🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 54193af95cf82cdbcc2b331bfd7112915a54bfd872b4fce2e148777fff41a995. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DCRat


Vendor detections: 16


Intelligence 16 IOCs 1 YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 54193af95cf82cdbcc2b331bfd7112915a54bfd872b4fce2e148777fff41a995
SHA3-384 hash: f577b1198790e51d836c402d268c7bc5ff34ec9423497e9bafcfe80711b5d52166d092cdb1aa78ae763d411b92fc14c2
SHA1 hash: af221e6609bb544787a5baca96f1a7faa620ef5e
MD5 hash: 9d18ee23e1c0f2575d1638502d753aec
humanhash: texas-saturn-pluto-cat
File name:nyashka.exe
Download: download sample
Signature DCRat
Create hunting rule
File size:850'432 bytes
First seen:2026-01-31 21:55:08 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'245 x AgentTesla, 20'500 x Formbook, 12'374 x SnakeKeylogger)
ssdeep 12288:Flz1dGWP2h6tKAAhiIniuwKI5wzuuGhP/Sknk7HtDHEre/OfGVapM61+:FlFvtzAhiI619qN4rpM61+
Threatray 234 similar samples on MalwareBazaar
TLSH T15D05D72429EB003AF177EFB459D1399E96AEF6F3B7079E8E305042C64712780DD9163A
TrID 66.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.5% (.EXE) Win64 Executable (generic) (10522/11/4)
5.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.0% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
Reporter abuse_ch
Tags:DCRat exe RAT


Avatar
abuse_ch
DCRat C2:
http://212.67.17.63/Javascriptapiwindowsgeneratorwptemp.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://212.67.17.63/Javascriptapiwindowsgeneratorwptemp.php https://threatfox.abuse.ch/ioc/1739434/

Intelligence

File Origin
# of uploads :
1
# of downloads :
206
Origin country :
NL NL
Vendor Threat Intelligence
Malware configuration found for:
DarkCrystal
Details
DarkCrystal
a version, a mutex, c2 urls, and extracted plugins
Link:
https://research.acce.ciphertechsolutions.com/results/96ba34ff-9407-4087-82ce-12b06456f673/
Malware family:
n/a
ID:
1
File name:
nyashka.exe
Verdict:
Malicious activity
Analysis date:
2026-01-31 19:50:19 UTC
Tags:
auto-sch
Link:
https://app.any.run/tasks/0841aa9c-7a08-4597-98e1-13cef985bf82

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/51043/
Detection(s):
Win.Packed.Uztuby-10015799-0
Create hunting rule

Win.Packed.Uztuby-10017372-0
Create hunting rule

Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=697e5cfad93e7233498c2dda
Tags:
autorun shell micro sage
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm base64 cmd dcrat fingerprint lolbin obfuscated reconnaissance
Link:
https://www.filescan.io/uploads/697e7a4f930564ff3c81222e/reports/58caef0c-95cf-48d6-a02b-48a26f056fb8/overview
Verdict:
Malicious
Labled as:
Trojan.MSIL.Basic.8
Link:
https://www.hybrid-analysis.com/sample/54193af95cf82cdbcc2b331bfd7112915a54bfd872b4fce2e148777fff41a995
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-01-31T16:55:00Z UTC
Last seen:
2026-01-31T20:48:00Z UTC
Hits:
~10
Detections:
Backdoor.Agent.HTTP.C&C Trojan.Win32.Agent.sb HEUR:Trojan-PSW.MSIL.Coins.gen HEUR:Trojan.Win32.Generic Backdoor.MSIL.DCRat.sb
Link:
https://opentip.kaspersky.com/54193af95cf82cdbcc2b331bfd7112915a54bfd872b4fce2e148777fff41a995/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/f46d5eeb-414f-4458-9dee-1fbe7a54f3b1
Result
Threat name:
DCRat
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1861036
Signature
.NET source code contains potential unpacker
.NET source code contains very large strings
Adds a directory exclusion to Windows Defender
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Creates processes via WMI
Drops executable to a common third party application directory
Drops executables to the windows directory (C:\Windows) and starts them
Drops PE files with benign system names
Found malware configuration
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: System File Execution Location Anomaly
Sigma detected: Windows Binaries Write Suspicious Extensions
Suricata IDS alerts for network traffic
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Yara detected DCRat
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1861036 Sample: nyashka.exe Startdate: 31/01/2026 Architecture: WINDOWS Score: 100 110 Suricata IDS alerts for network traffic 2->110 112 Found malware configuration 2->112 114 Antivirus detection for URL or domain 2->114 116 16 other signatures 2->116 9 nyashka.exe 4 27 2->9         started        13 lsass.exe 2->13         started        15 RuntimeBroker.exe 2->15         started        17 6 other processes 2->17 process3 file4 92 C:\Windows\...\RuntimeBroker.exe, PE32 9->92 dropped 94 C:\Users\user\Desktop\yYfkdtSf.log, PE32 9->94 dropped 96 C:\Users\user\Desktop\iESNuTjO.log, PE32 9->96 dropped 104 12 other malicious files 9->104 dropped 128 Adds a directory exclusion to Windows Defender 9->128 130 Creates processes via WMI 9->130 132 Drops PE files with benign system names 9->132 134 Drops executable to a common third party application directory 9->134 19 cmd.exe 9->19         started        22 powershell.exe 23 9->22         started        24 powershell.exe 24 9->24         started        32 10 other processes 9->32 98 C:\Users\user\Desktop\uzAUWdRx.log, PE32 13->98 dropped 100 C:\Users\user\Desktop\tjeMgEQI.log, PE32 13->100 dropped 102 C:\Users\user\Desktop\fffNrnIi.log, PE32 13->102 dropped 106 4 other malicious files 13->106 dropped 26 cmd.exe 13->26         started        28 powershell.exe 13->28         started        30 powershell.exe 13->30         started        34 11 other processes 13->34 136 Multi AV Scanner detection for dropped file 15->136 signatures5 process6 signatures7 118 Uses ping.exe to sleep 19->118 120 Uses ping.exe to check the status of other devices and networks 19->120 36 fontdrvhost.exe 19->36         started        49 3 other processes 19->49 122 Loading BitLocker PowerShell Module 22->122 41 conhost.exe 22->41         started        43 conhost.exe 24->43         started        51 2 other processes 26->51 45 conhost.exe 28->45         started        47 conhost.exe 30->47         started        53 10 other processes 32->53 55 10 other processes 34->55 process8 dnsIp9 108 212.67.17.63, 49724, 49728, 49729 MEGAMAX-ASNizhnyNovgorodRU Russian Federation 36->108 84 C:\Users\user\Desktop\ukadnBcp.log, PE32 36->84 dropped 86 C:\Users\user\Desktop\rddURjiu.log, PE32 36->86 dropped 88 C:\Users\user\Desktop\qgCMwjTz.log, PE32 36->88 dropped 90 4 other malicious files 36->90 dropped 124 Adds a directory exclusion to Windows Defender 36->124 57 cmd.exe 36->57         started        60 powershell.exe 36->60         started        62 powershell.exe 36->62         started        64 10 other processes 36->64 file10 signatures11 process12 signatures13 126 Uses ping.exe to sleep 57->126 66 conhost.exe 57->66         started        68 chcp.com 57->68         started        80 2 other processes 57->80 70 conhost.exe 60->70         started        72 conhost.exe 62->72         started        74 conhost.exe 64->74         started        76 conhost.exe 64->76         started        78 conhost.exe 64->78         started        82 7 other processes 64->82 process14
Score:
98%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/54193af95cf82cdbcc2b331bfd7112915a54bfd872b4fce2e148777fff41a995
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/54193af95cf82cdbcc2b331bfd7112915a54bfd872b4fce2e148777fff41a995/
Verdict:
Malicious
Threat:
Family.DCRAT
Link:
https://tip.neiki.dev/file/54193af95cf82cdbcc2b331bfd7112915a54bfd872b4fce2e148777fff41a995
Threat name:
ByteCode-MSIL.Backdoor.DCRat
Create hunting rule
Status:
Malicious
First seen:
2026-01-31 19:50:22 UTC
File Type:
PE (.Net Exe)
AV detection:
22 of 36 (61.11%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kqmtv6k47awnxtblgmn724issfnfjp6yok2pzyxbjb3x772bvgkq._file
Verdict:
malicious
Label(s):
dcrat
Create hunting rule
Similar samples:
2598022c6608f58f6a9ada52db902aa98e4389d92f7d74390966d2a52b82f7f4
DCRat
708b90620e944806d2ad832646b09f6b94d64935fb1eb6c056ac6da6049055d4
DCRat
77f89edc608310294fb98dd03be1c1b855482cebf1222b7bed671f59961f1b52
DCRat
ed5f1d6b9cd6b16d5a26c5138d8dce24ec8336ffdc3fd0a0bc49588887611da0
DCRat
error
DCRat
+ 224 additional samples on MalwareBazaar
Result
Malware family:
dcrat
Create hunting rule
Score:
  10/10
Tags:
family:dcrat discovery execution infostealer persistence rat
Link:
https://tria.ge/reports/260131-1szk1aaw5e/
Behaviour
Modifies registry class
Runs ping.exe
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Enumerates physical storage devices
System Network Configuration Discovery: Internet Connection Discovery
Drops file in Program Files directory
Drops file in Windows directory
Checks computer location settings
Executes dropped EXE
Command and Scripting Interpreter: PowerShell
DCRat payload
DcRat
Dcrat family
Process spawned unexpected child process
Unpacked files
SH256 hash:
cccd73fd69a9ac8c81ed8fe0861487908f34d6332e8934e8474afb4f98c7eaba
MD5 hash:
36aa31a229707d08b2d9b44310ed7837
SHA1 hash:
01abe408a0feac1c554c9b20bc3677aa248147ba
Link:
https://www.unpac.me/results/0ec3a177-0dd8-4e80-a3ee-3d55ff3644f7/
SH256 hash:
2b93377ea087225820a9f8e4f331005a0c600d557242366f06e0c1eae003d669
MD5 hash:
d8bf2a0481c0a17a634d066a711c12e9
SHA1 hash:
7cc01a58831ed109f85b64fe4920278cedf3e38d
Link:
https://www.unpac.me/results/0ec3a177-0dd8-4e80-a3ee-3d55ff3644f7/
SH256 hash:
54193af95cf82cdbcc2b331bfd7112915a54bfd872b4fce2e148777fff41a995
MD5 hash:
9d18ee23e1c0f2575d1638502d753aec
SHA1 hash:
af221e6609bb544787a5baca96f1a7faa620ef5e
Link:
https://www.unpac.me/results/0ec3a177-0dd8-4e80-a3ee-3d55ff3644f7/
Malware family:
DCRat
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/54193af95cf8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/54193af95cf82cdbcc2b331bfd7112915a54bfd872b4fce2e148777fff41a995

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DCRat
Create hunting rule
Author:Nikolaos 'n0t' Totosis
Description:DCRat Payload
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File
Create hunting rule
Author:ditekSHen
Description:Detects executables containing bas64 encoded gzip files
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:RSharedStrings
Create hunting rule
Author:Katie Kleemola
Description:identifiers for remote and gmremote
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/51043/

Comments