MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bdc2f986320facc24627b6e31ae3ff0147583b04c262a386b2043557b59d06c0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DCRat


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bdc2f986320facc24627b6e31ae3ff0147583b04c262a386b2043557b59d06c0
SHA3-384 hash: 8974e71b596a8497bd0ab5a8730a7beb78125eaee68564d9479fc4f3d6179d9d9ee004343c39aa965e284a7d8f669964
SHA1 hash: 80ff3e79bc0679a0e2e91e811310e9fe59c5fcdb
MD5 hash: ec50388a69792d133c1298e1dceb40a6
humanhash: georgia-diet-orange-edward
File name:ec50388a69792d133c1298e1dceb40a6.exe
Download: download sample
Signature DCRat
Create hunting rule
File size:2'450'208 bytes
First seen:2023-03-13 09:29:00 UTC
Last seen:2023-03-13 11:29:01 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 4328f7206db519cd4e82283211d98e83 (533 x RedLineStealer, 18 x Arechclient2, 15 x DCRat)
ssdeep 49152:PuxU6VfbIhv2/g8nn7HoqW2m86bzBvwv+P9gB8xy2LmQKV:Wi6VzIA/gg7IR8iVgB8xybQKV
Threatray 1'601 similar samples on MalwareBazaar
TLSH T1C9B53314F7009AD4D9FC5AB1096BA37594612F0307D100EBBE5A3B0E4FFAA9E9B78171
TrID 27.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
20.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
18.6% (.EXE) Win32 Executable (generic) (4505/5/1)
8.5% (.ICL) Windows Icons Library (generic) (2059/9)
8.3% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 7cfcdcd8d4f4f4f4 (1 x PrivateLoader, 1 x DCRat, 1 x CoinMiner)
Reporter abuse_ch
Tags:DCRat exe signed

Code Signing Certificate

Organisation:HDD Verbatim Digital EVO-II 5Tb HDWG460EZSTA N300 (4096rpm) 4036Mb 0.5 Rtl
Issuer:HDD Verbatim Digital EVO-II 5Tb HDWG460EZSTA N300 (4096rpm) 4036Mb 0.5 Rtl
Algorithm:sha1WithRSAEncryption
Valid from:2023-01-22T17:37:55Z
Valid to:2033-01-23T17:37:55Z
Serial number: 117f03551552a9bd476d6d636ca0815e
Intelligence: 16 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: c2aafc3026236ab0a1aa6ee7f534b8d52a305c9c147a5d213626f6a8da449b62
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
224
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ec50388a69792d133c1298e1dceb40a6.exe
Verdict:
Malicious activity
Analysis date:
2023-03-13 09:42:10 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/abacee2d-eef8-4ffb-b733-222e8d64b6d5

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/373931/
Detection(s):
SecuriteInfo.com.Win32.Trojan-gen.16871.9704.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for analyzing tools
Сreating synchronization primitives
Creating a window
Changing a file
Creating a file
Using the Windows Management Instrumentation requests
Launching a process
Creating a file in the Windows subdirectories
Creating a file in the Program Files subdirectories
Modifying an executable file
Moving a recently created file
Enabling the 'hidden' option for recently created files
Moving a file to the Windows subdirectory
Creating a process from a recently created file
Searching for the window
Blocking the User Account Control
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
dcrat overlay packed
Link:
https://www.filescan.io/uploads/640eece115e425e0dcc1ca60/reports/945cc0b3-16d3-482a-af61-9754d39c6618/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/bdc2f986320facc24627b6e31ae3ff0147583b04c262a386b2043557b59d06c0
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/c7591883-4d35-45a0-8fcb-57e6b8cd597d
Result
Threat name:
DCRat
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1192740
Signature
Adds a directory exclusion to Windows Defender
Creates processes via WMI
Detected unpacking (changes PE section rights)
Disables UAC (registry)
Drops executables to the windows directory (C:\Windows) and starts them
Drops PE files with benign system names
Hides threads from debuggers
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Query firmware table information (likely to detect VMs)
Snort IDS alert for network traffic
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Uses schtasks.exe or at.exe to add and modify task schedules
Uses the Telegram API (likely for C&C communication)
Yara detected DCRat
Yara detected Generic Downloader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 825645 Sample: XJRYMMXcqj.exe Startdate: 13/03/2023 Architecture: WINDOWS Score: 100 48 ipinfo.io 2->48 50 api.telegram.org 2->50 54 Snort IDS alert for network traffic 2->54 56 Malicious sample detected (through community Yara rule) 2->56 58 Multi AV Scanner detection for dropped file 2->58 60 9 other signatures 2->60 8 XJRYMMXcqj.exe 2 34 2->8         started        12 backgroundTaskHost.exe 2->12         started        14 fontdrvhost.exe 3 2->14         started        16 30 other processes 2->16 signatures3 process4 file5 40 \Device40ull, PE32 8->40 dropped 42 C:\Windows\Setup\backgroundTaskHost.exe, PE32 8->42 dropped 44 C:\Windows\Setup\RCX93FB.tmp, PE32 8->44 dropped 46 24 other malicious files 8->46 dropped 68 Detected unpacking (changes PE section rights) 8->68 70 Query firmware table information (likely to detect VMs) 8->70 72 Uses schtasks.exe or at.exe to add and modify task schedules 8->72 80 4 other signatures 8->80 18 WmiPrvSE.exe 8->18         started        22 powershell.exe 8->22         started        24 powershell.exe 8->24         started        26 7 other processes 8->26 74 Multi AV Scanner detection for dropped file 12->74 76 Hides threads from debuggers 12->76 78 Tries to detect sandboxes / dynamic malware analysis system (registry check) 12->78 signatures6 process7 dnsIp8 52 87.251.77.205, 49700, 49701, 49702 HOSTKEY-ASNL Russian Federation 18->52 62 Query firmware table information (likely to detect VMs) 18->62 64 Hides threads from debuggers 18->64 66 Tries to detect sandboxes / dynamic malware analysis system (registry check) 18->66 28 conhost.exe 22->28         started        30 conhost.exe 24->30         started        32 conhost.exe 26->32         started        34 conhost.exe 26->34         started        36 conhost.exe 26->36         started        38 3 other processes 26->38 signatures9 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bdc2f986320facc24627b6e31ae3ff0147583b04c262a386b2043557b59d06c0/
Threat name:
Win32.Trojan.Casdet
Create hunting rule
Status:
Malicious
First seen:
2023-03-12 18:11:56 UTC
File Type:
PE (Exe)
Extracted files:
8
AV detection:
16 of 24 (66.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xxbptbrsb6wmerrhw3rrvy77afdvqoyeyjrkhbvsaq2vpnm5a3aa._file
Verdict:
malicious
Similar samples:
24cd4865f03fcaa7b5e76245734a43309cae82e24843cd667ceb3c3d46aa3095
DCRat
4fb9458ba400d1c797a8d1bf01032edfc3e77f7b4ab015856316afd790e16d77
DCRat
739a3e0733b75f4d7fcd2bc746422ea269ee8cb04e30fcad6d3b1e1163ececf1
DCRat
a484a486e4ccce5d89bed7fd21d3aef4802a85b3147a0445ccca16b3df95267a
DCRat
a6d8bed89596b313d874ca7d80bf6eae613f85d22e4dcd1b700c72ee008e4342
DCRat
e21d4e0b2f711e72b6251d1a0a5f1a703baffb7c7ddd1d1b087bc9068f17aaa8
DCRat
f66667737675b5cb1f3296aadb433275224d08c23ccee28107ca2fd4d5d3d53b
DCRat
f7954923c8a110188d24e4d27e68e57d7d1781882644386e57fbfb183b94b366
DCRat
fad1b92b67d6509a5d114b43395bd428b8fff6b827198083f1abc801a9c78525
DCRat
+ 1'591 additional samples on MalwareBazaar
Result
Malware family:
dcrat
Create hunting rule
Score:
  10/10
Tags:
family:dcrat evasion infostealer ransomware rat spyware stealer themida trojan
Link:
https://tria.ge/reports/230313-lfxtbahf45/
Behaviour
Creates scheduled task(s)
Interacts with shadow copies
Modifies registry class
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
System policy modification
Uses Task Scheduler COM API
Uses Volume Shadow Copy service COM API
Enumerates physical storage devices
Drops file in Program Files directory
Drops file in Windows directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks whether UAC is enabled
Enumerates connected drives
Looks up external IP address via web service
Checks BIOS information in registry
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Themida packer
Uses the VBS compiler for execution
Downloads MZ/PE file
Modifies extensions of user files
DCRat payload
Deletes shadow copies
Identifies VirtualBox via ACPI registry values (likely anti-VM)
DcRat
Process spawned unexpected child process
UAC bypass
Unpacked files
SH256 hash:
ec72653720966350d20ad98f69f8bd264e8f196368aaf38be70c92c2a2c52455
MD5 hash:
99bd51f1b8268132a698cd0829f9b995
SHA1 hash:
ce9c68886df72f849a0089dd45ad1708b6b509e1
Link:
https://www.unpac.me/results/bbccd1db-44ea-4102-baea-a1ed5be28fd7/
SH256 hash:
393ba5579150ada20d812646abdbfc687b64aa57e8def58f2cfe95843cbbf66c
MD5 hash:
d1d052c235fb4de3f36a092b5e6205e8
SHA1 hash:
a82e4f6dc962ec0ce52957aa51bc25f810f70ec3
Link:
https://www.unpac.me/results/bbccd1db-44ea-4102-baea-a1ed5be28fd7/
SH256 hash:
2dddd06e6a1be3c3100b6cf861d272ff74af65a5926bd7bacf62a70784a73e62
MD5 hash:
80b9ddc7e2886b3b84e8d65e9570fba5
SHA1 hash:
5b5380856e0948a50c4df14a5af80980fde53b27
Link:
https://www.unpac.me/results/bbccd1db-44ea-4102-baea-a1ed5be28fd7/
SH256 hash:
2c0a99a551ad2bf876bffff551290d8f5fcec1deacc88462228718109c97ceb5
MD5 hash:
a1f023dbcecaeadac32fe4a9f1ee2da0
SHA1 hash:
4741a95d506bb9093be1dfae4087cdebc028bd12
Link:
https://www.unpac.me/results/bbccd1db-44ea-4102-baea-a1ed5be28fd7/
SH256 hash:
6851e02d3f4b8179b975f00bbc86602a2f2f84524f548876eb656db7ea5eaa9c
MD5 hash:
c5124caf4aea3a83b63a9108fe0dcef8
SHA1 hash:
a43a5a59038fca5a63fa526277f241f855177ce6
Link:
https://www.unpac.me/results/bbccd1db-44ea-4102-baea-a1ed5be28fd7/
SH256 hash:
fd2ec49d506aa29e3158fe7fda840bf2201408a21398b46a2eb54604ed1b1bfb
MD5 hash:
19452337681375700e6c0514c44c3fad
SHA1 hash:
7f60c8bff9cfd0cec3b67e529c6ca987a0777573
Link:
https://www.unpac.me/results/bbccd1db-44ea-4102-baea-a1ed5be28fd7/
SH256 hash:
e16d31256434834519f0fc54095f9a5e03700adaba2e51a75dad1ab581441323
MD5 hash:
1edd3839f47ae345890b4dc71ba6cfe5
SHA1 hash:
0b6593476cd3f7a7292c1e5f63e137aebb147708
Link:
https://www.unpac.me/results/bbccd1db-44ea-4102-baea-a1ed5be28fd7/
SH256 hash:
bdc2f986320facc24627b6e31ae3ff0147583b04c262a386b2043557b59d06c0
MD5 hash:
ec50388a69792d133c1298e1dceb40a6
SHA1 hash:
80ff3e79bc0679a0e2e91e811310e9fe59c5fcdb
Link:
https://www.unpac.me/results/bbccd1db-44ea-4102-baea-a1ed5be28fd7/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/bdc2f986320f/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
DCRat
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/bdc2f986320facc24627b6e31ae3ff0147583b04c262a386b2043557b59d06c0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_Themida
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with Themida
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DCRat

Executable exe bdc2f986320facc24627b6e31ae3ff0147583b04c262a386b2043557b59d06c0

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/373931/
  
URLhaus
https://urlhaus.abuse.ch/url/2568412/
  
Delivery method
Distributed via web download

Comments