MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b73694f482085281fba7fc9176da365d802dc1302f3b9072f72dfbf308474365. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DCRat


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b73694f482085281fba7fc9176da365d802dc1302f3b9072f72dfbf308474365
SHA3-384 hash: bb1c0f1b009fd2cb588e9990ed29ae0d3fdf6edf3151905ef86c6124cd03090332503ad3cf5097ba4cee5af7d4b56be5
SHA1 hash: a033be5a5a8693f41af5425f9e7cfa21d87dca24
MD5 hash: ffaad32980cb12252ed0f9ccdaf6a4ca
humanhash: red-winner-oxygen-robin
File name:ffaad32980cb12252ed0f9ccdaf6a4ca.exe
Download: download sample
Signature DCRat
Create hunting rule
File size:7'680 bytes
First seen:2022-04-26 04:17:37 UTC
Last seen:2022-04-26 04:41:49 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'658 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 96:VI/HPIsIVRYrjHK6FOxXrKDz+m9LlPQN6lAw2eFjCI9nwiSzNt:5OzK3x7O+m9L+NYAw2Ijz9nPU
Threatray 2'077 similar samples on MalwareBazaar
TLSH T10DF1E917EBE8423EDE790B736C6357100B7697419C23DB9F69C8401B6E637844BA2B31
TrID 69.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.9% (.EXE) Win64 Executable (generic) (10523/12/4)
6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.2% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter abuse_ch
Tags:DCRat exe RAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
298
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/266603/
Detection(s):
SecuriteInfo.com.BackDoor.AsyncRATNET.2.32396.28486.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Creating a window
Using the Windows Management Instrumentation requests
Сreating synchronization primitives
DNS request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed replace.exe
Link:
https://www.filescan.io/uploads/6267728a2f162d9fdf69b6a7/reports/fcbebaa7-c08d-4062-8a8a-b15ceabe62ff/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6013127e-99c6-413c-8205-a2bbbe5be05a
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/982877
Signature
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b73694f482085281fba7fc9176da365d802dc1302f3b9072f72dfbf308474365/
Threat name:
ByteCode-MSIL.Trojan.Tiggre
Create hunting rule
Status:
Malicious
First seen:
2022-04-20 00:41:11 UTC
File Type:
PE (.Net Exe)
Extracted files:
2
AV detection:
24 of 26 (92.31%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=w43jj5ecbbjid65h7sixnwrwlwac3qjqf45za4xxfx57gcchinsq._file
Verdict:
malicious
Label(s):
asyncrat
Create hunting rule
Similar samples:
5c6457b1c5d9a5669d01a39aeabd18d08a8de3027e2667cc9418c5072341c931
DCRat
6acd5eb47c8c0bd86c1f04947074656f1e77a48dc4f5d2b02b487b4942dfe6c9
DCRat
b7087d25fb4bbe998f0eafc49d58bb04dc9c50d3b9ca55c1e52d2ba8dd1b9fbc
DCRat
ba2c8fcdef3c1675e57b94c9a7b04088a68d98110cf1ddf509eae437f731b138
DCRat
d0fef87fd7e5a7214773deef4c445970147c88d5335867b552f9d4d22ef0231b
DCRat
d17d26fe698a00cf23683e5df58679d6d1bf18866de4b87edb62a2bc64cb22bc
DCRat
+ 2'067 additional samples on MalwareBazaar
Result
Malware family:
asyncrat
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat botnet:default rat suricata
Link:
https://tria.ge/reports/220426-ewyl8afafq/
Behaviour
Suspicious use of AdjustPrivilegeToken
Async RAT payload
AsyncRat
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT)
Malware Config
C2 Extraction:
127.0.0.1:8848
jyzjkjj.com:8848
Unpacked files
SH256 hash:
b73694f482085281fba7fc9176da365d802dc1302f3b9072f72dfbf308474365
MD5 hash:
ffaad32980cb12252ed0f9ccdaf6a4ca
SHA1 hash:
a033be5a5a8693f41af5425f9e7cfa21d87dca24
Link:
https://www.unpac.me/results/f61cbb39-d769-4da2-8118-c91221757a51/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/b73694f482085281fba7fc9176da365d802dc1302f3b9072f72dfbf308474365

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb2
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/266603/

Comments