MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8a1057cf8e0ae58585534119e5edb46f5de02b2119edf91e77a0b24a045596de. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DCRat


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8a1057cf8e0ae58585534119e5edb46f5de02b2119edf91e77a0b24a045596de
SHA3-384 hash: 81fa73c01f91b6d815d611eb44b4f04c06558d8ea43734b65d195291896ca511d85ee52b27d409eb5fa9e2d671f8dec0
SHA1 hash: 14e7a81eb724c2540b6d175d6236d8cb1c1202d9
MD5 hash: 11f6879b35f28f55b89f9bfc1872cea1
humanhash: undress-high-one-early
File name:11f6879b35f28f55b89f9bfc1872cea1.bin.exe
Download: download sample
Signature DCRat
Create hunting rule
File size:3'377'248 bytes
First seen:2023-03-02 18:20:30 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f6baa5eaa8231d4fe8e922a2e6d240ea (37 x CoinMiner, 22 x DCRat, 15 x LummaStealer)
ssdeep 49152:kY5qkeQ+5QDyjkzTsSO6b6b0UmAavuEu5RZLly63Q7/liCykKVw3UznWp+Dzrv:kY5qx5QmEs9bdPRgjliCykKmMjHv
Threatray 114 similar samples on MalwareBazaar
TLSH T1EFF5333237E1A1F9D06280F066DD672709E4AB3ADF0DC1D7FAF9290699705C6783924B
TrID 43.3% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
27.6% (.EXE) Win64 Executable (generic) (10523/12/4)
13.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.3% (.EXE) OS/2 Executable (generic) (2029/13)
5.2% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):PE icon
dhash icon 1d7bf1c9c5c9c3cf (1 x DCRat)
Reporter abuse_ch
Tags:DCRat exe signed

Code Signing Certificate

Organisation:34g43g34g34
Issuer:34g43g34g34
Algorithm:sha256WithRSAEncryption
Valid from:2023-02-24T00:00:00Z
Valid to:2028-02-24T00:00:00Z
Serial number: 0b06e7a358588960
Intelligence: 10 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 3354c4c063e2430b70ef77c885a15af66f20a10029e20b9b24a1028daa6b5420
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
abuse_ch
DCRat C2:
http://81.200.152.41/videogeneratorprivate.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
230
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
dcrat
Create hunting rule
ID:
1
File name:
11f6879b35f28f55b89f9bfc1872cea1.bin.exe
Verdict:
Malicious activity
Analysis date:
2023-03-02 18:21:03 UTC
Tags:
rat backdoor dcrat stealer
Link:
https://app.any.run/tasks/c7a29a0a-1212-4e4e-bf2e-795bc8fc50d9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/371268/
Detection(s):
Win.Keylogger.Gencbl-9969771-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Sending an HTTP GET request
Searching for synchronization primitives
Searching for the window
Creating a window
Creating a file in the %temp% subdirectories
Enabling the 'hidden' option for files in the %temp% directory
Сreating synchronization primitives
Running batch commands
Creating a process with a hidden window
Launching a process
Moving a file to the %temp% subdirectory
Creating a process from a recently created file
Replacing files
Creating a file in the Program Files subdirectories
Using the Windows Management Instrumentation requests
Creating a file
Unauthorized injection to a recently created process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
keylogger overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/6400e91003b144271569bb38/reports/2fd839c2-a719-47e5-8e2f-c01a921d95d5/overview
Verdict:
Malicious
Labled as:
Win/grayware_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/8a1057cf8e0ae58585534119e5edb46f5de02b2119edf91e77a0b24a045596de
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/49a93b61-5d28-48d1-b651-673fe94cd4ba
Result
Threat name:
DCRat
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1186022
Signature
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Contains functionality to register a low level keyboard hook
Creates an autostart registry key pointing to binary in C:\Windows
Creates an undocumented autostart registry key
Creates autostart registry keys with suspicious values (likely registry only malware)
Creates multiple autostart registry keys
Creates processes via WMI
Drops executables to the windows directory (C:\Windows) and starts them
Drops PE files with benign system names
Machine Learning detection for dropped file
Multi AV Scanner detection for dropped file
Snort IDS alert for network traffic
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected DCRat
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 818888 Sample: AOkQQtw8hD.exe Startdate: 02/03/2023 Architecture: WINDOWS Score: 100 43 Snort IDS alert for network traffic 2->43 45 Antivirus detection for dropped file 2->45 47 Multi AV Scanner detection for dropped file 2->47 49 5 other signatures 2->49 7 AOkQQtw8hD.exe 8 2->7         started        11 services.exe 2->11         started        13 CHxCeFvDwb.exe 2 2->13         started        15 29 other processes 2->15 process3 file4 39 C:\Users\user\AppData\Local\Temp\...\7z.exe, PE32+ 7->39 dropped 41 C:\Users\user\AppData\Local\Temp\...\7z.dll, PE32+ 7->41 dropped 59 Contains functionality to register a low level keyboard hook 7->59 17 cmd.exe 2 7->17         started        61 Antivirus detection for dropped file 11->61 63 Machine Learning detection for dropped file 11->63 signatures5 process6 process7 19 Crtcommon.exe 28 40 17->19         started        23 7z.exe 2 17->23         started        25 7z.exe 3 17->25         started        27 6 other processes 17->27 file8 29 C:\Windows\...\services.exe, PE32 19->29 dropped 31 C:\Windows\IdentityCRL\INT\SgrmBroker.exe, PE32 19->31 dropped 33 C:\Recovery\explorer.exe, PE32 19->33 dropped 37 14 other malicious files 19->37 dropped 51 Creates an undocumented autostart registry key 19->51 53 Creates autostart registry keys with suspicious values (likely registry only malware) 19->53 55 Creates multiple autostart registry keys 19->55 57 3 other signatures 19->57 35 C:\Users\user\AppData\Local\...\Crtcommon.exe, PE32 23->35 dropped signatures9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8a1057cf8e0ae58585534119e5edb46f5de02b2119edf91e77a0b24a045596de/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=riifpt4oblsylbktiem6l3nun5o6akzbdhw7shtxuczeubcvs3pa._file
Verdict:
malicious
Similar samples:
02eac3477d8072f8a2e1eb518a741c467ec260aee8766b2ecbbe99bee947844a
DCRat
112e29903c6705e92dc217af3dd518c8ba29f7d992e746cf6c33c11f241e2f2f
DCRat
182bcfaaf9e59ac55d1419907c6a45510207378c3eef5b8c023c1bf0d426cc29
DCRat
4abeb9e9a46d1cac2b17c326d06830018532f8bca33ae4a3ba4536f044a50bc8
DCRat
52c408897aed4601f6c214b657c0652a966695d59bb0e5be2c343f0c52683be1
DCRat
799ed0d211859a9ff154db97b898160da3fc25110ca6b1b02b693e049d601dd1
DCRat
8ab37c64cb49c8213aa4eeabdb564b2df10b560fd731a82e7dbc1f8bae6aa1c3
DCRat
+ 104 additional samples on MalwareBazaar
Result
Malware family:
dcrat
Create hunting rule
Score:
  10/10
Tags:
family:dcrat infostealer persistence rat spyware stealer
Link:
https://tria.ge/reports/230302-wza4rseb66/
Behaviour
Creates scheduled task(s)
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Views/modifies file attributes
Enumerates physical storage devices
Drops file in Program Files directory
Drops file in Windows directory
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
DCRat payload
DcRat
Modifies WinLogon for persistence
Process spawned unexpected child process
Unpacked files
SH256 hash:
b73d8a2de261bc0741e01d65d7798355f0555f3016226e4ef3270809a995eb65
MD5 hash:
cf401623889c8352bdbe38adf5164823
SHA1 hash:
bcda572a0b6db9a7cb4c3564526a16d68d238c6d
Link:
https://www.unpac.me/results/4ca027c4-c126-4495-b5e6-9dce2ec7ff29/
SH256 hash:
8a1057cf8e0ae58585534119e5edb46f5de02b2119edf91e77a0b24a045596de
MD5 hash:
11f6879b35f28f55b89f9bfc1872cea1
SHA1 hash:
14e7a81eb724c2540b6d175d6236d8cb1c1202d9
Link:
https://www.unpac.me/results/4ca027c4-c126-4495-b5e6-9dce2ec7ff29/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.83
Link:
https://yomi.yoroi.company/submissions/8a1057cf8e0ae58585534119e5edb46f5de02b2119edf91e77a0b24a045596de

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/371268/

Comments