MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7ee77a45282939f784f7d224b7345399efa09a14a9ca619d6692d6ac04ebfa17. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DCRat


Vendor detections: 10


Intelligence 10 IOCs 1 YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7ee77a45282939f784f7d224b7345399efa09a14a9ca619d6692d6ac04ebfa17
SHA3-384 hash: 41c8115481b167c43aeff6a53db1a6e1b575131bfcc961f479a64e19bcf80313c8a0f04c346d1bf16a08e3e69289736f
SHA1 hash: 5574360f72164d0d0b99629e090a036518801117
MD5 hash: e654104cf3f7d7b0d3f63d781f2d6ec6
humanhash: jersey-social-hot-mirror
File name:7EE77A45282939F784F7D224B7345399EFA09A14A9CA6.exe
Download: download sample
Signature DCRat
Create hunting rule
File size:1'254'400 bytes
First seen:2021-06-16 18:15:32 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 2e5467cba76f44a088d39f78c5e807b6 (131 x DCRat, 112 x njrat, 79 x RedLineStealer)
ssdeep 24576:R1N45fb2CFnwDvLn9WZAbbo7Z33cmFWw83c4NDWCTFgGCcyXxZ4G8pruw:CNnsL9dbboN33pFINvTVlyZ8V
Threatray 14 similar samples on MalwareBazaar
TLSH 764533B1A1F2630BE1200A79E96F11F146627D528AB1E72F1DA94EB0FCD67134B10D7E
Reporter abuse_ch
Tags:DCRat exe


Avatar
abuse_ch
DCRat C2:
http://178.250.159.102/1vzbhwx9m3zcoop2v63fxe/dn5krv82yiibh83tsrqasyp59oii2npz7y43x9/bgsvcg47wn8njkzj1bkilypeu18lmzmncm0be4oxas/8537e73266353b47b77e12f9386dedc5.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://178.250.159.102/1vzbhwx9m3zcoop2v63fxe/dn5krv82yiibh83tsrqasyp59oii2npz7y43x9/bgsvcg47wn8njkzj1bkilypeu18lmzmncm0be4oxas/8537e73266353b47b77e12f9386dedc5.php https://threatfox.abuse.ch/ioc/130842/

Intelligence

File Origin
# of uploads :
1
# of downloads :
170
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
7EE77A45282939F784F7D224B7345399EFA09A14A9CA6.exe
Verdict:
Malicious activity
Analysis date:
2021-06-16 18:19:22 UTC
Tags:
trojan rat backdoor dcrat evasion stealer
Link:
https://app.any.run/tasks/139e861c-e1cd-409c-be01-81e1c9cc1768

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
PUA.Win.Packer.EnigmaProtector-19
Create hunting rule

PUA.Win.Packer.EnigmaProtector-1
Create hunting rule

Win.Malware.Agen-9851100-0
Create hunting rule

PUA.Win.Packer.EnigmaProtector-9852682-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Using the Windows Management Instrumentation requests
Sending a UDP request
Creating a file
Launching a process
Creating a file in the Program Files subdirectories
Creating a file in the Windows subdirectories
Creating a process from a recently created file
DNS request
Sending a custom TCP request
Creating a file in the %temp% directory
Deleting a recently created file
Creating a window
Reading critical registry keys
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Stealing user critical data
Enabling autorun by creating a file
Sending an HTTP GET request to an infection source
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Dark Crystal RAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1d94d527-bf87-4272-a933-8d18910b7cca
Result
Threat name:
DCRat
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/803257
Signature
.NET source code contains in memory code execution
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code references suspicious native API functions
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Drops executables to the windows directory (C:\Windows) and starts them
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has nameless sections
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Sigma detected: Copying Sensitive Files with Credential Data
Sigma detected: Schedule system process
Sigma detected: System File Execution Location Anomaly
Tries to evade analysis by execution special instruction which cause usermode exception
Tries to harvest and steal browser information (history, passwords, etc)
Uses schtasks.exe or at.exe to add and modify task schedules
Uses the Telegram API (likely for C&C communication)
Yara detected DCRat
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 435668 Sample: 7EE77A45282939F784F7D224B73... Startdate: 16/06/2021 Architecture: WINDOWS Score: 100 53 Found malware configuration 2->53 55 Antivirus detection for dropped file 2->55 57 Antivirus / Scanner detection for submitted sample 2->57 59 17 other signatures 2->59 7 7EE77A45282939F784F7D224B7345399EFA09A14A9CA6.exe 1 24 2->7         started        11 SearchUI.exe 3 2->11         started        13 gzNxgatdYkXLUiGym.exe 3 2->13         started        15 4 other processes 2->15 process3 file4 39 C:\Windows\Vss\Writers\...\RuntimeBroker.exe, PE32 7->39 dropped 41 C:\Users\Default\Music\taskhostw.exe, PE32 7->41 dropped 43 C:\Users\Default\AppData\...\SearchUI.exe, PE32 7->43 dropped 45 12 other malicious files 7->45 dropped 69 Detected unpacking (changes PE section rights) 7->69 71 Detected unpacking (overwrites its own PE header) 7->71 73 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 7->73 85 3 other signatures 7->85 17 RuntimeBroker.exe 7->17         started        21 schtasks.exe 1 7->21         started        23 schtasks.exe 1 7->23         started        25 5 other processes 7->25 75 Antivirus detection for dropped file 11->75 77 Multi AV Scanner detection for dropped file 11->77 79 Machine Learning detection for dropped file 11->79 81 Tries to evade analysis by execution special instruction which cause usermode exception 13->81 83 Hides threads from debuggers 13->83 signatures5 process6 dnsIp7 47 178.250.159.102, 49730, 49733, 49757 THEFIRST-ASRU Russian Federation 17->47 49 api.telegram.org 149.154.167.220, 443, 49731 TELEGRAMRU United Kingdom 17->49 51 2 other IPs or domains 17->51 61 Multi AV Scanner detection for dropped file 17->61 63 Detected unpacking (changes PE section rights) 17->63 65 Detected unpacking (overwrites its own PE header) 17->65 67 5 other signatures 17->67 27 conhost.exe 21->27         started        29 conhost.exe 23->29         started        31 conhost.exe 25->31         started        33 conhost.exe 25->33         started        35 conhost.exe 25->35         started        37 2 other processes 25->37 signatures8 process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7ee77a45282939f784f7d224b7345399efa09a14a9ca619d6692d6ac04ebfa17/
Threat name:
ByteCode-MSIL.Packed.EnigmaProtector
Create hunting rule
Status:
Malicious
First seen:
2021-03-08 13:55:26 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  1/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=p3txurjife47pbhx2islonctthx2bgquvhfgdhlgsllkybhl7ilq._file
Verdict:
suspicious
Similar samples:
25a5d91f4c867eb1436fdba263123537b96a582fd0f80dccf96537198678925e
DCRat
43fc7007823fa8f0e718a782ba2d85a5e63eb77a8efebc223e72d5671465e44f
DCRat
5261874485f9fe16a78a558734e8652f93db1d544f3be331e7f6adc06f43ee98
DCRat
5907f265be010c299b5e22d766d0fa3ee6ad2936b96dc40d8ef328cf3d388160
DCRat
84ae6fe4cd4f1357409af9eeea51b0ceb8385242c1e67b1f22a51a9475f3ce01
DCRat
9765d205b8b16a05e807f239217a734f37a1d7b263a116ee336d39688bb2ce58
DCRat
9a080e918c88adb048ffca38c0604318eee80e19be5a578186a63cdd64d45a41
DCRat
9cda5e5ad6ca68a803516013fbf62e6b06383b20fccf1ee6aed4730c916a3b55
DCRat
bd15b8dc3c9eeddcc7e33877876fb0d3856495b473df950f50bec4701db73d5c
DCRat
ccae475b281127a3280a51906a2ab50248c8b7f75c34e93c5bd62ccc0fded850
DCRat
+ 4 additional samples on MalwareBazaar
Result
Malware family:
dcrat
Create hunting rule
Score:
  10/10
Tags:
family:dcrat infostealer rat spyware stealer
Link:
https://tria.ge/reports/210616-n6dg13wgjx/
Behaviour
Creates scheduled task(s)
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Drops file in Windows directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Looks up external IP address via web service
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
DcRat
Unpacked files
SH256 hash:
7ee77a45282939f784f7d224b7345399efa09a14a9ca619d6692d6ac04ebfa17
MD5 hash:
e654104cf3f7d7b0d3f63d781f2d6ec6
SHA1 hash:
5574360f72164d0d0b99629e090a036518801117
Link:
https://www.unpac.me/results/2dc5269b-dc23-4ca8-8430-9e0d25c92130/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7ee77a45282939f784f7d224b7345399efa09a14a9ca619d6692d6ac04ebfa17

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:EnigmaStub
Create hunting rule
Author:@bartblaze
Description:Identifies Enigma packer stub.
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_XORed_URL_in_EXE
Create hunting rule
Author:Florian Roth
Description:Detects an XORed URL in an executable
Reference:https://twitter.com/stvemillertime/status/1237035794973560834
Rule name:win_smominru_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments