MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c08c41059368f7b4b4e23384333d646b786b335a71516073c7a70a4b436f952f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DCRat


Vendor detections: 15


Intelligence 15 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c08c41059368f7b4b4e23384333d646b786b335a71516073c7a70a4b436f952f
SHA3-384 hash: 148fef38a1db781f290d38c5ac2dcf5aa87694e40f13d52a94a85cc633ca34db45e7cd001e0c260bd146806417a10b86
SHA1 hash: 16ca63ae2af172d0150859b2543c5e9e7ca39c70
MD5 hash: 2dc2774c63a62538d966961e331b8c62
humanhash: pizza-timing-floor-quiet
File name:BlockdriverhostPerf.exe
Download: download sample
Signature DCRat
Create hunting rule
File size:1'639'936 bytes
First seen:2024-03-23 13:42:53 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'750 x AgentTesla, 19'656 x Formbook, 12'248 x SnakeKeylogger)
ssdeep 49152:00RIIcFWbpbtNawg3dami/S5JasQHcxJ:03FWbp0i/Sycx
Threatray 21 similar samples on MalwareBazaar
TLSH T135759E1A65925E73C2A41B328667013E9290C7663B51EF1F391F61D2A90BFF18A731F3
TrID 60.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.8% (.SCR) Windows screen saver (13097/50/3)
8.7% (.EXE) Win64 Executable (generic) (10523/12/4)
5.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
Reporter petrovic
Tags:DCRat exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
358
Origin country :
GB GB
Vendor Threat Intelligence
Malware family:
dcrat
Create hunting rule
ID:
1
File name:
Новый текстовый документ.txt
Verdict:
Malicious activity
Analysis date:
2024-03-23 12:11:47 UTC
Tags:
dcrat rat backdoor remote stealer
Link:
https://app.any.run/tasks/6aa3ad1c-0e39-4f05-8d65-d13f017ef638

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a file
Creating a file in the Windows subdirectories
Creating a file in the Program Files subdirectories
Creating a file in the %temp% directory
Running batch commands
Creating a process with a hidden window
Launching a process
Creating a process from a recently created file
Connection attempt to an infection source
Creating a window
Using the Windows Management Instrumentation requests
Searching for synchronization primitives
Unauthorized injection to a recently created process
Query of malicious DNS domain
Sending an HTTP POST request to an infection source
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
net_reactor packed packed
Link:
https://www.filescan.io/uploads/65fedc695810ce66d149b8e9/reports/44207fd6-60b0-4250-9508-8856955d5f75/overview
Verdict:
Malicious
Labled as:
Trojan.MSIL.Basic.8
Link:
https://www.hybrid-analysis.com/sample/c08c41059368f7b4b4e23384333d646b786b335a71516073c7a70a4b436f952f
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/de6c8db9-3e84-4471-bd55-fb5b68979c2a
Result
Threat name:
DCRat, PureLog Stealer, zgRAT
Create hunting rule
Detection:
malicious
Classification:
rans.troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1414474
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Drops PE files with benign system names
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Sigma detected: Files With System Process Name In Unsuspected Locations
Snort IDS alert for network traffic
Uses shutdown.exe to shutdown or reboot the system
Yara detected DCRat
Yara detected PureLog Stealer
Yara detected zgRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1414474 Sample: BlockdriverhostPerf.exe Startdate: 23/03/2024 Architecture: WINDOWS Score: 100 42 926388cm.n9shteam3.top 2->42 50 Snort IDS alert for network traffic 2->50 52 Antivirus detection for URL or domain 2->52 54 Antivirus detection for dropped file 2->54 56 10 other signatures 2->56 10 BlockdriverhostPerf.exe 4 22 2->10         started        signatures3 process4 file5 30 C:\Windows\Temp\Crashpad\...\PiHjpHWoSYKq.exe, PE32 10->30 dropped 32 C:\Windows\AppReadiness\explorer.exe, PE32 10->32 dropped 34 C:\Users\Default\Music\PiHjpHWoSYKq.exe, PE32 10->34 dropped 36 3 other malicious files 10->36 dropped 58 Drops PE files with benign system names 10->58 14 cmd.exe 1 10->14         started        signatures6 process7 process8 16 PiHjpHWoSYKq.exe 14 3 14->16         started        20 w32tm.exe 1 14->20         started        22 conhost.exe 14->22         started        24 chcp.com 1 14->24         started        dnsIp9 38 926388cm.n9shteam3.top 172.67.145.174, 49705, 49706, 49707 CLOUDFLARENETUS United States 16->38 40 104.21.79.128, 49866, 50116, 80 CLOUDFLARENETUS United States 16->40 44 Multi AV Scanner detection for dropped file 16->44 46 Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines) 16->46 48 Uses shutdown.exe to shutdown or reboot the system 16->48 26 shutdown.exe 1 16->26         started        signatures10 process11 process12 28 conhost.exe 26->28         started       
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/c08c41059368f7b4b4e23384333d646b786b335a71516073c7a70a4b436f952f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c08c41059368f7b4b4e23384333d646b786b335a71516073c7a70a4b436f952f/
Threat name:
ByteCode-MSIL.Trojan.DCRat
Create hunting rule
Status:
Malicious
First seen:
2024-03-23 13:43:07 UTC
File Type:
PE (.Net Exe)
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ycgecbmtnd33jnhcgocdgplenn4gwm22ofiwa46hu4fewq3psuxq._file
Verdict:
malicious
Similar samples:
82f0b4f78289836c0540291e50bc9adaa04b9fe277786c7004aebd8e378b02fd
DCRat
846646dae2f70ac644cd3420d1d465593f654b3f827e84b2ef421e701b37a72e
DCRat
9713fe346cdfa4b838146c7f0f4f61429d18ed0aa89eef45115f14e5e4f660d9
DCRat
d21d9ef91d1b4670508e2f0a7fe92ff37f313ffac33af7c41ee2757cb1c1cde2
DCRat
e434b8362b39f1202159b48a025eece729c54a2627c04fe927ece4566c2ca2b7
DCRat
fd013757b73bc051725a6cd214b5b5a4373ce97105404a7608226bb7e700fab5
DCRat
+ 11 additional samples on MalwareBazaar
Result
Malware family:
zgrat
Create hunting rule
Score:
  10/10
Tags:
family:zgrat rat
Link:
https://tria.ge/reports/240323-qz83xaba4z/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Drops file in Windows directory
Checks computer location settings
Detect ZGRat V1
ZGRat
Unpacked files
SH256 hash:
c08c41059368f7b4b4e23384333d646b786b335a71516073c7a70a4b436f952f
MD5 hash:
2dc2774c63a62538d966961e331b8c62
SHA1 hash:
16ca63ae2af172d0150859b2543c5e9e7ca39c70
Detections:
INDICATOR_EXE_Packed_DotNetReactor
Create hunting rule
Link:
https://www.unpac.me/results/e2a41c58-d7b1-41a8-bcef-68ab574f523b/
Parent samples :
c08c41059368f7b4b4e23384333d646b786b335a71516073c7a70a4b436f952f
ac15d82441447b30e13ba57c3c2ab12dae50e7396c74991393bd225f3784aab9
fd7ce76f9b83750fb21dff83c8d5a73d4cea124bd6f6dc70dc0ae6a4a259201a
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c08c41059368f7b4b4e23384333d646b786b335a71516073c7a70a4b436f952f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_DotNetReactor
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with unregistered version of .NET Reactor
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments