MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 589f17f9788644c903212007adadb661a42e6100ae8ddaab9a320b573b659bca. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DCRat


Vendor detections: 10


Intelligence 10 IOCs YARA 8 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 589f17f9788644c903212007adadb661a42e6100ae8ddaab9a320b573b659bca
SHA3-384 hash: 17a8f39683477059554da04fe1398b02682a1f9bdc5b8ef9d18dacf4b87900462b5b209ba8570dd5340ea72df50742bb
SHA1 hash: ef40c9e37c0bc220b1eb8916b1526049985fe7a4
MD5 hash: 98bafbd772e4b0502dc647b05d6acd03
humanhash: harry-spring-river-xray
File name:98bafbd772e4b0502dc647b05d6acd03
Download: download sample
Signature DCRat
Create hunting rule
File size:570'880 bytes
First seen:2021-10-14 16:09:33 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:aqnOaTzKT/LKB1ZZiJAEU/Ek/92HGosAxbMjStzbHu9YthpBU:a+O2zK3KfZZiJA/NFysAp5rjU
Threatray 95 similar samples on MalwareBazaar
TLSH T11FC42A242AE95929F1BFAF7DC6F17496977EB5633717960E08A1028A0713B41DCC0B3B
Reporter zbetcheckin
Tags:32 DCRat exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
239
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
98bafbd772e4b0502dc647b05d6acd03
Verdict:
Malicious activity
Analysis date:
2021-10-14 16:18:09 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/3230f43e-29a4-4c69-b0d5-9453e0bb1504

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
DCRat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/197578/
Detection(s):
Win.Packed.Uztuby-9891175-0
Create hunting rule

Win.Packed.Uztuby-9901274-0
Create hunting rule

ditekSHen.MALWARE.Win.Trojan.AsyncRAT.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Using the Windows Management Instrumentation requests
Launching a process
Creating a file in the Program Files subdirectories
Creating a window
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0b048b37-cfb6-48d9-a231-23eb1dd3f160
Result
Threat name:
DCRat
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/870636
Signature
.NET source code contains potential unpacker
.NET source code contains very large strings
Creates an autostart registry key pointing to binary in C:\Windows
Creates multiple autostart registry keys
Creates processes via WMI
Drops executables to the windows directory (C:\Windows) and starts them
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected DCRat
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/589f17f9788644c903212007adadb661a42e6100ae8ddaab9a320b573b659bca/
Threat name:
ByteCode-MSIL.Backdoor.LightStone
Create hunting rule
Status:
Malicious
First seen:
2021-10-10 20:49:37 UTC
AV detection:
25 of 28 (89.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lcprp6lyqzcmsazbead23lnwmgsc4yiav2g5vk42gifvoo3ftpfa._file
Verdict:
malicious
Similar samples:
049e79c4d019081cf5894cc565963f88f8a9e76ca0749d750242692e65b79710
DCRat
0b5a4d65bd3424391e5f9bc5b6247635b8097005edb07f35eee3aef1d73e1b64
DCRat
4b648c17bb169cf81da7a4d1182238b96463ed58474ef6b539818fdb19291a32
DCRat
7b0f445718f91d7d32669089ecf436c8cfc3639f756ef1d91f8ba5aa90c5145a
DCRat
89ff1cde233c8c94d22601a78eda7c67995c654817b03bdd975d24a0b9297715
DCRat
96f29dfb24c62e5c8053144b878b2fea14b29ee016f0fb0af344c2d0f13eca52
DCRat
e206cdfadd769d8506f7dde22b1a3277075506810b455f491ff08fd42707a0a0
DCRat
+ 85 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
discovery persistence spyware stealer
Link:
https://tria.ge/reports/211014-tmdb9aaac4/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Creates scheduled task(s)
Modifies Internet Explorer settings
Enumerates physical storage devices
Drops file in Program Files directory
Drops file in Windows directory
Drops file in System32 directory
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Checks computer location settings
Reads user/profile data of web browsers
Executes dropped EXE
Process spawned unexpected child process
Unpacked files
SH256 hash:
f7d0a36d2f80e3034aa11258925dc93a0e623ed0ea2834e254d211af7aad5ee4
MD5 hash:
5d6030915e38c573ef67c0a03fb59cc1
SHA1 hash:
d144b106e07c4f501999aa3f316a3eeba9f67648
Link:
https://www.unpac.me/results/bb42382d-6842-407a-a58b-3c96598e24d4/
Parent samples :
e0fa9c62364826149547d32728d06d155bdc6a54e90554695f8039bd7b73d036
54de552295e919218a7d43a1d0114bae169a79a1963113d615fd8bce428b385d
2774262a54ea6008d5b508f4d95eb811bd5d7dc50e1c0659d016ab33d966e729
aa7a05956ca47e164a10a94d0bdbe01123b84eb01fad5e581e1e72b10d93d5a9
26547389ff741eeba887fe39ec5f253d6597c03d1ffaf65c007ae5c40d897d5a
SH256 hash:
3fa34078725f01bc7e626f35042853a1d546a043e19753d584b3da1b5934a86e
MD5 hash:
4db2f2f6a0bfbfdf2d9d4c5a95066df7
SHA1 hash:
8062ee0fd84ebbdd3a59078e945f5048ce59fc6c
Link:
https://www.unpac.me/results/bb42382d-6842-407a-a58b-3c96598e24d4/
Parent samples :
658b0a01404144b5da03574e2a05b6c02030baa2276b9e047174c6ccb3e8918d
3da49f4f7f8e9b628584321c65a3ab3e8d5c7c27615cfc527a0e6bad9af1b8af
c54d820f7ddabf09562c1913c2099aceff06122699944496f1edf5b58f70eae9
06c5043de5a30a81b57f1afdd651d8d8dcafa12a548bf22c129fc0ab1559a6d9
4c13d7949070e6361626b855d849afa3e4721b654a7906303bb5933645498c53
34e740ecbaab29c15536abd6409bd10e1880a77eeb8a5a88e787051d4fd916a9
9e7a70da8b8fbd3193c3a9c10cb1b120802a8ef88e4e1c4c03945cd87dc0dd2f
e2955eb9de3b2d1d49eef7d0ff565d033429f0cb628439ef17571426758f58d8
d4836bff71f7f89bac76de2a7ff57ce8a2ee89a6ec92f8e786eae74ca259ce36
3eeb9115c3888d0b1c4cfccc25bb48661b90f308bdcc1ea0c2a56a7030d5c547
54de552295e919218a7d43a1d0114bae169a79a1963113d615fd8bce428b385d
e5ceb36a479f4affece79593a04374e43b3619ab38e64b1b36a76b25a149baff
65d59cc441cd33c09cc1d83f3097da96414b23480d94ee0bf74477aa0f012588
e341875335ab0192719a7a17c39dd43fe185be56d7dff52c8434525489523007
7d9ec2e09c8559b1d695569da5f16b9a6edd54c38526b91d458ca5c43c401761
2774262a54ea6008d5b508f4d95eb811bd5d7dc50e1c0659d016ab33d966e729
a87d18df4d58e31acb40b03e05c9de4a507991b1d4f3ba8cc22b599671fbf43a
425fea1071b9d17709b1c93a92ce8497bd4d8f42d17bf7f7dc47db9fede0133a
53f5687e99cd9f17ea56728183c0e8c32e8825efd4c92c3a62278613c5a8d0ba
17154764e83a28a94dd2d6d0250d641c9e1284ecd7b6def2302f640728bdc102
8d719797d54ade99d81bc37270540ae77d665a7a11322fbd7cc6821033ee55f5
c4ec5d7b7a9bf60de2c201ebaca15ef8da3590033d4abc42fa402bcd2e5abd79
486a172f5e53e60a401aafcd42ea3ff43474f7fc728408fbcc74993e3327a823
0bcb6a2a0bc53d7f8123dc77302edaaa382ac3f3b1124187277df169bee3b11d
a93149d4911689487366f8b17fa9d5d4f3ecc43e7e75daeb28786e41a9712797
07ef2eee7e56c2338327d52269e755e7dc2bc82e2fb8781de0c1ea7857003d49
78e05cedaa8ac3d3361793ab8b19b6ba2147ea99cd6e406720e90dc5474fcda0
2098a5c58be76612a56e5dc768ecffac4d8ca0c90f98d089838f299b5cc2990d
284f083103d1c160d9e4721ecce515646ce451a1b7ddf9dd89817904e21a4a2d
738f3b29b73ecee8cb2f1439bfb37f537b00fea55329de4d5a9eb556f5124898
0eaabbc6526d245393c83bd7167ce1af1b8ea62565bd24e4071fd5d85b42cba5
821cb2141c54e7f85c771ffb713132c64ab34c42d7dc495d932d4048349ecf19
ca834f0de0a8eb1fa2beda59fc7a5dc9879886f9a066d6065ef621506b43590f
87f220dad3bbeec6f39ed3e74eaa5b63f91924104b238fd33b4c5d49cc88f1ac
5d3aa443debb15bdf756b94980e0a6bcbef950edd72941905f70eded5238590c
6120c9db8e0c5d714fd87dcb35954c460439498928bc85978aef0fb377e43e1d
de00660d0d96ff67cb8e89a8d8525567327b109bc54b9042e5fdd516dcc0e51a
4e6333e4c4cb032d90a01f0499d63346da93f702ef1bc8aa6a0b0a8cad912354
1fbcb895a6e34fb2a307c0c9896b7922ea723e5eea183fa319c0142c5a761fdf
460e3932c1f76c83aeb5f294a84c5a2343d05bf40afadd3edae8c561f26f9ab3
855be39c3b980dbc9be89124bbe9f3e4fb660cab6a4e84af15fba8379b9eb2a7
f2ea08890e2043e272efd3f728c3a129807097c24024730154a24fe7269d3fc9
1365414d90a8e9a059336e150f9123f59562c2c5b3a354f3d73f882773f04571
0dacdf0e2ae577718cce67a4498ca419da614bf7b536c615528bb6e273717f54
8d31ae46e123de0d23937d664298428e37b45a7a135a95d73f5887779ee48710
d979fd8848a2fe7df6ea8cb353086d8a28d7c2523b5e10222c19285ab40fa5f3
13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc
3fa6ddcabcb03763ef1887117e16ebdf0553a1cc2a16b58bdecaba0735d4e60a
b108df3575c8f9c77577486a92b52fe55bfb6508acca68b22250d8e1fc0494fb
7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d
dc288149929d93cc33f1edfe82d4b92cb05c5b681e992dc18936df829b2b5e0e
5d78dc803d29fba00eb080a58f1d85c33dbf50834886337083269ca1b5f1c1db
b473ef5a2e4a6af3a8fb6e05a5f337de350ed961465a87525a19074a419071e2
8ce6b9b905b77768b4806c491d303784d9ba8513c4616e07b8f7a75553a0d40f
a6a27d9ba682a107558cdb16fcd50ebbe3d112c8dab38e96d5926c522781cc81
93fab8f38647afb8584bd6dbe31d748aa68f08d8015f5047db33e7a903eb4891
7238e57350be305f25ca913714b571ee225a658bf5234d9e98cf72e176b8749b
1177a24b2539e173f4f9d25c0f3e43a22d23ec64b562a86b4b7ef65741734067
5a089053f785fbdc6e6d11d32a6e74c9e5af34a6b3be078e867b0fe18833a7b6
ea6e4e54c6aa6df24c7a386a5ac3bd9a224d69ecd629a555744e72cde043cadd
0b80872ae84d5a7de900b51596d85e09361774ae22cd577ec4898b4350737a53
a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1
374290f4bc29e1d5a3295b8f23c281393075beae64db51cd5a5e96c03f9ef8b0
ad3cad3320c96364564203d96cc76ebea925dcc8de447195e0c1addb9f28e7e8
38b3c41d485fa638c249ee54c9a3ca358a9eb36e561834d9f7f2fca088da6248
a56e046d587cf2a6351bbf456ce47982f4aa1c9a6248ead75d734dce42d80fe8
371427ad07be3f9c39773c3c0c4b95c86f63dc2e427835565b159f3686818bd0
90cd882d4b7aa3939307bcc71bc05d38e600cb22e8984985335df1feac12e44a
4ce4afc5fd856ed5951e35c3efd45fdc03662abf43050fddc564023ef40e6823
34be0ed06faf7cf7e8af122810e391dc4c09958bba1303a226103218b1c79710
88f80fbe352e5778eb8a9d0cb508c888d8a3c88c676455c5a5dc6348f7a427b1
cb5bd9dcab7d07c1775ad24d25f72e15b6d62d4c22ce95345ce95632bc68be63
092853fc5c2163fdafef345aff1be3116697804b6f81ef2374422822d1e78bfa
cd526b1117e1c22762e6c48441856143ec31f33b8b8efaa13cb3ba37631c5972
6ad806c1234b782cd3a54e146cf02463424fa67c1a3e962c2f43ca10398178b4
633b3cade3eac35d244499864b7951091dc5d8cbac3cb6dd4fa87a214be9c41c
de7afeddc29a1d624396c18da80702aa9ab9f8e5212446022a49b7f804252f0e
7cef1a964acbe38f4796b9ddbbd95e3fc19215594b2f3ab74483d58fe4bb93ad
a3d949b62016bc688520dfe0bf68075ca6666089eea641a62be626aecd1872ef
cccb59dbcce9a68ffed699333477bba15ef02b19de9e5a345eed09e87440fc28
294003b3626890da222c7aeb34f7ac71cec614026c686fd88df269cc175a0e8c
1683c3759dd64d42623510c28230a23c9b999f12d5b63f2cb02f9eaf769f45a6
19e2bde176b68e7b609977a3965b60bb74afc5810781e1545c1dc83beeb64672
5f89b33cedfe3e9f075dd2312b10580dd16b5fb1702fe1f1ce572a792ec9bf91
791d92ffb559abed9ec0f3266f5e0f2a98a5af1fab714f0b3b1b2548f05ca8b0
e23b924ff1c1b8a67aebc3b98711c63e12832e2bdd41ff8a52b15685bfabfc6d
a68bc10b645b0b5748702f6db2b275549a5214854c0bc1efcb4259930760aa2f
fcc7ce0c1cf2c3d90bef0d564fcb9ac13631d73dd516a4e32f01ecd3ea9bcda9
8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4
5bdd5d335f1dce7bff7ad597aa12c5c36d2831b58d4a1a37650fab7b070c6e23
d1a77a1cb9e4123494d9646d4d064289d6c96dd7a1ebde4dc0aab169c42018f0
7080fb14c8ba10d8abfff9760872b9815bcebad6cf72651d4aae4ef919708445
078a6edfe74bdca838f020373b45f18d1a89abe276d75eedba8cc4a0e8ac0acd
7eb02adb15e19f6a197a641d054d24d133f6d0880afbb8ff53a6629cbc666b67
3490a06a34fbdc0f9d3ae55ff159fe407bf962f67b56bde78a9ad0bb312a1610
c8ea81ec0afa16e1e7c0bc325396be024c993479765a9e4ad26b29d83bbfb01a
3055d261f05a0656b1b92d9fa8ed3a72111a3a5c6d036d13d3d3a304ca99b987
7362f82084bcdf47b0927674ad678f66214e8d4f2783a0b9338ee4eb773c3474
feeeddd06c6b90360e7adf808b216628c585888af8e8b4179be7bb1a4e1e6994
94d6f5344b79742f145659d00c8e6d7113741ced8930b855dd6161b222f3e6c3
b003517c275f4ceb2bc2b54f77849c64818c7d37439201cab1cc2d91e8c66efd
cf2af3301f31bae02df162a5287f7671b353a4d7c704235e84661778a92c0b67
757ddfaea3c3fe1d283195f096eebe58fb45d87359773e3a53a983d5b78a6f04
7676e27b7a9afde332f828b3375bcefa5dbe8cb92c274b167b140a22ead8131d
014feb184c1838be5b8ca7761e5ddeafb5af92492718f13bcaedf5a736ce6377
b06c1166e2ceeb7def9f3d7efef3f22f2b004b5d36c785a4a4cb443b6e1281de
f41b0826792d64294cb3f67c11513610b4510d8efdf2f7ee66d434e3b7472343
00564ed0e7500f4ed88ae136b1c140425556bf536c6bd8c6c74b7d9665d6fe20
37afdc07792fe92b790bd6ba935889cef87b699d9f1a8f86336076f8cf6e4b72
5a47bbdd5a87677ce485cfa5eae97ce572dae896ec0fb306f8b4a2ad8d5f856c
91a5d06a6ddc1dbc0d573871082b21c0ef5d260987d760bff9b1d19966d0c32d
d169e5e99edef6f5c3619faee33bddd20978f514bdc3448b8655fd06ea5f5984
6e333e5b68668934186d53525c24d2ed857c35e36b4d21102d06e52e6890ac5f
524eadc0b5758167ac92dbfbf5b6119abefe8648eaf3c1171ab8a227d3720611
60f6c911f8b8f9579e3958699dcb7fb91ade66f3a9bdd435632c6d18006002c2
13f24a33b0bda605948ee337aac9f7095faeb536a0c1ba8d221a53af3822eec3
7b3cb0689a20b3d447c436253a2f44995562052e7f46094c93c12a375ebea0cb
534190cdacfd4dd6d00505481ff5051320f6168e3740dafbc132a5003146c3bb
4d460e49e0c569a7593cd7fd6e3a181b2e25dd7b98bd2906015007bd241b4d86
82aaf8a6c7718e883bf7f9cb3d18a7889a8080227f14f9bc1ce0e9efa77d651b
c3627f7a85532ddd721bc37ed3816ff0197641ff368ed20bd39c19aabeeb97db
ff9670eca75815f925c41581162bdd2ccbd31283996b6c66a438dba9cd6af831
8d34477674ccda710d5acd22a1ea3ce7c9e818d7b6d3b19200c896fcf42f5b4b
2ea69f49817149fb5d008a79ac6975b890d949aa57708f3cb76fa15d8ce3f106
32137cf4d6060f5047dcee2185431bcfcd3fa5b244d63050410a4448df737b38
3f6feb2ff90be022f4b11b4e4be46768ce735fa4fda2fc731232fd1105a109da
3f7dbeb177934d53205b93a27b9f4262fe0f46aaf090326cb8e2069d90d0414c
1ce99f60292aa8808687010e53feff56ab3af5af3d725d8a9008dd4a1cf252cb
70c558209d7201e690991be17a01c6ef7f5b14775f2cfb288f0abafa43187fe2
3acf15dfd8e4a0fbe7404c2f8aadda1cff0aba5c058f5b5c3481bb44d8ff5b64
fea10c485839f80cc78106c2ef1d4a3ef70a5a0c208586be219a070bca061d6c
7482844fa9ea3044100ff708dd43854bf604859d30e1e6f556a7fa55d32323e4
d945170cc27804050d9789baaf9e86fcd5c4e130ef4b38cec14e3a833a2cf6f9
e4a9185f0986262e066fdd0a863444e2667b40655df1c7098c605be5bd3ec6e6
62fd8c7e773674a56856b0ed4907df4eb15ac0fb4e4a18fea5b244180c70b575
5539d434ee526c3dd170b22ac661ded347391278c129f0f7571d683bdc0fb1db
e0b4936809d8a75b5095ce25dfb12e14c825e9401d941356749bba86a26b6bbb
f9e07becd2faaba0a53f178a513cef474849c4d82a1e69a871c81617db614296
bef3edd51fd9d18caaf806dc73b6d31554c805af50228e47c1543c00b81fe083
58207d1c5728785516cdbe3bc2323b9aeee09ba1a2e6e237cf18a364b7449ace
9f39a758c86041bc56ea46dad466476907466a5bbae961c28e1bb3d70c1cd3ca
84f54e72011bbefa9480f3b556de2739efdd2910018230990ac5a1b580ff4993
dbbf6145ab9543b6e92fd30de62cd494fded9c7f0a79f4c96f56782c80d10b96
4cb2a089b9b5c731fa3bca4d3e697271d948fed7882fb6ab86c3ebb3d86ab0ca
6e36e247d18636fd5a1790ec30a2700272016b7b18f92bb5e3afccd3f7850008
fc5b0314dfd53a19bb905de5b758720df8a25857bdd1c5a72e5b1af7d4ff994a
f08995b47577c1055a9dba345fec4ef1718e482fb014769e5d29e917837b1aed
da479ac3683eb1b6cc8cee9967b33d7a299fb551b9a8a1ddd5182469de37b2fb
01e7f777e19a70073e6e8d286263b12b59bf8cc9af1e0b0c9fa4244ff63c9dc0
4728a46d0432b4fa8c56c71597346276a69c9a38842725426a44364cc0655457
f35cac13d76f955a715a51f5029ec8e4539004f02a447eec2b84febd7a4f62af
ce4f0de3346625b38371d6e608e7f1dce0e078e3c307ffc7ea793f8443a25e9a
75162536c16046734b4d39d6f66a17a502ab3f7763727a0172e80a6d3b0eb27a
39c734ab91b8067c2458a620ce002b8bbe6f0e18176a7d98d022883ec73e67ec
4f22748956c9ec725df67a7729730ae3d56f88dc37db966abfc3a7557bbdb69a
a38d77ec66208f83f4065fe43bf51c96b587d2937b0d5f6d1abb1ab973de3751
a0f0432f815889adb15907adaab5489844a71f5527bb07afb3d37f1a6ef948df
3993abaf8f1b6758260ab97a7192a4dcce70c41ffb326db7f0e94dffaf647312
cd01c6df90757354750d2597513fe1970f028826da6e2e057bb167e22846e016
bb2153f4393601174d491f9be952ec246a4f77e67b46e0ad7983d7270436b8f1
b0049161819d1b613e9bac0c0ab31c4926013efcb93041f2b8c56f5d34f2336a
4e6eb217528d9643d9a41ea4ef18d97e64d425d5c419738a82081e2577964de5
90528e80817e530236ab8110837e1afc510cd1b3a69e90787d8dd00eb471a40a
c4c2a82a7d454bb85fa22f12d2571639c1640ba4a6790d708f4a229f91a7a99b
a00f90db29e2c261c2b6bb00093c43659b577708e8afff72c97f17d41bb06e2e
9ca2e817ff19e5313105b3b468c5390aff48fabe778333d4d2d045659818e73a
b86a67a7dea558bd5719148ecc93ecb2c4f9270006ff304d860c866519c8ca15
550e199325198e2aeb1c1fe8228a37715962dcad001c447f29f226921e6a9f0e
b0cc835df649b790bf8fde133d284d4bf3b9c6fd65baaa6578f91b9b3fc33b5d
d607bfcbe22d2dd7d7a40172c2c5e1680d5d1132c8cab4b2ce51b57ca84fe997
a1f1d8797ffd930f0a16f3a1bd96b58419bb05bcd304a6e4ec2ddc14c664c83c
43bf0e585ed703c5aa53e6a74b04e2b3c10a3a7708889a5d823c7f84e29c2aab
96f8492fd115abf7134203668cd31f428efbc1d75edb9c6f26aaf8201e19950e
c91ecca54c0cbdf3f8714d7c92ca6858d4ddb5957ab06f9ed33bb73e3b5f6207
e7cf9ae73751f92a53dbbc41b4939510e23352bf3a942e86b269c72b80cdb63c
47b707ee7aeb49ae4d8e8a7abb7aa067a49f7ec9a804aa7c21d2c563cf2cb50f
SH256 hash:
f4dbaec73ccd5c6431cf902d7327ddb9f2c87de2434226bb18948ba4ee5755ed
MD5 hash:
b45e9d751c574567757174ac44bf54a1
SHA1 hash:
642fc5f04600f8a8ba6feeec08cf94f281c40d0d
Link:
https://www.unpac.me/results/bb42382d-6842-407a-a58b-3c96598e24d4/
Parent samples :
56b97987918aafadb2b070083e19236388c3ac087b80a8d548c07ff31252eb17
6176ead880248cbccdf7df359034699e937249e13608b788be1b25158b09c1ca
3927622ef8e0a99764011d9f98f47bf0eb1a39df514a7e02e78d3cc7773c4944
0daea272c1fa7bb54113cfc6948f10b9346f2cf05000ac5b57aaed5cef8dae05
e0fa9c62364826149547d32728d06d155bdc6a54e90554695f8039bd7b73d036
SH256 hash:
7e7d277ee439aa3ac20595df84d788993352bef00826b1c1fb6ffe67c30165be
MD5 hash:
b4cb71460e8d1e0202ff9488c6f7c0a3
SHA1 hash:
56c270b475895762ad013cc27fa9d7426c61e410
Link:
https://www.unpac.me/results/bb42382d-6842-407a-a58b-3c96598e24d4/
SH256 hash:
decdffcfad163e2126f3b121e230a9824e41fac7eefeb27d155e895294f7ddf6
MD5 hash:
5e2eb0ce4382cbe9af208bd7016193f2
SHA1 hash:
f52766a4f7bd46080ed4e47c66355908ac6070c1
Link:
https://www.unpac.me/results/bb42382d-6842-407a-a58b-3c96598e24d4/
SH256 hash:
589f17f9788644c903212007adadb661a42e6100ae8ddaab9a320b573b659bca
MD5 hash:
98bafbd772e4b0502dc647b05d6acd03
SHA1 hash:
ef40c9e37c0bc220b1eb8916b1526049985fe7a4
Link:
https://www.unpac.me/results/bb42382d-6842-407a-a58b-3c96598e24d4/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/589f17f9788644c903212007adadb661a42e6100ae8ddaab9a320b573b659bca

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File
Create hunting rule
Author:ditekSHen
Description:Detects executables containing bas64 encoded gzip files
Rule name:INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
Author:ditekSHen
Description:Detects Windows executables referencing non-Windows User-Agents
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:MALWARE_Win_AsyncRAT
Create hunting rule
Author:ditekSHen
Description:Detects AsyncRAT
Rule name:MALWARE_Win_DCRat
Create hunting rule
Author:ditekSHen
Description:DCRat payload
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DCRat

Executable exe 589f17f9788644c903212007adadb661a42e6100ae8ddaab9a320b573b659bca

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1677972/
Cape
Cape
https://www.capesandbox.com/analysis/197578/

Comments


Avatar
zbet commented on 2021-10-14 16:09:35 UTC

url : hxxp://82.146.62.93/lolz.exe