MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d06c0b20a27d2adcf82fd87832990af27b06ad1f80156b1e914451530efe1b03. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	d06c0b20a27d2adcf82fd87832990af27b06ad1f80156b1e914451530efe1b03
SHA3-384 hash:	f9f5b115a4c40eb0e9d48e61ea3c0360d02a00b33a1982c3fea074d28813347c19a984795f7542b90e0d09f133e19a57
SHA1 hash:	f855b953cee255476b19733ea12abd1989759579
MD5 hash:	b467b14fff29778519c84555a821266c
humanhash:	sad-ceiling-dakota-enemy
File name:	b467b14fff29778519c84555a821266c.exe
Download:	download sample
Signature	DCRat Alert Create hunting rule
File size:	1'534'976 bytes
First seen:	2023-12-29 15:50:14 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	24576:BgcIEAb1d0peOEk9mk6A58R2wgLqTF2Z26D+:CcIZ0p9NmkN5CG
Threatray	10 similar samples on MalwareBazaar
TLSH	T1CA65A22439EB102AF173EFB59AE4749ACA6FF6B33707589E205103864713B81DDD163A
TrID	59.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.6% (.SCR) Windows screen saver (13097/50/3) 8.5% (.EXE) Win64 Executable (generic) (10523/12/4) 5.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.0% (.EXE) Win16 NE executable (generic) (5038/12/1)
Reporter	abuse_ch
Tags:	DCRat exe

abuse_ch

DCRat C2:
http://79.174.94.220/videoPipecpuWindowsAsyncwordpressDatalife.php

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

340

Origin country :

NL

Vendor Threat Intelligence

ANY.RUN dcrat

Malware family:

dcrat

Alert

Create hunting rule

ID:

1

File name:

d06c0b20a27d2adcf82fd87832990af27b06ad1f80156b1e914451530efe1b03.exe

Verdict:

Malicious activity

Analysis date:

2023-12-29 15:52:04 UTC

Tags:

rat backdoor dcrat remote stealer

Link:

https://app.any.run/tasks/1ebe39c1-65bb-48fd-976e-226120065b4a

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

ClamAV Detected

Detection(s):

Win.Packed.Uztuby-10015799-0

Alert

Create hunting rule

Win.Packed.Uztuby-10017372-0

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Creating a file

Creating a file in the %temp% directory

Running batch commands

Creating a process with a hidden window

Launching a process

Creating a process from a recently created file

Loading a suspicious library

Using the Windows Management Instrumentation requests

Sending an HTTP POST request

Creating a window

Searching for synchronization primitives

Unauthorized injection to a recently created process

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm cmd lolbin lolbin replace

Link:

https://www.filescan.io/uploads/658eeae77d4bdb7f8b001499/reports/be123073-8341-405b-aeb5-d2a7294b74a7/overview

Hybrid Analysis IL:Trojan.MSILZilla

Verdict:

Malicious

Labled as:

IL:Trojan.MSILZilla

Link:

https://www.hybrid-analysis.com/sample/d06c0b20a27d2adcf82fd87832990af27b06ad1f80156b1e914451530efe1b03

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Generic Malware

Malware family:

Generic Malware

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/99174321-c3c7-4f6b-b03e-ed11752391b8

Joe Sandbox DCRat

Result

Threat name:

DCRat

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1368015

Signature

.NET source code contains potential unpacker

.NET source code contains very large strings

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Machine Learning detection for dropped file

Machine Learning detection for sample

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Snort IDS alert for network traffic

Yara detected DCRat

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/d06c0b20a27d2adcf82fd87832990af27b06ad1f80156b1e914451530efe1b03

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d06c0b20a27d2adcf82fd87832990af27b06ad1f80156b1e914451530efe1b03/

ReversingLabs TitaniumCloud ByteCode-MSIL.Backdoor.DCRat

Threat name:

ByteCode-MSIL.Backdoor.DCRat

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-23 17:52:36 UTC

File Type:

PE (.Net Exe)

AV detection:

29 of 37 (78.38%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2bwawifcpuvnz6bp3b4dfgik6j5qnli7qakwwhuririvgdx6dmbq._file

Threatray malicious

Verdict:

malicious

Similar samples:

0688ce617e2e8af025340b42e79620a52527962ee200f9efd29b664282845ac5

DCRat

18425dae9f0a49097d0abdd28ec465bfe2f4161b7849fb28494b8058a18ebcfc

DCRat

21db4cd681095da19d677cceaa96d61b988bbbc3be10bb834011c87c9641185c

DCRat

2b4e2e22cbb5e97af111f8bc8d4e2b393e3e7931be06f639cea37a221d56316e

DCRat

3fb7af8c998cbcc414afa0dccb923bbe75e68b619eaa3198d8ee216ef48f76b0

DCRat

40faf695c36c68e2cb0e605c72a8b2fdc0a5ea561b01fb74d4e66d0c98707c0a

DCRat

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

n/a

Link:

https://tria.ge/reports/231229-tagh5shef4/

Behaviour

Modifies registry class

Runs ping.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Drops file in Program Files directory

Checks computer location settings

Executes dropped EXE

UnpacMe INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File cn_utf8_windows_terminal

Unpacked files

SH256 hash:

aab95596475ca74cede5ba50f642d92fa029f6f74f6faeae82a9a07285a5fb97

MD5 hash:

f4b38d0f95b7e844dd288b441ebc9aaf

SHA1 hash:

9cbf5c6e865ae50cec25d95ef70f3c8c0f2a6cbf

Link:

https://www.unpac.me/results/19d37dd5-0dc9-4d49-9ae2-ecbe642bfa85/

SH256 hash:

90698d3a98610dce1bb4e267d87f6ca067fdf54ff942a33f04f48acb9b80159d

MD5 hash:

a0d2b9463b7b4a97205bc334ad9e75d6

SHA1 hash:

827e9caf20e10989dffd4bab3ca2c8cfabebcfad

Link:

https://www.unpac.me/results/19d37dd5-0dc9-4d49-9ae2-ecbe642bfa85/

SH256 hash:

d06c0b20a27d2adcf82fd87832990af27b06ad1f80156b1e914451530efe1b03

MD5 hash:

b467b14fff29778519c84555a821266c

SHA1 hash:

f855b953cee255476b19733ea12abd1989759579

Detections:

INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File

Alert

Create hunting rule

cn_utf8_windows_terminal

Alert

Create hunting rule

Link:

https://www.unpac.me/results/19d37dd5-0dc9-4d49-9ae2-ecbe642bfa85/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI iSpy Keylogger

Threat name:

iSpy Keylogger

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d06c0b20a27d2adcf82fd87832990af27b06ad1f80156b1e914451530efe1b03