MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bb13cf7f4d7f5db58730a4dd948093ab12ee0f65c2393784e43143913d51130b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DCRat


Vendor detections: 10


Intelligence 10 IOCs 1 YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bb13cf7f4d7f5db58730a4dd948093ab12ee0f65c2393784e43143913d51130b
SHA3-384 hash: 49886d7541ab1cb561939478f531730a8931177d15106ce5150ece3e664cf02c9138276d980d2462e5712d148bb3801a
SHA1 hash: fe7979247f13e40a912d3699616ea9fc60c07fa4
MD5 hash: 35446b2c71a2f3e2556e450139688a51
humanhash: seven-twelve-thirteen-kitten
File name:BB13CF7F4D7F5DB58730A4DD948093AB12EE0F65C2393.exe
Download: download sample
Signature DCRat
Create hunting rule
File size:1'253'376 bytes
First seen:2021-06-16 18:16:08 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 2e5467cba76f44a088d39f78c5e807b6 (131 x DCRat, 112 x njrat, 79 x RedLineStealer)
ssdeep 24576:pbai7vbsZ8Ax+D8EjPQxX74hRUOrvteXruVvN5ON6ZtMyH0BBO/fBTv:pei7AZ89IuPQx7a2GcXKRrONiCyH0m/x
Threatray 54 similar samples on MalwareBazaar
TLSH 8045331E7A2A1771F0C6987B4146A1FC85007928A12ED57EAC693E2FF8DE52C71097F8
Reporter abuse_ch
Tags:DCRat exe


Avatar
abuse_ch
DCRat C2:
http://178.250.156.252/lnrb8w5q8kl6x49ip0n6lu4yqhxwbq350d2dz/3fbo9/4fxjvavaxn3rtoym4lm9buub863awdlcfgsh3d2fki2psus/049a32d523ce9d6119f6440814453755.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://178.250.156.252/lnrb8w5q8kl6x49ip0n6lu4yqhxwbq350d2dz/3fbo9/4fxjvavaxn3rtoym4lm9buub863awdlcfgsh3d2fki2psus/049a32d523ce9d6119f6440814453755.php https://threatfox.abuse.ch/ioc/130860/

Intelligence

File Origin
# of uploads :
1
# of downloads :
169
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
BB13CF7F4D7F5DB58730A4DD948093AB12EE0F65C2393.exe
Verdict:
Malicious activity
Analysis date:
2021-06-16 18:32:22 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/817aceb5-70e1-4c70-b6fd-84b4bc2318c7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
PUA.Win.Packer.EnigmaProtector-19
Create hunting rule

PUA.Win.Packer.EnigmaProtector-1
Create hunting rule

Win.Malware.Generickdz-9845430-0
Create hunting rule

PUA.Win.Packer.EnigmaProtector-9852682-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Using the Windows Management Instrumentation requests
Sending a UDP request
Creating a file
Launching a process
Creating a file in the Windows subdirectories
Creating a process from a recently created file
Sending an HTTP GET request
Creating a window
DNS request
Sending a custom TCP request
Creating a file in the %temp% directory
Deleting a recently created file
Reading critical registry keys
Unauthorized injection to a recently created process by context flags manipulation
Setting a global event handler for the keyboard
Stealing user critical data
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Dark Crystal RAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4c6ebdd0-5f52-4c87-9832-c34cf29b0d38
Result
Threat name:
DCRat
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/803265
Signature
.NET source code contains in memory code execution
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code references suspicious native API functions
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Drops executable to a common third party application directory
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has nameless sections
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Sigma detected: Schedule system process
Tries to evade analysis by execution special instruction which cause usermode exception
Tries to harvest and steal browser information (history, passwords, etc)
Uses schtasks.exe or at.exe to add and modify task schedules
Uses the Telegram API (likely for C&C communication)
Writes to foreign memory regions
Yara detected DCRat
Yara detected PasswordDump Tool
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 435676 Sample: BB13CF7F4D7F5DB58730A4DD948... Startdate: 16/06/2021 Architecture: WINDOWS Score: 100 59 Found malware configuration 2->59 61 Antivirus detection for dropped file 2->61 63 Antivirus / Scanner detection for submitted sample 2->63 65 15 other signatures 2->65 7 BB13CF7F4D7F5DB58730A4DD948093AB12EE0F65C2393.exe 25 2->7         started        11 wermgr.exe 2->11         started        14 RuntimeBroker.exe 4 2->14         started        16 3 other processes 2->16 process3 dnsIp4 43 C:\Users\Public\Pictures\wermgr.exe, PE32 7->43 dropped 45 C:\Users\Default\AppData\Roaming\...\Idle.exe, PE32 7->45 dropped 47 C:\Users\Default\...\backgroundTaskHost.exe, PE32 7->47 dropped 49 12 other malicious files 7->49 dropped 69 Detected unpacking (changes PE section rights) 7->69 71 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 7->71 73 Uses schtasks.exe or at.exe to add and modify task schedules 7->73 89 5 other signatures 7->89 18 schtasks.exe 7->18         started        20 schtasks.exe 2 7->20         started        22 qLuOKzrnbPTKCrLaItxh.exe 7->22         started        25 5 other processes 7->25 51 178.250.156.252, 49722, 49726, 49729 THEFIRST-ASRU Russian Federation 11->51 53 api.telegram.org 149.154.167.220, 443, 49724 TELEGRAMRU United Kingdom 11->53 55 ipinfo.io 34.117.59.81, 443, 49725 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 11->55 75 Antivirus detection for dropped file 11->75 77 Multi AV Scanner detection for dropped file 11->77 79 May check the online IP address of the machine 11->79 81 Tries to harvest and steal browser information (history, passwords, etc) 11->81 83 Machine Learning detection for dropped file 14->83 85 Tries to evade analysis by execution special instruction which cause usermode exception 14->85 87 Hides threads from debuggers 14->87 file5 signatures6 process7 signatures8 27 WerFault.exe 18->27         started        31 conhost.exe 18->31         started        33 conhost.exe 20->33         started        67 Hides threads from debuggers 22->67 35 conhost.exe 25->35         started        37 conhost.exe 25->37         started        39 conhost.exe 25->39         started        41 2 other processes 25->41 process9 dnsIp10 57 192.168.2.1 unknown unknown 27->57 91 Tries to evade analysis by execution special instruction which cause usermode exception 27->91 93 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 33->93 signatures11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bb13cf7f4d7f5db58730a4dd948093ab12ee0f65c2393784e43143913d51130b/
Threat name:
Win32.Packed.EnigmaProtector
Create hunting rule
Status:
Malicious
First seen:
2021-04-14 03:59:14 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
26 of 29 (89.66%)
Threat level:
  1/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xmj4672np5o3lbzqutozjaetvmjo4d3fyi4tpbhegfbzcpkrcmfq._file
Verdict:
suspicious
Similar samples:
0c7591403c6672c67cd0fbb1a7d4db34a224e5388a81a82a725811999bc49b4e
DCRat
53e72c77ac1b8f4a54db9bb9b178720062176e09f026f7c9b0c9bba62ace16a5
DCRat
546e5320773891c160621ec99d48fb4d90d6d58bc26ab01d7e5a3f16fec9636c
DCRat
6ef31a13d71d059d6e007fb2305c8e2d7615c3d468c9f2f4e023b45490b50787
DCRat
84ae6fe4cd4f1357409af9eeea51b0ceb8385242c1e67b1f22a51a9475f3ce01
DCRat
bf375d5c15abb5c57b0cc3371a3537b79560fe82b1aff486afde752e05971ebb
DCRat
cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427
DCRat
d1597e584fec8eb356aa5c831045b2ce68531e69fe70436fa3ca0d8dd1d90ca7
DCRat
d81e62102d9b748aaabf4f06bf0c09a66dfaaac7836374016a5f076b6f7ed418
DCRat
e3ac84aeb4c0a6606a5e385327f371c36335954f27ec4151d616fbb73d466e37
DCRat
+ 44 additional samples on MalwareBazaar
Result
Malware family:
dcrat
Create hunting rule
Score:
  10/10
Tags:
family:dcrat infostealer rat spyware stealer
Link:
https://tria.ge/reports/210616-zvc795tvba/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Program crash
Drops file in Program Files directory
Drops file in Windows directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Looks up external IP address via web service
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
DcRat
Unpacked files
SH256 hash:
bb13cf7f4d7f5db58730a4dd948093ab12ee0f65c2393784e43143913d51130b
MD5 hash:
35446b2c71a2f3e2556e450139688a51
SHA1 hash:
fe7979247f13e40a912d3699616ea9fc60c07fa4
Link:
https://www.unpac.me/results/262b8a11-0ea0-4440-af8c-15e1351cd825/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/bb13cf7f4d7f5db58730a4dd948093ab12ee0f65c2393784e43143913d51130b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:EnigmaStub
Create hunting rule
Author:@bartblaze
Description:Identifies Enigma packer stub.
Rule name:INDICATOR_EXE_Packed_Loader
Create hunting rule
Author:ditekSHen
Description:Detects packed executables observed in Molerats
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:MAL_Unknown_PWDumper_Apr18_3
Create hunting rule
Author:Florian Roth
Description:Detects sample from unknown sample set - IL origin
Reference:Internal Research
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_XORed_URL_in_EXE
Create hunting rule
Author:Florian Roth
Description:Detects an XORed URL in an executable
Reference:https://twitter.com/stvemillertime/status/1237035794973560834
Rule name:win_smominru_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments