MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 7711ab515c2fe669a40d2ee4883ededba88dff7c305008df222c2133469215e8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
DCRat
Vendor detections: 8
| SHA256 hash: | 7711ab515c2fe669a40d2ee4883ededba88dff7c305008df222c2133469215e8 |
|---|---|
| SHA3-384 hash: | efceaa102334e0ab92f637b7e781b2d182da689c99c223565ef7afc196da1c540075abc5796bbb091a8919f6b2bb9d0d |
| SHA1 hash: | 1880ac009d18869d7f029bed378f7ef9276a7e0d |
| MD5 hash: | aba88ae23ef00a022dd6a09105b5a740 |
| humanhash: | hydrogen-spaghetti-bakerloo-double |
| File name: | aba88ae23ef00a022dd6a09105b5a740 |
| Download: | download sample |
| Signature | DCRat |
| File size: | 560'128 bytes |
| First seen: | 2021-08-17 09:27:19 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger) |
| ssdeep | 12288:TqnOm3Yx8DHoPDZKGdXdsXEJiY6L6/prI+WK:T+OmRoPwJ0JiF+/51 |
| Threatray | 53 similar samples on MalwareBazaar |
| TLSH | T13FC47C152BF86925F1BF5B79E4F06D6A8B72B81276A2EF4F048213D91E13740DC80B67 |
| Reporter |  zbetcheckin |
| Tags: | 32 DCRat exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
125
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
aba88ae23ef00a022dd6a09105b5a740
Verdict:
Malicious activity
Analysis date:
2021-08-17 09:28:07 UTC
Tags:
evasion trojan rat backdoor dcrat stealer
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Sending a custom TCP request
Connection attempt
Sending an HTTP GET request
Using the Windows Management Instrumentation requests
Creating a window
DNS request
Reading critical registry keys
Creating a file in the %temp% directory
Deleting a recently created file
Creating a file
Sending a UDP request
Stealing user critical data
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Result
Threat name:
DCRat
Detection:
malicious
Classification:
troj.spyw.evad
Score:
88 / 100
Signature
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses the Telegram API (likely for C&C communication)
Yara detected DCRat
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Backdoor.LightStone
Status:
Malicious
First seen:
2021-08-16 22:08:17 UTC
AV detection:
25 of 46 (54.35%)
Threat level:
5/5
Verdict:
unknown
Similar samples:
+ 43 additional samples on MalwareBazaar
Result
Malware family:
dcrat
Score:
10/10
Tags:
family:dcrat rat spyware stealer
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Accesses cryptocurrency files/wallets, possible credential harvesting
Looks up external IP address via web service
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
296c6aacdee2200eda07a33337818ef92d1214d1835443d2707d76727d5966b4
MD5 hash:
ede46c883113aeda0a0d2f56af1cceb2
SHA1 hash:
cf17d560abf8bcc1118fbfef77d953b0605f820c
SH256 hash:
69e2e00d2984bd1c7bb42b972e43f56d61951a04e00834d05564240ddd198950
MD5 hash:
245c027f35b15118f47fe044c842d3cd
SHA1 hash:
567755f062684e09850321cdeaf95d4e0597dbba
SH256 hash:
48d6be0ff082776c566a19459a5963f08d2c4d4a1c947de7a99b07560e236295
MD5 hash:
1ea5ecfbe64e314d9bb062046d5bfb75
SHA1 hash:
3ceeb4ea27ac76da489a55f242faf11ee0a2d2a2
SH256 hash:
6ea4c210ee414f6238144474c3b4c2c87faf578a15eb3836afa0348ac0127195
MD5 hash:
05562e23866bd4ea62858f16c750d971
SHA1 hash:
0cf712a1afa8f4ead43fd11cb77a37f15ca1dad0
SH256 hash:
7711ab515c2fe669a40d2ee4883ededba88dff7c305008df222c2133469215e8
MD5 hash:
aba88ae23ef00a022dd6a09105b5a740
SHA1 hash:
1880ac009d18869d7f029bed378f7ef9276a7e0d
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers |
| Rule name: | MALWARE_Win_AsyncRAT |
|---|---|
| Author: | ditekSHen |
| Description: | Detects AsyncRAT |
| Rule name: | pe_imphash |
|---|
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.url : hxxp://135.125.172.201/test.exe