🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 be45c291ff3fb00e54164f8f4dac8b55d6e9ded30f6112bb508f844ce0ce092e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DCRat


Vendor detections: 13


Intelligence 13 IOCs 1 YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: be45c291ff3fb00e54164f8f4dac8b55d6e9ded30f6112bb508f844ce0ce092e
SHA3-384 hash: 309aa813d62f807f656453d0c9cb26af174c0c5d9f4afb9349027003a4f6814f2ab222a8706c34470fdee489e8b49a60
SHA1 hash: a820087f17519b60c9af0e167e9ef3364cc4aed9
MD5 hash: 0979b3bd68e2bae0b3a8045219380335
humanhash: summer-rugby-william-california
File name:0979B3BD68E2BAE0B3A8045219380335.exe
Download: download sample
Signature DCRat
Create hunting rule
File size:12'146'176 bytes
First seen:2026-08-26 15:45:15 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'221 x AgentTesla, 20'420 x Formbook, 12'370 x SnakeKeylogger)
ssdeep 98304:Ll2X8KwwfxwNjtkTwpPK++tAZ/Fza/JmUMMJ06:Ll2sKwOK8cpyjtAN6Ap
TLSH T1D2C6F14697628E33C2AA3B7184D7001E46B0C7627522FF1B763F18E1AC4A3719F569F6
TrID 70.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.2% (.EXE) Win64 Executable (generic) (6522/11/2)
4.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
Reporter abuse_ch
Tags:DCRat exe RAT


Avatar
abuse_ch
DCRat C2:
http://37.230.117.14/Auth5/Poll1VmDownloads/4geo5Server/8generatorPhp/Datalife4Datalife/0Betterdump/_sql/baseprotect/PipeJs_linuxTrackWordpressdatalifeUploads.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://37.230.117.14/Auth5/Poll1VmDownloads/4geo5Server/8generatorPhp/Datalife4Datalife/0Betterdump/_sql/baseprotect/PipeJs_linuxTrackWordpressdatalifeUploads.php https://threatfox.abuse.ch/ioc/1888277/

Intelligence

File Origin
# of uploads :
1
# of downloads :
202
Origin country :
NL NL
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/d1fa851b-d07a-42c4-8fea-f1ce474c3899/
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
No threats detected
Analysis date:
2026-08-26 16:22:58 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/193a0367-dc71-4e83-8184-5d45b2c5dae1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/82902/
Detection(s):
Sanesecurity.Malware.30425.UnRegNetReactor.UNOFFICIAL
Create hunting rule

Win.Packed.Uztuby-10009381-0
Create hunting rule

Win.Packed.Uztuby-10015036-0
Create hunting rule

Win.Packed.Uztuby-10015799-0
Create hunting rule

Win.Packed.Uztuby-10015902-0
Create hunting rule

Win.Packed.Uztuby-10017372-0
Create hunting rule

Win.Packed.Zusy-10023527-0
Create hunting rule

Win.Packed.Basic-10032438-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a file in the Program Files subdirectories
Creating a file
Creating a file in the %temp% directory
Deleting a recently created file
Running batch commands
Creating a process with a hidden window
Launching a process
Sending a UDP request
Creating a process from a recently created file
Loading a suspicious library
Using the Windows Management Instrumentation requests
Connection attempt
Sending an HTTP POST request
Unauthorized injection to a recently created process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
base64 net_reactor obfuscated obfuscated overlay packed packed reconnaissance
Link:
https://www.filescan.io/uploads/6a8f0a14d9c2b431268dd8ea/reports/0023d1e9-a54b-4c43-b31c-93986d70ef28/overview
Verdict:
Malicious
Labled as:
Trojan.MSIL.Basic.8
Link:
https://www.hybrid-analysis.com/sample/be45c291ff3fb00e54164f8f4dac8b55d6e9ded30f6112bb508f844ce0ce092e
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-08-24T11:43:00Z UTC
Last seen:
2026-08-27T18:17:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/be45c291ff3fb00e54164f8f4dac8b55d6e9ded30f6112bb508f844ce0ce092e/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/f7f649cf-d418-44d7-97fd-d565c5fd3ca5
Result
Threat name:
DCRat, zgRAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1964235
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Drops PE files with benign system names
Found malware configuration
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Files With System Process Name In Unsuspected Locations
Suricata IDS alerts for network traffic
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Yara detected DCRat
Yara detected MSIL Injector
Yara detected zgRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1964235 Sample: 8xLPMhiMAL.exe Startdate: 26/08/2026 Architecture: WINDOWS Score: 100 109 Suricata IDS alerts for network traffic 2->109 111 Found malware configuration 2->111 113 Antivirus detection for dropped file 2->113 115 10 other signatures 2->115 14 8xLPMhiMAL.exe 4 45 2->14         started        process3 file4 99 C:\ZBYIDFJE9140\cvtAX37QhekJN.exe, PE32 14->99 dropped 101 C:\Users\user\Desktop\yuVArXBi.log, PE32 14->101 dropped 103 C:\Users\user\Desktop\xyhabbee.log, PE32 14->103 dropped 105 31 other malicious files 14->105 dropped 127 Drops PE files with benign system names 14->127 18 cmd.exe 1 14->18         started        signatures5 process6 signatures7 117 Uses ping.exe to sleep 18->117 119 Uses ping.exe to check the status of other devices and networks 18->119 21 qFjNfsD7o92NcvP.exe 14 30 18->21         started        26 w32tm.exe 1 18->26         started        28 conhost.exe 18->28         started        30 chcp.com 1 18->30         started        process8 dnsIp9 107 37.230.117.14, 49711, 49712, 49714 RU-JSCIOTRU Russia 21->107 75 C:\Users\user\Desktop\yZtasEKt.log, PE32 21->75 dropped 77 C:\Users\user\Desktop\xlpRGrOv.log, PE32 21->77 dropped 79 C:\Users\user\Desktop\ulbbPIvF.log, PE32 21->79 dropped 81 21 other malicious files 21->81 dropped 121 Antivirus detection for dropped file 21->121 123 Multi AV Scanner detection for dropped file 21->123 125 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 21->125 32 cmd.exe 1 21->32         started        file10 signatures11 process12 process13 34 qFjNfsD7o92NcvP.exe 29 32->34         started        37 w32tm.exe 1 32->37         started        39 conhost.exe 32->39         started        41 chcp.com 1 32->41         started        file14 67 C:\Users\user\Desktop\yovrDNSQ.log, PE32 34->67 dropped 69 C:\Users\user\Desktop\xIaCwixY.log, PE32 34->69 dropped 71 C:\Users\user\Desktop\wusbLNob.log, PE32 34->71 dropped 73 21 other malicious files 34->73 dropped 43 cmd.exe 34->43         started        process15 process16 45 qFjNfsD7o92NcvP.exe 43->45         started        48 conhost.exe 43->48         started        50 chcp.com 43->50         started        52 w32tm.exe 43->52         started        file17 91 C:\Users\user\Desktop\ylCJtwnu.log, PE32 45->91 dropped 93 C:\Users\user\Desktop\xobBYwZz.log, PE32 45->93 dropped 95 C:\Users\user\Desktop\wAXtmidB.log, PE32 45->95 dropped 97 21 other malicious files 45->97 dropped 54 cmd.exe 45->54         started        process18 process19 56 qFjNfsD7o92NcvP.exe 54->56         started        59 conhost.exe 54->59         started        61 chcp.com 54->61         started        63 w32tm.exe 54->63         started        file20 83 C:\Users\user\Desktop\sRzCLLKa.log, PE32 56->83 dropped 85 C:\Users\user\Desktop\qcHMUuVk.log, PE32 56->85 dropped 87 C:\Users\user\Desktop\qFpTGpmi.log, PE32 56->87 dropped 89 21 other malicious files 56->89 dropped 65 cmd.exe 56->65         started        process21
Score:
98%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/be45c291ff3fb00e54164f8f4dac8b55d6e9ded30f6112bb508f844ce0ce092e
Verdict:
Malware
YARA:
14 match(es)
Tags:
.Net .Net Obfuscator .Net Reactor Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.90 Win 32 Exe x86
Link:
https://app.malva.re/file/0979b3bd68e2bae0b3a8045219380335
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/be45c291ff3fb00e54164f8f4dac8b55d6e9ded30f6112bb508f844ce0ce092e/
Threat name:
ByteCode-MSIL.Trojan.DCRat
Create hunting rule
Status:
Malicious
First seen:
2026-08-24 16:36:49 UTC
File Type:
PE (.Net Exe)
AV detection:
28 of 38 (73.68%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xzc4fep7h6ya4vawj6hu3lelkxlotxwtb5qrfo2qr6cezygobexa._file
Result
Malware family:
dcrat
Create hunting rule
Score:
  10/10
Tags:
family:dcrat discovery execution infostealer rat
Link:
https://tria.ge/reports/260826-s7d9ls1hkh/
Behaviour
Modifies registry class
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Executes a command shell one-liner
System Network Configuration Discovery: Internet Connection Discovery
Drops file in Program Files directory
Drops file in Windows directory
.NET Reactor proctector
Checks computer location settings
Executes dropped EXE
DCRat payload
Family: DcRat
Unpacked files
SH256 hash:
be45c291ff3fb00e54164f8f4dac8b55d6e9ded30f6112bb508f844ce0ce092e
MD5 hash:
0979b3bd68e2bae0b3a8045219380335
SHA1 hash:
a820087f17519b60c9af0e167e9ef3364cc4aed9
Link:
https://www.unpac.me/results/b00d319d-e3f8-4d40-a814-dc5bd87b99a2/
SH256 hash:
0563b6b8e0c290c204bdeec6a2212a59ea86206c01087245ec0bb174f742f823
MD5 hash:
a06017f469fdf0624211f7e53c7d035c
SHA1 hash:
0941b80cf79eda53eb3326e5f3c47685060b82f8
Link:
https://www.unpac.me/results/b00d319d-e3f8-4d40-a814-dc5bd87b99a2/
SH256 hash:
2b93377ea087225820a9f8e4f331005a0c600d557242366f06e0c1eae003d669
MD5 hash:
d8bf2a0481c0a17a634d066a711c12e9
SHA1 hash:
7cc01a58831ed109f85b64fe4920278cedf3e38d
Link:
https://www.unpac.me/results/b00d319d-e3f8-4d40-a814-dc5bd87b99a2/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/be45c291ff3fb00e54164f8f4dac8b55d6e9ded30f6112bb508f844ce0ce092e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DotNet_Reactor
Create hunting rule
Author:@bartblaze
Description:Identifies .NET Reactor, which offers .NET code protection such as obfuscation, encryption and so on.
Rule name:INDICATOR_EXE_Packed_DotNetReactor
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with unregistered version of .NET Reactor
Rule name:Lumma_Stealer_Detection
Create hunting rule
Author:ashizZz
Description:Detects a specific Lumma Stealer malware sample using unique strings and behaviors
Reference:https://seanthegeek.net/posts/compromized-store-spread-lumma-stealer-using-fake-captcha/
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:PureCrypter
Create hunting rule
Author:@bartblaze
Description:Identifies PureCrypter, .NET loader and obfuscator.
Reference:https://malpedia.caad.fkie.fraunhofer.de/details/win.purecrypter
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/82902/

Comments