MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c709256808d07869ced7a73c9ea9d6959c952b235e7e1687d6263a1d204f928a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

DCRat

Vendor detections: 11

Intelligence 11 IOCs YARA 6 File information Comments 1

SHA256 hash:	c709256808d07869ced7a73c9ea9d6959c952b235e7e1687d6263a1d204f928a
SHA3-384 hash:	3b925207f8f61753f89dbc3f88d4c82913ec0fcc05bba976b209f961bf07eba233cf0601467708d88800108b7e494836
SHA1 hash:	f7933ecb695d4de8c8df23b38c72d0764d26b7ed
MD5 hash:	ede7f0991c44aec38b041cf4301a492d
humanhash:	florida-winner-pizza-nuts
File name:	ede7f0991c44aec38b041cf4301a492d
Download:	download sample
Signature	DCRat Create hunting rule
File size:	368'640 bytes
First seen:	2022-07-16 12:54:08 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'658 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep	1536:lrBP0DBoWAIBn2UTiJzGMIeaJ3rPDhbqE8wRysrpp65lDVclN:6SzKn2UQzGMIeaJ3rPDhbl1PvSlpY
Threatray	1'176 similar samples on MalwareBazaar
TLSH	T11A7486D832147B8EC867CEBD89B45C64AE607C67931B4103A55336DD9A3E9C7CF21CA2
TrID	69.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 9.9% (.EXE) Win64 Executable (generic) (10523/12/4) 6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.7% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.2% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	e8aa69d4d4cc8ee8 (7 x QuasarRAT, 4 x DCRat, 2 x OrcusRAT)
Reporter	zbetcheckin
Tags:	32 DCRat exe

Intelligence

File Origin

# of uploads :

# of downloads :

443

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

asyncrat

ID:

File name:

binded2.exe

Verdict:

Malicious activity

Analysis date:

2022-07-16 19:26:37 UTC

Tags:

asyncrat

Link:

https://app.any.run/tasks/db10bfbb-8df8-4600-be5e-cac9fa655de6

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/291215/

Detection(s):

Win.Malware.Generickdz-9865912-0

PUA.Win.Packed.ConfuserEx-6391397-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Using the Windows Management Instrumentation requests

Сreating synchronization primitives

Running batch commands

Creating a process with a hidden window

Creating a file in the %AppData% directory

Creating a file in the %temp% directory

Creating a file

Launching a process

Creating a process from a recently created file

DNS request

Sending a custom TCP request

Creating a window

Sending an HTTP GET request

Deleting a recently created file

Changing a file

Unauthorized injection to a recently created process

Enabling autorun by creating a file

Gathering data

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

DCRat

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/8fcc6021-8b6d-46a5-88b7-0309aa31a8d5

Result

Threat name:

AsyncRAT, DcRat

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1033735

Behaviour

Behavior Graph:

n/a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c709256808d07869ced7a73c9ea9d6959c952b235e7e1687d6263a1d204f928a/

Threat name:

Win32.Trojan.AgentTesla

Status:

Malicious

First seen:

2022-07-16 09:56:02 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

20 of 26 (76.92%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=y4esk2ai2b4gttwxu46j5kowswojkkzdlz7bnb6wey5b2icpskfa._file

Verdict:

malicious

Label(s):

asyncrat

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/220716-p5tpqscgbj/

Behaviour

Program crash

Unpacked files

SH256 hash:

c709256808d07869ced7a73c9ea9d6959c952b235e7e1687d6263a1d204f928a

MD5 hash:

ede7f0991c44aec38b041cf4301a492d

SHA1 hash:

f7933ecb695d4de8c8df23b38c72d0764d26b7ed

Link:

https://www.unpac.me/results/1b5f2159-6b26-44e0-b885-c45d0293ae00/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

iSpy Keylogger

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c709256808d07869ced7a73c9ea9d6959c952b235e7e1687d6263a1d204f928a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_EXE_Packed_ConfuserEx Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with ConfuserEx Mod

Rule name:	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts Create hunting rule
Author:	ditekSHen
Description:	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.

Rule name:	INDICATOR_SUSPICIOUS_EXE_DcRatBy Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing the string DcRatBy

Rule name:	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice Create hunting rule
Author:	ditekSHen
Description:	Detects executables attemping to enumerate video devices using WMI