MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 53a815cac9e27b538eda23642b19a3d7bba41c19e4d07f5c3f427d581b73cac8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DCRat


Vendor detections: 8


Intelligence 8 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 53a815cac9e27b538eda23642b19a3d7bba41c19e4d07f5c3f427d581b73cac8
SHA3-384 hash: a62a72284a757257d91f83aa7a57df8dfc7ce20ff2aabc69e9a599b5884e5f666a3d5fd6a32f476867477ac249a2f8aa
SHA1 hash: b6c75b8550510fa16f8082247ed1cf2c57029569
MD5 hash: 2f32139f0c559f561ff33681ad2f46c8
humanhash: coffee-golf-august-delta
File name:2f32139f0c559f561ff33681ad2f46c8.exe
Download: download sample
Signature DCRat
Create hunting rule
File size:944'640 bytes
First seen:2021-10-28 20:26:56 UTC
Last seen:2021-10-28 21:02:55 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 3fd48f2b49a69674203a1b3779fc17fd (2 x DCRat)
ssdeep 24576:pKD/WPlFGJ7ebaTZ1rJu9j9hF98IzsVh:sD+PlFyqba/V
Threatray 394 similar samples on MalwareBazaar
TLSH T18215DF96012C004AD7D517750B5A61E2EE3FB9BFE0F32B3528D15F85A262CB508AFB17
File icon (PE):PE icon
dhash icon d2eaeaf27afee6fa (3 x CoinMiner, 2 x DCRat, 1 x AsyncRAT)
Reporter abuse_ch
Tags:DCRat exe


Avatar
abuse_ch
DCRat C2:
http://94.250.251.68/vmcpu.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://94.250.251.68/vmcpu.php https://threatfox.abuse.ch/ioc/239352/

Intelligence

File Origin
# of uploads :
2
# of downloads :
189
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Spy.21595.9188.570.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/53dfd200-27eb-4454-974a-4fa6e04ac8dd
Result
Threat name:
DCRat
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/878873
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Creates an autostart registry key pointing to binary in C:\Windows
Creates multiple autostart registry keys
Creates processes via WMI
Drops PE files to the user root directory
Drops PE files with benign system names
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Execution from Suspicious Folder
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected DCRat
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 511307 Sample: KeHT6rxyE7.exe Startdate: 28/10/2021 Architecture: WINDOWS Score: 100 45 Found malware configuration 2->45 47 Antivirus detection for dropped file 2->47 49 Antivirus / Scanner detection for submitted sample 2->49 51 6 other signatures 2->51 8 KeHT6rxyE7.exe 2 2->8         started        12 ctfmon.exe 3 2->12         started        14 DUiNWcPMLpHMODfmll.exe 3 2->14         started        16 9 other processes 2->16 process3 dnsIp4 39 C:\Users\Public\OperaGX.exe, PE32 8->39 dropped 61 Drops PE files to the user root directory 8->61 19 OperaGX.exe 10 19 8->19         started        63 Antivirus detection for dropped file 12->63 65 Multi AV Scanner detection for dropped file 12->65 67 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 12->67 69 2 other signatures 12->69 41 94.250.251.68, 49745, 49746, 49747 THEFIRST-ASRU Russian Federation 16->41 43 192.168.2.1 unknown unknown 16->43 file5 signatures6 process7 file8 31 C:\Windows\...\backgroundTaskHost.exe, PE32 19->31 dropped 33 C:\Windows\Registration\CRMLog\HxTsr.exe, PE32 19->33 dropped 35 C:\Users\Public\Videos\ctfmon.exe, PE32 19->35 dropped 37 3 other malicious files 19->37 dropped 53 Antivirus detection for dropped file 19->53 55 Multi AV Scanner detection for dropped file 19->55 57 Creates multiple autostart registry keys 19->57 59 3 other signatures 19->59 23 cmd.exe 1 19->23         started        signatures9 process10 process11 25 OperaGX.exe 2 23->25         started        27 w32tm.exe 1 23->27         started        29 conhost.exe 23->29         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/53a815cac9e27b538eda23642b19a3d7bba41c19e4d07f5c3f427d581b73cac8/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-10-20 01:02:00 UTC
AV detection:
9 of 26 (34.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=koublswj4j5vhdw2enscwgnd2652ihaz4tih6xb7ij6vqg3tzlea._file
Verdict:
malicious
Similar samples:
2f09f4d2b8e06f116dd784829712dcd3bb9528e580ccf6313e4c99fbb89a7792
DCRat
3943324bc46207fd39e2518eb019a79eaceaef8b0d24c02f980384fea0fdacf8
DCRat
4b356bb2813fcbcab1930a5e3687d600e54e4c0e603e17acd630e70ba27d960e
DCRat
51b8434c68594113a4036358e477fe1ae1b4cc0b99d653b224250e24537d87e2
DCRat
8106d9ab42eacd3d5c1f4f49ba80f65dd60f8d812d2274b2ae1b2fb23048944f
DCRat
95155b1eb26b2f4d548de9b64239aa4339c191a56b9f1e61697351dced1c9bc7
DCRat
99b234ed5fcab5f1e2ebbc0a26fd5e94a3efa69fadb275065592ea7cba636e16
DCRat
b1712ed2922c7af304903adfc55fc79a8a097f06b2fb98072ebfb3b44fbd3ad1
DCRat
c39d68efeada072170dc0be43e29b61f92cd62f70e3cc4ef31fd44d1aa44d5c0
DCRat
+ 384 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/211028-y8d8wsghfn/
Unpacked files
SH256 hash:
2d35c3005d341c55e309780f58d694e7b548f456a5389d992052794bbb8ea04f
MD5 hash:
b17e52352a0bba46b13b56e4c22e0232
SHA1 hash:
75fde8048c0f398d0072693ed0b0fedf3de0d5cc
Link:
https://www.unpac.me/results/b4c9aa3f-6e7f-4cbe-b22f-f2684c53a272/
SH256 hash:
53a815cac9e27b538eda23642b19a3d7bba41c19e4d07f5c3f427d581b73cac8
MD5 hash:
2f32139f0c559f561ff33681ad2f46c8
SHA1 hash:
b6c75b8550510fa16f8082247ed1cf2c57029569
Link:
https://www.unpac.me/results/b4c9aa3f-6e7f-4cbe-b22f-f2684c53a272/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/53a815cac9e27b538eda23642b19a3d7bba41c19e4d07f5c3f427d581b73cac8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments