MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3f36c33a05be0ec69135c73ab25fc3edb4426ee8f92784945acf36a8d0187d5f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

DCRat

Vendor detections: 18

Intelligence 18 IOCs YARA File information Comments

SHA256 hash:	3f36c33a05be0ec69135c73ab25fc3edb4426ee8f92784945acf36a8d0187d5f
SHA3-384 hash:	95a139773060a5c09384902f2582a4cb3c0ccb8848ed6f9bb4f03abe7673e658426056e7b818ac412da2463a44b567fc
SHA1 hash:	5da7b42fdb972de60352f6a4dc491596aaa2f10d
MD5 hash:	f764228dcdce3c10f834b33843819e1d
humanhash:	march-nevada-sad-triple
File name:	f764228dcdce3c10f834b33843819e1d.exe
Download:	download sample
Signature	DCRat Create hunting rule
File size:	262'144 bytes
First seen:	2023-12-16 06:20:39 UTC
Last seen:	2023-12-16 08:22:27 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	0e6aa5088f0c41b623834536ead5feeb (1 x RiseProStealer, 1 x Glupteba, 1 x DCRat)
ssdeep	3072:BUFFOz0AQbNAd1dWi8oMztFcafn8j4nWjlHA0n4Cu63QjMrajuHrB78:kFOodGdr7MztFcA8j4qlHAVGQjT8
Threatray	1'479 similar samples on MalwareBazaar
TLSH	T146448D12B3D1A032E61319318A65C2F42A2AFCE28F5666DB67986F3F4D712D1CA71703
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	0008060323061331 (1 x DCRat)
Reporter	abuse_ch
Tags:	DCRat exe

abuse_ch

DCRat C2:
http://188.120.254.27/GeoSecure/Cpu/Http4voiddbPrivate/6PhpDownloadsPoll/videovmLineprocessAuthgameProtectBasetrackuploads.php

Intelligence

File Origin

# of uploads :

# of downloads :

326

Origin country :

Vendor Threat Intelligence

Malware family:

smoke

ID:

File name:

f764228dcdce3c10f834b33843819e1d.exe

Verdict:

Malicious activity

Analysis date:

2023-12-16 06:24:31 UTC

Tags:

loader smoke smokeloader

Link:

https://app.any.run/tasks/2a9c7007-7b9c-4fee-81d8-a8626c4749d5

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

SmokeLoader

Link:

https://www.capesandbox.com/analysis/467936/

Detection(s):

SecuriteInfo.com.Win32.BotX-gen.9281.19415.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Sending a custom TCP request

Сreating synchronization primitives

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

DNS request

Sending an HTTP GET request

Creating a process from a recently created file

Query of malicious DNS domain

Sending a TCP request to an infection source

Unauthorized injection to a system process

Enabling autorun by creating a file

Sending an HTTP POST request to an infection source

Gathering data

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

control lolbin packed xpack

Link:

https://www.filescan.io/uploads/657d41d0f4b6e5e1634ba598/reports/73b772f5-6758-4956-a929-5b40258a788e/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/3f36c33a05be0ec69135c73ab25fc3edb4426ee8f92784945acf36a8d0187d5f

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/719bd032-165e-430e-9815-9c890cea72bc

Result

Threat name:

SmokeLoader

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1363278

Signature

Antivirus detection for URL or domain

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/3f36c33a05be0ec69135c73ab25fc3edb4426ee8f92784945acf36a8d0187d5f

Detection:

smokeloader

Link:

https://mwdb.cert.pl/sample/3f36c33a05be0ec69135c73ab25fc3edb4426ee8f92784945acf36a8d0187d5f/

Threat name:

Win32.Trojan.Smokeloader

Status:

Malicious

First seen:

2023-12-16 03:26:10 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

21 of 37 (56.76%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=h43mgoqfxyhmnejvy45lex6d5w2ee3xi7etyjfc2z43kruaypvpq._file

Verdict:

malicious

DCRat

0ef76ecabac1c81d4e2ed32c6fd30d846214f385a51523b4b78f105d9eb406a3

DCRat

247eb6cc11d0a92ac985fb99c19dcfe4779878f4989764b8ced06727820ff57c

DCRat

3b73c4da6f2bda6ebc26552afccbfd8c097a5a3195fd2593840d9ea7712b7120

DCRat

5c88a340b3b0502c9777fe6159f01d66875341dc739e23a56a21ee18479890f2

DCRat

6a302e65ae3cd7ceb6a94b2753f1a3223b189355eecbe443b0fd45722a495f48

DCRat

a73ee8f46c7caf4da7ea6a92dc0a11d58757a83e1b5b9c3723b49690fc238271

DCRat

e629fcf41de2187cafd4c8c38b1e9408a5c521d29459971bb96fae5da26fa9d5

DCRat

ecacf78ad957224fcc0afbd65118f2b5e8e2eda5daef0e072eef35e5f12a43b3

DCRat

+ 1'469 additional samples on MalwareBazaar

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:smokeloader botnet:pub1 backdoor spyware stealer trojan

Link:

https://tria.ge/reports/231216-g4bhrsaffq/

Behaviour

Checks SCSI registry key(s)

Modifies registry class

Runs ping.exe

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Enumerates physical storage devices

Drops file in Program Files directory

Drops file in Windows directory

Checks computer location settings

Deletes itself

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Downloads MZ/PE file

SmokeLoader

Malware Config

C2 Extraction:

http://humydrole.com/tmp/index.php
http://trunk-co.ru/tmp/index.php
http://weareelight.com/tmp/index.php
http://pirateking.online/tmp/index.php
http://piratia.pw/tmp/index.php
http://go-piratia.ru/tmp/index.php