MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d63df0dc7adde3502da5628dba18a1cc7305a09a1c99280230ea4a6c3a436704. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DCRat


Vendor detections: 11


Intelligence 11 IOCs 1 YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d63df0dc7adde3502da5628dba18a1cc7305a09a1c99280230ea4a6c3a436704
SHA3-384 hash: 8d274616564606e8a5070b9e46ae0e16cfc60a42772a1560518c7066975032bdec2011635a9ca5c579285d3e664d0357
SHA1 hash: 8f08123c6c259e3218ebb4fcbe7906fc1a01860a
MD5 hash: fc76aaa7e72c89044d6a227f5d63a66d
humanhash: stairway-oscar-twenty-undress
File name:D63DF0DC7ADDE3502DA5628DBA18A1CC7305A09A1C992.exe
Download: download sample
Signature DCRat
Create hunting rule
File size:1'098'896 bytes
First seen:2022-07-18 13:30:38 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash fcf1390e9ce472c7270447fc5c61a0c1 (864 x DCRat, 118 x NanoCore, 94 x njrat)
ssdeep 24576:U2G/nvxW3Ww0tDi9537KoZnZm+ac1ngU0zaei:UbA3029xNnZm+V9v
Threatray 3'461 similar samples on MalwareBazaar
TLSH T191355A027A54CE52D0A90673C4EFD11843BCBD422A26C75F7A8A339D95223E65F4E6CF
TrID 91.0% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39)
3.6% (.EXE) Win64 Executable (generic) (10523/12/4)
1.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
1.5% (.EXE) Win32 Executable (generic) (4505/5/1)
0.6% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 9494b494d4aeaeac (832 x DCRat, 172 x RedLineStealer, 134 x CryptOne)
Reporter abuse_ch
Tags:DCRat exe


Avatar
abuse_ch
DCRat C2:
http://a0642085.xsph.ru/dlecentral.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://a0642085.xsph.ru/dlecentral.php https://threatfox.abuse.ch/ioc/838529/

Intelligence

File Origin
# of uploads :
1
# of downloads :
260
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/291580/
Detection(s):
Win.Trojan.Uztuby-9855059-0
Create hunting rule

Win.Ransomware.Clinix-9868408-0
Create hunting rule

Win.Packed.Uztuby-9937390-0
Create hunting rule

Win.Packed.Basic-9952747-0
Create hunting rule

SecuriteInfo.com.Trojan.Rasftuby.Gen.14.10239.27368.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file
Creating a process from a recently created file
Running batch commands
Creating a process with a hidden window
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Launching a process
Creating a file in the system32 subdirectories
Creating a file in the Program Files subdirectories
DNS request
Connecting to a non-recommended domain
Sending an HTTP GET request
Unauthorized injection to a recently created process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun by creating a file
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/26630/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
bladabindi greyware makop overlay packed packed setupapi.dll shdocvw.dll shell32.dll
Link:
https://www.filescan.io/uploads/62d5611fb55643c0386e705d/reports/184d3a90-e8b9-4a5c-bdad-a8d61fd5c283/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2f3ce711-504c-4a46-bba7-96e665e1a735
Result
Threat name:
DCRat
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1035768
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Creates an autostart registry key pointing to binary in C:\Windows
Creates multiple autostart registry keys
Creates processes via WMI
Drops executables to the windows directory (C:\Windows) and starts them
Drops PE files with benign system names
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected DCRat
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 668261 Sample: D63DF0DC7ADDE3502DA5628DBA1... Startdate: 18/07/2022 Architecture: WINDOWS Score: 100 52 a0642085.xsph.ru 2->52 56 Antivirus detection for dropped file 2->56 58 Antivirus / Scanner detection for submitted sample 2->58 60 Multi AV Scanner detection for dropped file 2->60 62 6 other signatures 2->62 11 D63DF0DC7ADDE3502DA5628DBA18A1CC7305A09A1C992.exe 3 6 2->11         started        14 ctfmon.exe 2 2->14         started        17 WmiPrvSE.exe 2 2->17         started        19 10 other processes 2->19 signatures3 process4 dnsIp5 48 C:\perfcrtmonitor\perfcrtmonitorperfcrt.exe, PE32 11->48 dropped 50 C:\perfcrtmonitor\SRdZt44uSYkiEbXgnKi.vbe, data 11->50 dropped 22 wscript.exe 1 11->22         started        72 Antivirus detection for dropped file 14->72 74 Multi AV Scanner detection for dropped file 14->74 76 Machine Learning detection for dropped file 14->76 54 a0642085.xsph.ru 141.8.197.42, 49807, 49809, 49847 SPRINTHOSTRU Russian Federation 19->54 file6 signatures7 process8 process9 24 cmd.exe 1 22->24         started        process10 26 perfcrtmonitorperfcrt.exe 9 23 24->26         started        30 conhost.exe 24->30         started        file11 40 C:\Windows\System32\shutdownext\spoolsv.exe, PE32 26->40 dropped 42 C:\Windows\System32\netplwiz\UsoClient.exe, PE32 26->42 dropped 44 C:\Windows\...\backgroundTaskHost.exe, PE32 26->44 dropped 46 3 other malicious files 26->46 dropped 64 Antivirus detection for dropped file 26->64 66 Machine Learning detection for dropped file 26->66 68 Creates multiple autostart registry keys 26->68 70 3 other signatures 26->70 32 cmd.exe 1 26->32         started        signatures12 process13 process14 34 conhost.exe 32->34         started        36 w32tm.exe 32->36         started        38 perfcrtmonitorperfcrt.exe 32->38         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d63df0dc7adde3502da5628dba18a1cc7305a09a1c99280230ea4a6c3a436704/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-03-13 20:21:49 UTC
File Type:
PE (Exe)
Extracted files:
21
AV detection:
20 of 26 (76.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2y67bxd23xrvalnfmkg3ugfbzrzqlie2dsmsqarq5jfgyosdm4ca._file
Verdict:
malicious
Similar samples:
1934ca02e1627b6127c65310ffe6be91e216d53bfa4b90d0fe5ec4912c17e4cd
DCRat
7dcf51a85a732f83474f19d96b405266668a9db0ed6a2e5617e1d74566940f63
DCRat
8e16230a9d5336fb1d6c6278b45e3b653aa2f6cd060742f28cd68d6a5117a396
DCRat
c57da7f8b745fb0111c9180c739623fcc4002f183b2ed78d1e2f370a5a765625
DCRat
f4cd9d90c5f772963664e07973d5374984dc92381cd5ad1752037df71aab6185
DCRat
fa8fefc2d3e69a1809f4ef2ca8e0a418d3553cac12d8c468338b1cef67c4f731
DCRat
+ 3'451 additional samples on MalwareBazaar
Result
Malware family:
dcrat
Create hunting rule
Score:
  10/10
Tags:
family:dcrat infostealer persistence rat suricata
Link:
https://tria.ge/reports/220718-qsc2wschg5/
Behaviour
Creates scheduled task(s)
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Drops file in Windows directory
Drops file in System32 directory
Adds Run key to start application
Checks computer location settings
Loads dropped DLL
Executes dropped EXE
DcRat
Process spawned unexpected child process
suricata: ET MALWARE DCRAT Activity (GET)
Unpacked files
SH256 hash:
2f5bd4242b44722e28ae3a39b62733eb661645eba91df19b4ef12aa6e6558b1a
MD5 hash:
e7e676e65cf0e7a9a9ed644b152eadf4
SHA1 hash:
a1d8a5fa28bb6190d8f0bccebd65d1abe2b473db
Link:
https://www.unpac.me/results/bb4358fd-d1cd-4bfe-b35e-a2e887a0608a/
SH256 hash:
d63df0dc7adde3502da5628dba18a1cc7305a09a1c99280230ea4a6c3a436704
MD5 hash:
fc76aaa7e72c89044d6a227f5d63a66d
SHA1 hash:
8f08123c6c259e3218ebb4fcbe7906fc1a01860a
Link:
https://www.unpac.me/results/bb4358fd-d1cd-4bfe-b35e-a2e887a0608a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d63df0dc7adde3502da5628dba18a1cc7305a09a1c99280230ea4a6c3a436704

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:sfx_pdb
Create hunting rule
Author:@razvialex
Description:Detect interesting files containing sfx with pdb paths.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/291580/

Comments