MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 566f31997d73c69aaf319b3cf639e415d5be63376f46468c69345174fcbd0ec8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
DCRat
Vendor detections: 9
| SHA256 hash: | 566f31997d73c69aaf319b3cf639e415d5be63376f46468c69345174fcbd0ec8 |
|---|---|
| SHA3-384 hash: | 81fdd9691135567b6d557aba76f3cd50b85c7f9affbf50b61027e9f88c5e3ebf5b940fbdec859f576c39a1d000afdae0 |
| SHA1 hash: | 3d5b5a710d51211f6788ceffa9c3212632f51d05 |
| MD5 hash: | 145f12ba5a2d22fce0984bde5ca9d8bf |
| humanhash: | seventeen-april-tennis-zulu |
| File name: | 566F31997D73C69AAF319B3CF639E415D5BE63376F464.exe |
| Download: | download sample |
| Signature | DCRat |
| File size: | 1'075'200 bytes |
| First seen: | 2022-02-02 20:51:16 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger) |
| ssdeep | 12288:SFTBSEOBk1RvLZQ0T/V1ssDkeayH5gjU0lnpiEF2mtx6YpGEtNysQkJc2LDqDHC7:YlSU5z46YpGYNHnNx03296c+QsZ0+4 |
| Threatray | 466 similar samples on MalwareBazaar |
| TLSH | T1633549023A08DD02D02A5637CAEF802547ADEE617B63DB1A7E9F336D65553A71C0E1CE |
| Reporter |  abuse_ch |
| Tags: | DCRat exe |
Indicators Of Compromise (IOCs)
Below is a list of indicators of compromise (IOCs) associated with this malware samples.
| IOC | ThreatFox Reference |
|---|---|
| http://a0613321.xsph.ru/toLinuxtemp.php | https://threatfox.abuse.ch/ioc/377511/ |
Intelligence
File Origin
# of uploads :
1
# of downloads :
159
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Сreating synchronization primitives
Creating a file in the system32 subdirectories
Using the Windows Management Instrumentation requests
Launching a process
Creating a file
Creating a file in the Program Files subdirectories
Creating a file in the %temp% directory
Running batch commands
Creating a process with a hidden window
Sending a custom TCP request
Sending a UDP request
DNS request
Creating a process from a recently created file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
anti-debug anti-vm cmd.exe control.exe cscript.exe explorer.exe greyware hacktool obfuscated packed replace.exe schtasks.exe stealer wacatac
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Result
Threat name:
DCRat
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Behaviour
Behavior Graph:
n/a
Threat name:
ByteCode-MSIL.Trojan.Zilla
Status:
Malicious
First seen:
2022-01-31 14:56:00 UTC
File Type:
PE (.Net Exe)
AV detection:
24 of 28 (85.71%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Similar samples:
+ 456 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
10/10
Tags:
persistence
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Drops file in System32 directory
Adds Run key to start application
Executes dropped EXE
Process spawned unexpected child process
Unpacked files
SH256 hash:
3b6504d325e9f813021c5e41cb0978407f76e093584189daa1500ce65219f6b1
MD5 hash:
790b9fb857c8d06730dde580cb3b711b
SHA1 hash:
bf2be330d788d0c021d9e52e77a252e989ccea81
Parent samples :
e6e4997c4d3b458b12715acf42f18421e60121dcbb461476ecdc487d5caa5284
54de552295e919218a7d43a1d0114bae169a79a1963113d615fd8bce428b385d
669634a33853f70175e367b9519b29e5ac57ddeb412884c004875344ad2b5165
2774262a54ea6008d5b508f4d95eb811bd5d7dc50e1c0659d016ab33d966e729
327c974b8d165bfbdc0c4277bd3d68e24b6d55a6d970340662ff78468a9c4e29
5680eb1ffa1fac4f1c5a78024331ff7dd8982138d89d2df4ec56996b44c9cc99
54de552295e919218a7d43a1d0114bae169a79a1963113d615fd8bce428b385d
669634a33853f70175e367b9519b29e5ac57ddeb412884c004875344ad2b5165
2774262a54ea6008d5b508f4d95eb811bd5d7dc50e1c0659d016ab33d966e729
327c974b8d165bfbdc0c4277bd3d68e24b6d55a6d970340662ff78468a9c4e29
5680eb1ffa1fac4f1c5a78024331ff7dd8982138d89d2df4ec56996b44c9cc99
SH256 hash:
8a7826780543071524af05b7f4c59739163dec89d6d7a96c18293b3e2f9ee31f
MD5 hash:
69879d46c0bab8ea535a91a8f07d933c
SHA1 hash:
6da9e7844be8a24af8190de6ce041fa2903846d4
SH256 hash:
0239a3372936c96852622fdfed8e291c5d9658587d4c9d313aa70d2050d69ecf
MD5 hash:
daf27fd362785c44d3a5a4d94c827790
SHA1 hash:
3a9d0ed269db4a87be7f704d3ea1e7925c08182a
SH256 hash:
566f31997d73c69aaf319b3cf639e415d5be63376f46468c69345174fcbd0ec8
MD5 hash:
145f12ba5a2d22fce0984bde5ca9d8bf
SHA1 hash:
3d5b5a710d51211f6788ceffa9c3212632f51d05
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.50
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.