MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7198c021c349195154979637b443482046379e1dad61a191a58cf8a0e1b0d9d9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	7198c021c349195154979637b443482046379e1dad61a191a58cf8a0e1b0d9d9
SHA3-384 hash:	bb425a16257079a1fc2288954a6f2b92a77a4986bd2a071b53cd7344f78daa779dda72d0e5d7da5e3fbfbc9951ae44e7
SHA1 hash:	75d35a78322318316003274df065556127c7cf82
MD5 hash:	05807a1da055a7f5f9685785a492e378
humanhash:	skylark-yellow-autumn-cardinal
File name:	05807a1da055a7f5f9685785a492e378.exe
Download:	download sample
Signature	DCRat Alert Create hunting rule
File size:	992'256 bytes
First seen:	2023-12-28 22:45:15 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'206 x SnakeKeylogger)
ssdeep	24576:ow5fINw7rTQVHC+sofD+Q//+IrbeeDdVrnAlR:okfIOTGC+so7F//NDXnG
Threatray	5 similar samples on MalwareBazaar
TLSH	T1242518127E448E01F0191233C3EF458957B4D961A6E6E32B7DBA3B6E15123A77C0DACB
TrID	47.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 20.2% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 8.4% (.SCR) Windows screen saver (13097/50/3) 6.8% (.EXE) Win64 Executable (generic) (10523/12/4) 4.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
Reporter	abuse_ch
Tags:	DCRat exe

abuse_ch

DCRat C2:
http://a0899956.xsph.ru/L1nc0In.php

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

380

Origin country :

NL

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Win.Packed.Msilmamut-9950860-0

Alert

Create hunting rule

Win.Packed.Basic-9952747-0

Alert

Create hunting rule

Win.Packed.Uztuby-9963900-0

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

DNS request

Sending a custom TCP request

Connecting to a non-recommended domain

Sending an HTTP GET request

Creating a window

Using the Windows Management Instrumentation requests

Searching for synchronization primitives

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm cmd cscript dcrat explorer lolbin net_reactor obfuscated packed schtasks

Link:

https://www.filescan.io/uploads/658dfaabb290743934ef3836/reports/80dc7208-ceef-4525-91a5-f59914b8139a/overview

Hybrid Analysis Trojan.MSIL.Basic.8

Verdict:

Malicious

Labled as:

Trojan.MSIL.Basic.8

Link:

https://www.hybrid-analysis.com/sample/7198c021c349195154979637b443482046379e1dad61a191a58cf8a0e1b0d9d9

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Malicious

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/c728665b-c76f-4d7a-a0b7-42b1e0eb6df4

Joe Sandbox DCRat

Result

Threat name:

DCRat

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1367823

Signature

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

Antivirus / Scanner detection for submitted sample

Connects to a pastebin service (likely for C&C)

Found malware configuration

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Snort IDS alert for network traffic

Yara detected DCRat

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/7198c021c349195154979637b443482046379e1dad61a191a58cf8a0e1b0d9d9

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7198c021c349195154979637b443482046379e1dad61a191a58cf8a0e1b0d9d9/

ReversingLabs TitaniumCloud ByteCode-MSIL.Backdoor.DCRat

Threat name:

ByteCode-MSIL.Backdoor.DCRat

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-25 08:38:00 UTC

File Type:

PE (.Net Exe)

AV detection:

31 of 37 (83.78%)

Threat level:

  5/5

Spamhaus Hash Blocklist

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ogmmaiodjemvcvexsy33iq2iebddphq5vvq2denfrt4kbynq3hmq._file

Threatray malicious

Verdict:

malicious

Similar samples:

7198c021c349195154979637b443482046379e1dad61a191a58cf8a0e1b0d9d9

DCRat

80cc02b76df0e84c09c64a9ecc3f746e4a776dde0abef216b9bf528ec2ddba4c

DCRat

9c8b561cf27708f285da964826b1183608e75be698f6b5a4469faea8e535a760

DCRat

Hatching Triage dcrat

Result

Malware family:

dcrat

Alert

Create hunting rule

Score:

  10/10

Tags:

family:dcrat infostealer rat

Link:

https://tria.ge/reports/231228-2pyd7sbah4/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Legitimate hosting services abused for malware hosting/C2

DCRat payload

DcRat

UnpacMe 2

Unpacked files

SH256 hash:

4e7559a9539caf9238081cc71ca062ac4b5cf35c132ab2cff639f96f71878bb6

MD5 hash:

eee2cbc8116cf91009dcd705456753f4

SHA1 hash:

7119a961d3556cb1c912dec91e40b098b6b57f8e

Link:

https://www.unpac.me/results/a4703471-bad4-4506-9659-7cf3d7d7d5b0/

SH256 hash:

7198c021c349195154979637b443482046379e1dad61a191a58cf8a0e1b0d9d9

MD5 hash:

05807a1da055a7f5f9685785a492e378

SHA1 hash:

75d35a78322318316003274df065556127c7cf82

Link:

https://www.unpac.me/results/a4703471-bad4-4506-9659-7cf3d7d7d5b0/

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/7198c021c349/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/7198c021c349195154979637b443482046379e1dad61a191a58cf8a0e1b0d9d9