MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 72ae820b13a8e8f73da2770b9c0bd9d0a6a42e2ba3dcaf1279359e2b2b221b12. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
DCRat
Vendor detections: 17
| SHA256 hash: | 72ae820b13a8e8f73da2770b9c0bd9d0a6a42e2ba3dcaf1279359e2b2b221b12 |
|---|---|
| SHA3-384 hash: | 9967c9933c9b80ff0620c65330c10443da3e9421afc713ded500f0d031385c9dc1c944b7e0b62c008f3d09f99f982c8b |
| SHA1 hash: | addc8dca076b2216c98466b5eec8f827ca1482d9 |
| MD5 hash: | 9fb32dc431fd70acfb7d1608c0535317 |
| humanhash: | washington-louisiana-sierra-wolfram |
| File name: | 0x000600000002323a-338 |
| Download: | download sample |
| Signature | DCRat |
| File size: | 1'684'480 bytes |
| First seen: | 2023-12-30 10:54:54 UTC |
| Last seen: | 2023-12-30 10:55:09 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 6f462fcc6b830b77fb3fef2add9dc570 (9 x CoinMiner, 3 x BitRAT, 2 x XWorm) |
| ssdeep | 24576:rN+pjxSNHrO1+pz+p55/cS8jfCCnNPjf+pWE4+pwv++pu/p1X0:MpFCHrOwp6pdpWE9pypu/zE |
| Threatray | 11 similar samples on MalwareBazaar |
| TLSH | T12B7542E476482ED8C062CE18B746B9B56DA15FA93A3D4935E1FCBD018B3FD08578C18B |
| TrID | 38.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 15.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 11.7% (.EXE) Win16 NE executable (generic) (5038/12/1) 10.5% (.EXE) Win32 Executable (generic) (4505/5/1) 4.8% (.EXE) Win16/32 Executable Delphi generic (2072/23) |
| File icon (PE): |  |
| dhash icon | 06276565593b9e4c (2 x DCRat, 1 x AsyncRAT, 1 x Formbook) |
| Reporter |  e24111111111111 |
| Tags: | DCRat exe |
Intelligence
File Origin
# of uploads :
2
# of downloads :
285
Origin country :
GRVendor Threat Intelligence
Malware family:
asyncrat
ID:
1
File name:
c8dd8464008d24fe02938509eb3163f09749e1c76bff6dcfd25b1d3193357419.exe
Verdict:
Malicious activity
Analysis date:
2023-12-30 11:18:42 UTC
Tags:
evasion xworm asyncrat
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Malware
Maliciousness:
Behaviour
Сreating synchronization primitives
Launching a process
Creating a process with a hidden window
Creating a file
Creating a file in the %AppData% directory
Creating a process from a recently created file
Creating a file in the Windows directory
Creating a file in the %temp% directory
Using the Windows Management Instrumentation requests
Sending a custom TCP request
Creating a window
DNS request
Sending an HTTP GET request
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Searching for the window
Unauthorized injection to a recently created process
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
coinminer lolbin packed shell32
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
XWorm
Verdict:
Malicious
Result
Threat name:
AsyncRAT, DcRat, XWorm
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code contains very large array initializations
.NET source code references suspicious native API functions
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Drops PE files with benign system names
Encrypted powershell cmdline option found
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Potential dropper URLs found in powershell memory
Potential malicious VBS script found (has network functionality)
Protects its processes via BreakOnTermination flag
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected AsyncRAT
Yara detected DcRat
Yara detected Generic Downloader
Yara detected XWorm
Behaviour
Behavior Graph:
Score:
100%
Verdict:
Malware
File Type:
PE
Threat name:
Win32.Trojan.Generic
Status:
Malicious
First seen:
2023-05-24 19:39:21 UTC
File Type:
PE (Exe)
Extracted files:
3
AV detection:
18 of 22 (81.82%)
Threat level:
2/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 1 additional samples on MalwareBazaar
Result
Malware family:
xworm
Score:
10/10
Tags:
family:asyncrat family:xworm botnet:default rat trojan
Behaviour
Creates scheduled task(s)
Enumerates physical storage devices
Looks up external IP address via web service
Checks computer location settings
Async RAT payload
AsyncRat
Detect Xworm Payload
Xworm
Unpacked files
SH256 hash:
f78e70be8fd8f6f3160d0c81c5b576a61269793810e3b2e7c6dee963a6f1eb15
MD5 hash:
097ec55788abb1227d217dda37e82e7b
SHA1 hash:
d7a36418f95ba8e21152325013cbf12fc426127b
SH256 hash:
78866f2db94d2e3fc1dd6327206dca8a9a8f95e1bfc897a4fcf7ae41e200e7bd
MD5 hash:
4d1f2166658814405c8c66163e6f3387
SHA1 hash:
2e4bf3ef1f631d6279386ea9ac570f9182f0e980
SH256 hash:
f65e7a6d4e2874967bdac2e38721f7141ed3778feb74a07c82f8be2716e3e925
MD5 hash:
52c6c0a31da4b83b061ebe7409edb906
SHA1 hash:
ca0b545df3948b34f81f52ac08a64acef6bf096b
SH256 hash:
0e3b7bce0fb97f6860d6dd9142648188dce14573725d400174882e600e64bdbd
MD5 hash:
9c19d058a894e35cad64a0dab5f5a56f
SHA1 hash:
c41047677b50f5225eea3eb94df73bb99e43e076
Detections:
APT_ArtraDownloader2_Aug19_1
SH256 hash:
5d717d35b913ff6d13c408f294d899ca58bb321598426eca2bea71b9e6edd9ce
MD5 hash:
216ef921adac2bbb51ff6331f61b19e7
SHA1 hash:
90c3cfc3b78daa2bfa12d26dbd765fbfd4bc510d
Detections:
XWorm
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
MALWARE_Win_XWorm
INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
MALWARE_Win_AsyncRAT
Parent samples :
72ae820b13a8e8f73da2770b9c0bd9d0a6a42e2ba3dcaf1279359e2b2b221b12
80c91ecaab6a6a6a7a8cb3df47b111f031ea41beab9f8b8386f4c1bc8d18ff21
994ea35144e43c0074f6d60ccff844cc70d0a2b34ad9b583a7316e17aec94e2f
8d11ec5c3f5b3d5eb57e75469ffc10721aee94ae56b3d432fafdee189bb0d6e8
c8dd8464008d24fe02938509eb3163f09749e1c76bff6dcfd25b1d3193357419
80c91ecaab6a6a6a7a8cb3df47b111f031ea41beab9f8b8386f4c1bc8d18ff21
994ea35144e43c0074f6d60ccff844cc70d0a2b34ad9b583a7316e17aec94e2f
8d11ec5c3f5b3d5eb57e75469ffc10721aee94ae56b3d432fafdee189bb0d6e8
c8dd8464008d24fe02938509eb3163f09749e1c76bff6dcfd25b1d3193357419
SH256 hash:
72ae820b13a8e8f73da2770b9c0bd9d0a6a42e2ba3dcaf1279359e2b2b221b12
MD5 hash:
9fb32dc431fd70acfb7d1608c0535317
SHA1 hash:
addc8dca076b2216c98466b5eec8f827ca1482d9
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
No further information available
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.