MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 4c087150a0e17c46885efeced99be0b2a3f0f3d6209154aabd3c3871f1ec77d1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
DCRat
Vendor detections: 13
| SHA256 hash: | 4c087150a0e17c46885efeced99be0b2a3f0f3d6209154aabd3c3871f1ec77d1 |
|---|---|
| SHA3-384 hash: | ec744412e0c0adae858b5f381c57e777869efe101f3fc9baac1eb30383f129f7a17ed1705bc573649cc3e51585c8360d |
| SHA1 hash: | e9c8cbbe31b674f74f7056a748ac51c74b4311dc |
| MD5 hash: | befed138a635a6ab7395f50f5d9e7662 |
| humanhash: | california-winner-echo-kitten |
| File name: | file.exe |
| Download: | download sample |
| Signature | DCRat |
| File size: | 2'235'392 bytes |
| First seen: | 2023-05-31 07:47:13 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 89b3a6f6fa95f20a6ae4cdbb8278d185 (3 x RedLineStealer, 1 x DCRat) |
| ssdeep | 24576:yqgkC88oOyh+i5Q/39MJ6hzCrU/GHHUTB+8oeebf:ngkC8FOyU8u39MJ6hzHlI8ojf |
| Threatray | 9 similar samples on MalwareBazaar |
| TLSH | T1F1A5221135D68436D172183009E8EAB969BDB9A14F659DEF13D40FBF4B343C1C63BAA2 |
| TrID | 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1) |
| Reporter |  abuse_ch |
| Tags: | DCRat exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
251
Origin country :
NLVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file.exe
Verdict:
No threats detected
Analysis date:
2023-05-31 07:49:06 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
DCRat
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Creating a file
Launching a process
Creating a window
Сreating synchronization primitives
Searching for synchronization primitives
Unauthorized injection to a system process
Result
Malware family:
n/a
Score:
6/10
Tags:
n/a
Behaviour
MalwareBazaar
MeasuringTime
CheckCmdLine
EvasionQueryPerformanceCounter
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
dcrat lolbin packed shell32.dll
Verdict:
Malicious
Labled as:
Lazy.Generic
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Result
Threat name:
DCRat
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Writes to foreign memory regions
Yara detected DCRat
Yara detected Generic Downloader
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.RedLineStealer
Status:
Malicious
First seen:
2023-05-31 07:48:07 UTC
File Type:
PE (Exe)
AV detection:
18 of 24 (75.00%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
0b77f0bd5b7b0cc96993f50a2366a25a7a8f0295ebe102731e7489063c9521f4
MD5 hash:
338e15af5c344b31c719fea885e80da8
SHA1 hash:
f1d3b691df471323ac4763f997bb29caf3b72787
SH256 hash:
a8713375a3d67e482ecc27887126a467992c565c39fb6eb0e667a16a455e2b1a
MD5 hash:
cd814b92d67d5a1d04e43a12b97eb9c5
SHA1 hash:
aed121a2a24ebb58d8897cced92ef33aa6e57cb3
Detections:
win_xorist_auto
SH256 hash:
4c087150a0e17c46885efeced99be0b2a3f0f3d6209154aabd3c3871f1ec77d1
MD5 hash:
befed138a635a6ab7395f50f5d9e7662
SHA1 hash:
e9c8cbbe31b674f74f7056a748ac51c74b4311dc
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.