MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 455a9224b709f9b67263691c09909f0d172718117e591d92f075ef4640ced3b6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DCRat


Vendor detections: 12


Intelligence 12 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 455a9224b709f9b67263691c09909f0d172718117e591d92f075ef4640ced3b6
SHA3-384 hash: f2456de20eafbb1fa476d486134355fc40829a2933bff4c438193bd78fc530fe9b3674adb80918c3de2913c04850e53b
SHA1 hash: c0c622ebbf7108e1a6ad0ccca169a98043efb7b8
MD5 hash: 2fdc033f491fae9f2aabaee78f73f076
humanhash: hamper-kansas-monkey-sink
File name:2fdc033f491fae9f2aabaee78f73f076.exe
Download: download sample
Signature DCRat
Create hunting rule
File size:1'110'544 bytes
First seen:2022-10-02 18:33:13 UTC
Last seen:2023-08-27 09:07:57 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 140cf1579162cb6677e74d888d2053d1 (2 x DCRat)
ssdeep 24576:6KsfHLD9eUv+xUeO6qCvA81bpmgg7ncEXL0n/DRsCP/4BZ:6ffHLgxxFfA81bkgg7ncML0nLRs4/4BZ
Threatray 126 similar samples on MalwareBazaar
TLSH T1FE353C13AC4171EEEA6286305A3E0A2C1F4F3E19635E952E03F2475347B79E18B275DE
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter abuse_ch
Tags:DCRat exe RAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
312
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
C4Loader.exe
Verdict:
Malicious activity
Analysis date:
2022-10-03 16:17:42 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/6fcd267c-7f59-4de3-9171-ccb87546df4d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/315804/
Detection(s):
Win.Malware.Pwsx-9963812-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Enabling autorun by creating a file
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/40675/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
CheckCmdLine
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
80%
Tags:
cridex dcrat greyware overlay packed
Link:
https://www.filescan.io/uploads/6339d99c5c60ccc9fcfee2a6/reports/51449fc2-09c4-4a14-8c71-661ae1fd4152/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/787a3fdb-97d8-415f-8296-f4e6bfa8ac30
Result
Threat name:
DCRat
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1081984
Signature
.NET source code contains potential unpacker
.NET source code contains very large strings
Antivirus detection for URL or domain
Disables UAC (registry)
Drops PE files to the startup folder
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Yara detected DCRat
Yara detected Generic Downloader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 714541 Sample: Dh5yHfSadU.exe Startdate: 02/10/2022 Architecture: WINDOWS Score: 100 42 Snort IDS alert for network traffic 2->42 44 Multi AV Scanner detection for domain / URL 2->44 46 Malicious sample detected (through community Yara rule) 2->46 48 9 other signatures 2->48 7 Dh5yHfSadU.exe 2 2->7         started        11 klService.exe 1 2->11         started        process3 file4 32 C:\Users\user\AppData\...\klService.exe, PE32 7->32 dropped 50 Drops PE files to the startup folder 7->50 13 AppLaunch.exe 19 6 7->13         started        18 WerFault.exe 23 9 7->18         started        20 conhost.exe 7->20         started        22 WerFault.exe 10 11->22         started        24 AppLaunch.exe 3 11->24         started        26 conhost.exe 11->26         started        signatures5 process6 dnsIp7 38 a-plague-tale.top 77.73.134.4, 49708, 49709, 49710 FIBEROPTIXDE Kazakhstan 13->38 34 153752f631c91555b3...d7037797bc0ce29.exe, PE32 13->34 dropped 52 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 13->52 54 Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines) 13->54 56 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 13->56 58 Disables UAC (registry) 13->58 28 wscript.exe 13->28         started        30 wscript.exe 13->30         started        40 192.168.2.1 unknown unknown 18->40 36 C:\ProgramData\Microsoft\...\Report.wer, Unicode 18->36 dropped file8 signatures9 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/455a9224b709f9b67263691c09909f0d172718117e591d92f075ef4640ced3b6/
Threat name:
Win32.Spyware.RedLine
Create hunting rule
Status:
Malicious
First seen:
2022-10-01 23:55:00 UTC
File Type:
PE (Exe)
AV detection:
19 of 41 (46.34%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ivnjejfxbh43m4tdneoatee7bulsogarpzmr3exqoxxumqgo2o3a._file
Verdict:
malicious
Similar samples:
6014786b41622c5201cdb283d606c70831da00f1d890087b2be68fb4f5515e71
DCRat
603f6820ab27891bd9d355fbe8e0502d337b90a81c6398ceea83d6a1f7445200
DCRat
789edea2f682ba7f2caf76a0a3ca8559c5204627fd4a829cc863f06017686ccf
DCRat
9f8ed5976f0221e19b5a8edd4127fb72a17b2d37be6fe8e9f5e0b8761c05349d
DCRat
dc8be2ac025f16d43a0e07910a6038cde589c261ad03f4c23cf275b10bf857c2
DCRat
f661ec60e29f3bd12a3d4db867d37cd78ab2104f7c27b63624433a66d514113b
DCRat
f8cb9d2119eca6763dfaca0c112ce6d8ee975a8602afce2be1dbb0c52c4b3768
DCRat
+ 116 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/221002-w7rfqafdg2/
Behaviour
Program crash
Drops startup file
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/dc588122-d60a-409a-9024-60eeb85481aa
Unpacked files
SH256 hash:
455a9224b709f9b67263691c09909f0d172718117e591d92f075ef4640ced3b6
MD5 hash:
2fdc033f491fae9f2aabaee78f73f076
SHA1 hash:
c0c622ebbf7108e1a6ad0ccca169a98043efb7b8
Link:
https://www.unpac.me/results/f20f88b4-5abf-463c-90ab-e1b998a78d2f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/455a9224b709f9b67263691c09909f0d172718117e591d92f075ef4640ced3b6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DCRat

Executable exe 455a9224b709f9b67263691c09909f0d172718117e591d92f075ef4640ced3b6

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2284516/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/315804/

Comments