MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b52835c7a3e8e3d71540d7f1bbf3387958ca343752ead1f8d09cd040cfeeb74e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DCRat


Vendor detections: 13


Intelligence 13 IOCs 1 YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b52835c7a3e8e3d71540d7f1bbf3387958ca343752ead1f8d09cd040cfeeb74e
SHA3-384 hash: f43c39667f312d32b35780f227db6ddb0692df58eb8bc96a385daf7084db818e64639f08e977cde158803b62aa7129bb
SHA1 hash: bf16ed181dc0b713670dcffbe4bb60d5cd092222
MD5 hash: 961884c72f561b66e4ff04e7c330466c
humanhash: bacon-lion-ack-alpha
File name:B52835C7A3E8E3D71540D7F1BBF3387958CA343752EAD.exe
Download: download sample
Signature DCRat
Create hunting rule
File size:2'719'972 bytes
First seen:2022-10-25 01:31:04 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash fcf1390e9ce472c7270447fc5c61a0c1 (863 x DCRat, 118 x NanoCore, 94 x njrat)
ssdeep 49152:UbA30rkIOEDTD5PrzrO1FzQBt14rs/IiijcRLsc/sDBDf463fFO:UbHlTlQrViijc9/sVDf463NO
Threatray 3'745 similar samples on MalwareBazaar
TLSH T1DFC5D001BE44C912F0891A33D3FF46444BB4AD502AA6E31B7EB9376D56123937D2DACB
TrID 54.2% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39)
40.3% (.CPL) Windows Control Panel Item (generic) (197083/11/60)
2.1% (.EXE) Win64 Executable (generic) (10523/12/4)
1.0% (.EXE) Win16 NE executable (generic) (5038/12/1)
0.9% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 9494b494d4aeaeac (832 x DCRat, 172 x RedLineStealer, 134 x CryptOne)
Reporter abuse_ch
Tags:DCRat exe


Avatar
abuse_ch
DCRat C2:
http://a0706896.xsph.ru/requestpacketDefaulttestcdn.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://a0706896.xsph.ru/requestpacketDefaulttestcdn.php https://threatfox.abuse.ch/ioc/925860/

Intelligence

File Origin
# of uploads :
1
# of downloads :
266
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
dcrat
Create hunting rule
ID:
1
File name:
B52835C7A3E8E3D71540D7F1BBF3387958CA343752EAD.exe
Verdict:
Malicious activity
Analysis date:
2022-10-25 01:32:27 UTC
Tags:
trojan rat backdoor dcrat
Link:
https://app.any.run/tasks/3bd771c8-ca26-4960-8923-1e1857cbbc94

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
DCRat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/323719/
Detection(s):
Win.Trojan.Uztuby-9855059-0
Create hunting rule

Win.Ransomware.Clinix-9868408-0
Create hunting rule

Win.Packed.Basic-9952747-0
Create hunting rule

Win.Malware.Uztuby-9957322-0
Create hunting rule

Win.Packed.Uztuby-9963900-0
Create hunting rule

Win.Packed.Uztuby-9969968-0
Create hunting rule

Win.Malware.Uztuby-9972880-0
Create hunting rule

SecuriteInfo.com.Trojan.Rasftuby.Gen.14.10239.27368.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file
Creating a process from a recently created file
Running batch commands
Creating a process with a hidden window
Using the Windows Management Instrumentation requests
Launching a process
Creating a file in the Program Files subdirectories
Unauthorized injection to a recently created process
Enabling autorun by creating a file
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/45208/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5ab8e86d-ee21-4ad2-846f-24e72ba724be
Result
Threat name:
DCRat
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1097141
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Creates processes via WMI
Drops PE files to the user root directory
Drops PE files with benign system names
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected DCRat
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 729782 Sample: B52835C7A3E8E3D71540D7F1BBF... Startdate: 25/10/2022 Architecture: WINDOWS Score: 100 42 Antivirus detection for dropped file 2->42 44 Antivirus / Scanner detection for submitted sample 2->44 46 Multi AV Scanner detection for dropped file 2->46 48 5 other signatures 2->48 8 B52835C7A3E8E3D71540D7F1BBF3387958CA343752EAD.exe 3 7 2->8         started        11 fontdrvhost.exe 2->11         started        14 WmiPrvSE.exe 2 2->14         started        16 23 other processes 2->16 process3 file4 30 C:\MsHypercomWindhcp\containercrt.exe, PE32 8->30 dropped 32 C:\MsHypercomWindhcp\oJ94LpJg8Y.vbe, data 8->32 dropped 18 wscript.exe 1 8->18         started        20 wscript.exe 8->20         started        58 Antivirus detection for dropped file 11->58 60 Multi AV Scanner detection for dropped file 11->60 62 Machine Learning detection for dropped file 11->62 signatures5 process6 process7 22 cmd.exe 1 18->22         started        process8 24 containercrt.exe 3 42 22->24         started        28 conhost.exe 22->28         started        file9 34 C:\Windows\ServiceProfiles\wininit.exe, PE32 24->34 dropped 36 C:\Windows\...\OUlfhDQegTljMhBNfjyltsdQQ.exe, PE32 24->36 dropped 38 C:\Windows\DigitalLocker\en-US\WmiPrvSE.exe, PE32 24->38 dropped 40 15 other malicious files 24->40 dropped 50 Antivirus detection for dropped file 24->50 52 Multi AV Scanner detection for dropped file 24->52 54 Machine Learning detection for dropped file 24->54 56 3 other signatures 24->56 signatures10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b52835c7a3e8e3d71540d7f1bbf3387958ca343752ead1f8d09cd040cfeeb74e/
Threat name:
ByteCode-MSIL.Trojan.Uztuby
Create hunting rule
Status:
Malicious
First seen:
2022-08-18 15:33:16 UTC
File Type:
PE (Exe)
Extracted files:
22
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wuudlr5d5dr5ofka27y3x4zypfmmunbxklvnd6gqttiebt7ow5ha._file
Verdict:
malicious
Similar samples:
198c4342d01c3a4e12ba3de4e1e78e9950d174ef10b0a3039e41c973022b8a1f
DCRat
66bc2046ade6ee7d8a37ed169de795ea3ed78ef5fadb2ae1311758eac97d360a
DCRat
75f4f5ea593b662296588ab0a9df53905617e9761e3239a606b80ebc1d1825af
DCRat
99b71c75c4569e2c56a8ff077642b35f103dec1423c826257b4ca3771ce8ea5a
DCRat
b171ce02608257ab163b0dcdf443a91a41ffe02e2c74597cdb829f5088a7ca94
DCRat
c66c491bf92e6185a293fc73cd26e06310a956eaacc05fe0c719b8936fa002c6
DCRat
c9f6825c8f37158f43119ae24dd57fbf083a1e1497be4094c199cb96deb73c7d
DCRat
e8e3cddcc753e66757c3d6a47b63117f718103f03a039b40a4553849e04b8aec
DCRat
+ 3'735 additional samples on MalwareBazaar
Result
Malware family:
dcrat
Create hunting rule
Score:
  10/10
Tags:
family:dcrat infostealer rat
Link:
https://tria.ge/reports/221025-bxy3labcam/
Behaviour
Creates scheduled task(s)
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Drops file in Windows directory
Checks computer location settings
Loads dropped DLL
Executes dropped EXE
DCRat payload
DcRat
Process spawned unexpected child process
Unpacked files
SH256 hash:
d64198e171a22c42cf8a2ee47be33475000d3869f218b9717e07f0b5e26b9cf5
MD5 hash:
3feac7e7b45e485bc3ea2a39f1547b90
SHA1 hash:
be80d67844776d100f9329f53ce142c7309657e4
Link:
https://www.unpac.me/results/5686deda-10cb-4f55-b97e-dde4ab11183f/
SH256 hash:
460eea4cf1432250838cccdd413b3622e621732f55f7171a7c81547081125a03
MD5 hash:
1bd55ab6c6f988998bb45fe3fd14bfe3
SHA1 hash:
a25926daa5ff6a6cd64b2a7fce87dc828ca2ff71
Link:
https://www.unpac.me/results/5686deda-10cb-4f55-b97e-dde4ab11183f/
SH256 hash:
9f0be686eb649901bce21746c7f5c5db9132f5cc67365087861e1548fcabee2d
MD5 hash:
f4ff828040d43a10f36d6b9261a3e0c1
SHA1 hash:
2150d9d8dc161493963e1eed70b269faec797e21
Link:
https://www.unpac.me/results/5686deda-10cb-4f55-b97e-dde4ab11183f/
SH256 hash:
b52835c7a3e8e3d71540d7f1bbf3387958ca343752ead1f8d09cd040cfeeb74e
MD5 hash:
961884c72f561b66e4ff04e7c330466c
SHA1 hash:
bf16ed181dc0b713670dcffbe4bb60d5cd092222
Link:
https://www.unpac.me/results/5686deda-10cb-4f55-b97e-dde4ab11183f/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b52835c7a3e8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b52835c7a3e8e3d71540d7f1bbf3387958ca343752ead1f8d09cd040cfeeb74e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BAZT_B5_NOCEXInvalidStream
Create hunting rule
Rule name:NETDIC208_NOCEX_NOREACTOR
Create hunting rule
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:pe_imphash
Create hunting rule
Rule name:sfx_pdb
Create hunting rule
Author:@razvialex
Description:Detect interesting files containing sfx with pdb paths.
Rule name:sfx_pdb_winrar_restrict
Create hunting rule
Author:@razvialex
Description:Detect interesting files containing sfx with pdb paths.
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/323719/

Comments