b971639937
DCRat
4cced7c39444bc55a0cd79b0384b24517e355e0d70ab20019af96f2a7c181cd8
DCRat
51b8434c68594113a4036358e477fe1ae1b4cc0b99d653b224250e24537d87e2
DCRat
6176ead880248cbccdf7df359034699e937249e13608b788be1b25158b09c1ca
DCRat
6e491124fc83eb50eae434f1aafe070f9dba30d2ed03d10abd7cc2d91fcfc4dd
DCRat
d7fa1b64c4a5a79700791c113b5b2594a2194a8ca83bf18494337ef12d88fdb6
DCRat
+ 675 additional samples on MalwareBazaar
Result
Malware family:
dcrat
Create hunting rule
Score:
  10/10
Tags:
family:dcrat infostealer persistence rat
Link:
https://tria.ge/reports/230625-q5s9msea22/
Behaviour
Creates scheduled task(s)
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Enumerates physical storage devices
Drops file in Program Files directory
Drops file in System32 directory
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
DCRat payload
DcRat
Process spawned unexpected child process
Unpacked files
SH256 hash:
5e19c4b3486ed7902779d92c105f129d7dd36f642841cc6bde3c6213a0ddabea
MD5 hash:
fd56d047d6ad68623b46f78459fa2f5b
SHA1 hash:
cd4abb9c2ab8cf5777875d4958215ab71b3c1708
Link:
https://www.unpac.me/results/89097c90-e134-4f10-ae70-73921b69be60/
SH256 hash:
49dd10bf34acb11a37a3b3250ab70f542b1739f74ef7ab4e90634520e7994795
MD5 hash:
9d9c165c33e6fc4fa90ab538695b74c3
SHA1 hash:
cb6a70b457625e5eeafd12464e883b7c9c78229c
Link:
https://www.unpac.me/results/89097c90-e134-4f10-ae70-73921b69be60/
SH256 hash:
f4dbaec73ccd5c6431cf902d7327ddb9f2c87de2434226bb18948ba4ee5755ed
MD5 hash:
b45e9d751c574567757174ac44bf54a1
SHA1 hash:
642fc5f04600f8a8ba6feeec08cf94f281c40d0d
Detections:
DCRatMiscInfoGrabberPlugin
Create hunting rule
Link:
https://www.unpac.me/results/89097c90-e134-4f10-ae70-73921b69be60/
Parent samples :
56b97987918aafadb2b070083e19236388c3ac087b80a8d548c07ff31252eb17
6176ead880248cbccdf7df359034699e937249e13608b788be1b25158b09c1ca
3927622ef8e0a99764011d9f98f47bf0eb1a39df514a7e02e78d3cc7773c4944
0daea272c1fa7bb54113cfc6948f10b9346f2cf05000ac5b57aaed5cef8dae05
e0fa9c62364826149547d32728d06d155bdc6a54e90554695f8039bd7b73d036
SH256 hash:
5109a3c338b15884eede33963f2a35cff4834f6c8d31df11cec3875f8118351d
MD5 hash:
1cbe39b29e77cfc848bb09973edf5664
SHA1 hash:
05067052c80600c512a07a31a3695958820a5737
Link:
https://www.unpac.me/results/89097c90-e134-4f10-ae70-73921b69be60/
SH256 hash:
3927622ef8e0a99764011d9f98f47bf0eb1a39df514a7e02e78d3cc7773c4944
MD5 hash:
1945e9b9e7b54901fb4443d1850f2223
SHA1 hash:
10cc5512e921e4d617f0c917589812f6179bf90b
Link:
https://www.unpac.me/results/89097c90-e134-4f10-ae70-73921b69be60/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3927622ef8e0a99764011d9f98f47bf0eb1a39df514a7e02e78d3cc7773c4944

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:msil_suspicious_use_of_strreverse
Create hunting rule
Author:dr4k0nia
Description:Detects mixed use of Microsoft.CSharp and VisualBasic to use StrReverse
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_NET_Msil_Suspicious_Use_StrReverse
Create hunting rule
Author:dr4k0nia, modified by Florian Roth
Description:Detects mixed use of Microsoft.CSharp and VisualBasic to use StrReverse
Reference:https://github.com/dr4k0nia/yara-rules

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/402682/

Comments