MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4faac7b368c5b46e3a5cc10300e9be5ad85463c29a8d38025c8ec386ed06a9de. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DCRat


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4faac7b368c5b46e3a5cc10300e9be5ad85463c29a8d38025c8ec386ed06a9de
SHA3-384 hash: f3dcee30c0367f89d76844da7289bb8d36d0d30206e9eb89e567e7f771395562c982ad93e10afcdcd8297fb8e7bb677b
SHA1 hash: b8f39041eb1e294b4952197a06d33e8bf885714f
MD5 hash: a19d22a2f5989d2e2dc98bb62bfcf9fb
humanhash: undress-oven-ack-asparagus
File name:a19d22a2f5989d2e2dc98bb62bfcf9fb.exe
Download: download sample
Signature DCRat
Create hunting rule
File size:45'981'696 bytes
First seen:2024-01-30 10:50:24 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash d5d9d937853db8b666bd4b525813d7bd (40 x DCRat, 28 x njrat, 5 x RedLineStealer)
ssdeep 786432:yLEB9kPgvPAK9UGJ7dcsfh3n9dCmBSIARXSK6dZPpj4HabgRVUv+oIr7IPaDm0zY:EE/ko19UeWsfh3n9lGRCK0h8HygAvjIq
Threatray 202 similar samples on MalwareBazaar
TLSH T13AA733ECF230AD4BD6429CBDD78632D2B763C52F45C6BA56F14998358C500B863A2F1E
TrID 27.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
20.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
18.6% (.EXE) Win32 Executable (generic) (4505/5/1)
8.5% (.ICL) Windows Icons Library (generic) (2059/9)
8.3% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 05e6767464f01b0b (1 x DCRat)
Reporter abuse_ch
Tags:DCRat exe


Avatar
abuse_ch
DCRat C2:
http://f0912091.xsph.ru/L1nc0In.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
379
Origin country :
NL NL
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
lolbin packed poison shell32
Link:
https://www.filescan.io/uploads/65b8d49af9733b1319adf622/reports/775a2e15-a317-4285-908d-d2e947e42bab/overview
Verdict:
Malicious
Labled as:
Trojan.MSIL.Injector
Link:
https://www.hybrid-analysis.com/sample/4faac7b368c5b46e3a5cc10300e9be5ad85463c29a8d38025c8ec386ed06a9de
Result
Verdict:
MALICIOUS
Result
Threat name:
DCRat
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1383245
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Creates processes via WMI
Drops PE files with benign system names
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: Schedule system process
Sigma detected: Suspicious Process Patterns NTDS.DIT Exfil
Uses schtasks.exe or at.exe to add and modify task schedules
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Yara detected DCRat
Yara detected Python Keylogger
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1383245 Sample: tOCTdBymcy.exe Startdate: 30/01/2024 Architecture: WINDOWS Score: 100 79 Found malware configuration 2->79 81 Antivirus detection for dropped file 2->81 83 Antivirus / Scanner detection for submitted sample 2->83 85 11 other signatures 2->85 11 tOCTdBymcy.exe 10 2->11         started        14 System.exe 2->14         started        16 System.exe 2->16         started        process3 file4 59 C:\Users\user\AppData\Local\...\MinerBot.exe, PE32 11->59 dropped 61 C:\Users\user\AppData\Local\...\MineBot3.exe, PE32+ 11->61 dropped 18 MineBot3.exe 60 11->18         started        22 MinerBot.exe 3 6 11->22         started        process5 file6 47 C:\Users\user\AppData\Local\...\_yaml.pyd, PE32+ 18->47 dropped 49 C:\Users\user\AppData\...\unicodedata.pyd, PE32+ 18->49 dropped 51 C:\Users\user\AppData\Local\...\select.pyd, PE32+ 18->51 dropped 57 37 other files (35 malicious) 18->57 dropped 87 Multi AV Scanner detection for dropped file 18->87 24 conhost.exe 18->24         started        53 C:\OneDriveTemp\OneDriveLog.exe, PE32 22->53 dropped 55 C:\...\0PcTrXAlD3jypOm6ldYXDSJa4eNj.vbe, data 22->55 dropped 89 Antivirus detection for dropped file 22->89 91 Machine Learning detection for dropped file 22->91 26 wscript.exe 1 22->26         started        signatures7 process8 signatures9 93 Windows Scripting host queries suspicious COM object (likely to drop second stage) 26->93 29 cmd.exe 1 26->29         started        process10 process11 31 OneDriveLog.exe 3 28 29->31         started        35 conhost.exe 29->35         started        file12 63 C:\Windows\...\siMGnuvhjsipzoBQYpeeuDsF.exe, PE32 31->63 dropped 65 C:\Windows\Fonts\ApplicationFrameHost.exe, PE32 31->65 dropped 67 C:\Recovery\siMGnuvhjsipzoBQYpeeuDsF.exe, PE32 31->67 dropped 69 9 other malicious files 31->69 dropped 71 Antivirus detection for dropped file 31->71 73 Multi AV Scanner detection for dropped file 31->73 75 Machine Learning detection for dropped file 31->75 77 3 other signatures 31->77 37 schtasks.exe 31->37         started        39 schtasks.exe 31->39         started        41 schtasks.exe 31->41         started        43 28 other processes 31->43 signatures13 process14 process15 45 Conhost.exe 37->45         started       
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/4faac7b368c5b46e3a5cc10300e9be5ad85463c29a8d38025c8ec386ed06a9de
Gathering data
Threat name:
Win32.Trojan.VBinder
Create hunting rule
Status:
Malicious
First seen:
2024-01-25 06:18:37 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
22 of 24 (91.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=j6vmpm3iyw2g4os4yebqb2n6llmfiy6ctkgtqas4r3byn3igvhpa._file
Verdict:
malicious
Similar samples:
07fa9ac4502b2a0ba83036450abbe28d6656c8941abf5180e81650550aa50a4e
DCRat
1e1a63dc013e9571d1430993d08eb080e5f97339e107efcfdb39bae9aef8ce54
DCRat
3dd0a5685e10ef6d63758cafee7c651f8ae80a47664158976ace7b80c825a032
DCRat
4faac7b368c5b46e3a5cc10300e9be5ad85463c29a8d38025c8ec386ed06a9de
DCRat
7fed6406da8c6fac0504f899f2d88cf18c82b40d10d28e0651d851aa8113a13b
DCRat
db27a1103437042989486896fb714fd8cd59a856a7db453bbcc2162794b3fde6
DCRat
db356737d8940879b057bd0173aae780602b9ceb0a5790bd90e12c5cfc194088
DCRat
+ 192 additional samples on MalwareBazaar
Result
Malware family:
dcrat
Create hunting rule
Score:
  10/10
Tags:
family:dcrat infostealer rat
Link:
https://tria.ge/reports/240130-mxtzesede5/
Behaviour
Creates scheduled task(s)
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Enumerates physical storage devices
Drops file in Program Files directory
Drops file in Windows directory
Legitimate hosting services abused for malware hosting/C2
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
DCRat payload
DcRat
Process spawned unexpected child process
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4faac7b368c5b46e3a5cc10300e9be5ad85463c29a8d38025c8ec386ed06a9de

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments