MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 84ae6fe4cd4f1357409af9eeea51b0ceb8385242c1e67b1f22a51a9475f3ce01. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DCRat


Vendor detections: 7


Intelligence 7 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 84ae6fe4cd4f1357409af9eeea51b0ceb8385242c1e67b1f22a51a9475f3ce01
SHA3-384 hash: 03fff7bc55f67bd3da86555f37c3333d4700d9e2bd990ff6cc8a13f93342076e98d9a6ada0d370c1c2ff585f09c03ecf
SHA1 hash: 59c614e5b6df1ad7e8eda4570f2ca779102a6e56
MD5 hash: 9943818246b54e3acfea6ad7433c7f96
humanhash: island-arizona-stairway-equal
File name:9943818246b54e3acfea6ad7433c7f96.exe
Download: download sample
Signature DCRat
Create hunting rule
File size:1'245'184 bytes
First seen:2021-03-17 08:11:56 UTC
Last seen:2021-03-17 09:31:14 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 2e5467cba76f44a088d39f78c5e807b6 (131 x DCRat, 112 x njrat, 79 x RedLineStealer)
ssdeep 24576:5BpqnxTsBkc8KYwtg/UiJo58ej3ZOhd4vsl/pBpVgdAYYUrQQ:5XqxTWtV81e8ebZ0a0lXpVxxN
Threatray 14 similar samples on MalwareBazaar
TLSH 6345334018C11A52C770EBB8938651BA0F3E987067FD0998DF361351FE4AE57A468FEE
Reporter abuse_ch
Tags:DCRat exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
98
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
9943818246b54e3acfea6ad7433c7f96.exe
Verdict:
Malicious activity
Analysis date:
2021-03-17 08:22:23 UTC
Tags:
rat backdoor dcrat trojan evasion stealer
Link:
https://app.any.run/tasks/23135a9a-8c70-4c21-bcc8-54b6117572fb

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
PUA.Win.Packer.EnigmaProtector-19
Create hunting rule

PUA.Win.Packer.EnigmaProtector-1
Create hunting rule

SecuriteInfo.com.Trojan.Siggen12.34127.28787.5369.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Using the Windows Management Instrumentation requests
Creating a file
Launching a process
Creating a process from a recently created file
Sending a UDP request
DNS request
Sending an HTTP GET request
Creating a window
Creating a file in the %temp% directory
Deleting a recently created file
Reading critical registry keys
Sending a custom TCP request
Setting a global event handler for the keyboard
Stealing user critical data
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
DCRat
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/642018
Signature
.NET source code contains in memory code execution
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code references suspicious native API functions
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has nameless sections
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected DCRat
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 369981 Sample: 6mwT86Mpvq.exe Startdate: 17/03/2021 Architecture: WINDOWS Score: 100 49 Found malware configuration 2->49 51 Multi AV Scanner detection for dropped file 2->51 53 Multi AV Scanner detection for submitted file 2->53 55 11 other signatures 2->55 7 6mwT86Mpvq.exe 1 18 2->7         started        11 RuntimeBroker.exe 3 2->11         started        13 dsTJDfjXkybSXIFH.exe 3 2->13         started        15 6mwT86Mpvq.exe 2->15         started        process3 file4 37 C:\Recovery\dsTJDfjXkybSXIFH.exe, PE32 7->37 dropped 39 C:\Recovery\RuntimeBroker.exe, PE32 7->39 dropped 41 C:\ProgramData\...\dsTJDfjXkybSXIFH.exe, PE32 7->41 dropped 43 8 other malicious files 7->43 dropped 65 Detected unpacking (changes PE section rights) 7->65 67 Detected unpacking (overwrites its own PE header) 7->67 69 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 7->69 77 2 other signatures 7->77 17 6mwT86Mpvq.exe 16 119 7->17         started        21 schtasks.exe 1 7->21         started        23 schtasks.exe 1 7->23         started        25 3 other processes 7->25 71 Multi AV Scanner detection for dropped file 11->71 73 Machine Learning detection for dropped file 11->73 75 Hides threads from debuggers 11->75 signatures5 process6 dnsIp7 45 cs51919.tmweb.ru 5.23.51.236, 49710, 49718, 49745 TIMEWEB-ASRU Russian Federation 17->45 47 ipinfo.io 216.239.34.21, 443, 49714 GOOGLEUS United States 17->47 57 Multi AV Scanner detection for dropped file 17->57 59 Detected unpacking (changes PE section rights) 17->59 61 Detected unpacking (overwrites its own PE header) 17->61 63 4 other signatures 17->63 27 conhost.exe 21->27         started        29 conhost.exe 23->29         started        31 conhost.exe 25->31         started        33 conhost.exe 25->33         started        35 conhost.exe 25->35         started        signatures8 process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/84ae6fe4cd4f1357409af9eeea51b0ceb8385242c1e67b1f22a51a9475f3ce01/
Threat name:
Win32.Packed.EnigmaProtector
Create hunting rule
Status:
Malicious
First seen:
2021-03-11 05:27:36 UTC
AV detection:
33 of 47 (70.21%)
Threat level:
  1/5
Verdict:
suspicious
Similar samples:
25a5d91f4c867eb1436fdba263123537b96a582fd0f80dccf96537198678925e
DCRat
43fc7007823fa8f0e718a782ba2d85a5e63eb77a8efebc223e72d5671465e44f
DCRat
5261874485f9fe16a78a558734e8652f93db1d544f3be331e7f6adc06f43ee98
DCRat
5907f265be010c299b5e22d766d0fa3ee6ad2936b96dc40d8ef328cf3d388160
DCRat
798eab01e5d7f1c78e3f7db514f3611ae85e468405af144245f55c8f2657c6d9
DCRat
9a080e918c88adb048ffca38c0604318eee80e19be5a578186a63cdd64d45a41
DCRat
9cda5e5ad6ca68a803516013fbf62e6b06383b20fccf1ee6aed4730c916a3b55
DCRat
b83c0954a3138f4c18e4f6a5182768b5a1efbb13c69dcf01d63eb81f63456eda
DCRat
bd15b8dc3c9eeddcc7e33877876fb0d3856495b473df950f50bec4701db73d5c
DCRat
ccae475b281127a3280a51906a2ab50248c8b7f75c34e93c5bd62ccc0fded850
DCRat
+ 4 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
spyware stealer
Link:
https://tria.ge/reports/210317-1tzxzk5k5x/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Drops file in Windows directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Looks up external IP address via web service
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
Unpacked files
SH256 hash:
84ae6fe4cd4f1357409af9eeea51b0ceb8385242c1e67b1f22a51a9475f3ce01
MD5 hash:
9943818246b54e3acfea6ad7433c7f96
SHA1 hash:
59c614e5b6df1ad7e8eda4570f2ca779102a6e56
Link:
https://www.unpac.me/results/46c05e73-07f3-49bf-a529-d83c131fe921/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/84ae6fe4cd4f1357409af9eeea51b0ceb8385242c1e67b1f22a51a9475f3ce01

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:EnigmaStub
Create hunting rule
Author:@bartblaze
Description:Identifies Enigma packer stub.
Rule name:SUSP_XORed_URL_in_EXE
Create hunting rule
Author:Florian Roth
Description:Detects an XORed URL in an executable
Reference:https://twitter.com/stvemillertime/status/1237035794973560834
Rule name:win_smominru_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DCRat

Executable exe 84ae6fe4cd4f1357409af9eeea51b0ceb8385242c1e67b1f22a51a9475f3ce01

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1072553/
  
Delivery method
Distributed via web download

Comments