MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d860e3c6d73e49c3b4851235cd64cdc98bbd87e6fb1b6fb13a981b3c405a9f50. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DCRat


Vendor detections: 12


Intelligence 12 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d860e3c6d73e49c3b4851235cd64cdc98bbd87e6fb1b6fb13a981b3c405a9f50
SHA3-384 hash: 5f1e704d27db348d4aa325446926bd380366789a5e2d53d897536378fe23ffafc18f1afeedbbb2f498edb52a02576219
SHA1 hash: b6b24524a296f2e6d39ed23ee185b61b04654e2b
MD5 hash: 613a66305ca8993bae644c4ab53fe78a
humanhash: zebra-robin-jersey-friend
File name:613A66305CA8993BAE644C4AB53FE78A.exe
Download: download sample
Signature DCRat
Create hunting rule
File size:2'699'035 bytes
First seen:2024-02-07 23:35:18 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash fcf1390e9ce472c7270447fc5c61a0c1 (871 x DCRat, 118 x NanoCore, 94 x njrat)
ssdeep 49152:HbA3XQOcIAn9opz8/8ZQll78CgpQraAvsUjfUd4Ke:HbjMAihqAI7b/aQsUbD
Threatray 230 similar samples on MalwareBazaar
TLSH T108C5D0013E44CD91F0181677C2EF53144BB4A9416BA6E72BB9AA337D96123D37C1EACB
TrID 76.0% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39)
16.5% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
3.0% (.EXE) Win64 Executable (generic) (10523/12/4)
1.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
1.2% (.EXE) Win32 Executable (generic) (4504/4/1)
File icon (PE):PE icon
dhash icon 29ab6a696949cdcd (1 x DCRat)
Reporter abuse_ch
Tags:DCRat exe


Avatar
abuse_ch
DCRat C2:
http://f0915140.xsph.ru/L1nc0In.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
593
Origin country :
NL NL
Vendor Threat Intelligence
Detection:
DCRat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/475245/
Detection(s):
SecuriteInfo.com.VBS.Encrypted.Gen.UNOFFICIAL
Create hunting rule

Win.Trojan.Uztuby-9855059-0
Create hunting rule

Win.Ransomware.Clinix-9868408-0
Create hunting rule

Win.Packed.Msilmamut-9950860-0
Create hunting rule

Win.Packed.Basic-9952747-0
Create hunting rule

Win.Packed.Uztuby-9963900-0
Create hunting rule

Win.Packed.Uztuby-9969968-0
Create hunting rule

Win.Malware.Uztuby-9972880-0
Create hunting rule

Win.Trojan.DarkKomet-9976180-0
Create hunting rule

Win.Trojan.Uztuby-10010740-0
Create hunting rule

SecuriteInfo.com.Trojan.Rasftuby.Gen.14.10239.27368.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm cmd cscript dcrat explorer fingerprint installer lolbin overlay packed packed prometheus schtasks setupapi sfx shdocvw shell32 stealer
Link:
https://www.filescan.io/uploads/65c413e4db7c120da4e73a67/reports/f90f6cf3-4a27-4a3a-ac12-0b560f535115/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/d860e3c6d73e49c3b4851235cd64cdc98bbd87e6fb1b6fb13a981b3c405a9f50
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7df8689a-f7c1-4616-ac96-f74bf43ecbc5
Result
Threat name:
DCRat
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1388720
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Creates processes via WMI
Drops executable to a common third party application directory
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Sigma detected: Execution from Suspicious Folder
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: Rare Remote Thread Creation By Uncommon Source Image
Sigma detected: Schedule system process
Sigma detected: System File Execution Location Anomaly
Snort IDS alert for network traffic
Uses schtasks.exe or at.exe to add and modify task schedules
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Yara detected DCRat
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1388720 Sample: z5bRv2IfU5.exe Startdate: 08/02/2024 Architecture: WINDOWS Score: 100 61 f0915140.xsph.ru 2->61 65 Snort IDS alert for network traffic 2->65 67 Found malware configuration 2->67 69 Antivirus detection for dropped file 2->69 71 12 other signatures 2->71 11 z5bRv2IfU5.exe 3 7 2->11         started        15 lsEnUzPwxnCKPWwONdaru.exe 2->15         started        18 lsEnUzPwxnCKPWwONdaru.exe 3 2->18         started        20 2 other processes 2->20 signatures3 process4 dnsIp5 49 C:\...\providerPerfNet.exe, PE32 11->49 dropped 51 C:\...\ATGn9DG55lWgoRHV8ktl.vbe, data 11->51 dropped 75 Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines) 11->75 22 wscript.exe 1 11->22         started        25 wscript.exe 11->25         started        63 f0915140.xsph.ru 141.8.192.151, 49729, 49730, 49731 SPRINTHOSTRU Russian Federation 15->63 77 Multi AV Scanner detection for dropped file 15->77 file6 signatures7 process8 signatures9 73 Windows Scripting host queries suspicious COM object (likely to drop second stage) 22->73 27 cmd.exe 1 22->27         started        process10 process11 29 providerPerfNet.exe 3 16 27->29         started        33 conhost.exe 27->33         started        file12 53 C:\...\lsEnUzPwxnCKPWwONdaru.exe, PE32 29->53 dropped 55 C:\Users\...\lsEnUzPwxnCKPWwONdaru.exe, PE32 29->55 dropped 57 C:\Recovery\lsEnUzPwxnCKPWwONdaru.exe, PE32 29->57 dropped 59 3 other malicious files 29->59 dropped 79 Antivirus detection for dropped file 29->79 81 Multi AV Scanner detection for dropped file 29->81 83 Machine Learning detection for dropped file 29->83 85 3 other signatures 29->85 35 cmd.exe 29->35         started        37 schtasks.exe 29->37         started        39 schtasks.exe 29->39         started        41 13 other processes 29->41 signatures13 process14 process15 43 conhost.exe 35->43         started        45 w32tm.exe 35->45         started        47 lsEnUzPwxnCKPWwONdaru.exe 35->47         started       
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/d860e3c6d73e49c3b4851235cd64cdc98bbd87e6fb1b6fb13a981b3c405a9f50
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d860e3c6d73e49c3b4851235cd64cdc98bbd87e6fb1b6fb13a981b3c405a9f50/
Threat name:
ByteCode-MSIL.Backdoor.DCRat
Create hunting rule
Status:
Malicious
First seen:
2024-02-02 20:33:53 UTC
File Type:
PE (Exe)
Extracted files:
11
AV detection:
23 of 24 (95.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3bqohrwxhze4hnefci242zgnzgf33b7g7mnw7mj2tantyqc2t5ia._file
Verdict:
malicious
Similar samples:
1e1a63dc013e9571d1430993d08eb080e5f97339e107efcfdb39bae9aef8ce54
DCRat
3dd0a5685e10ef6d63758cafee7c651f8ae80a47664158976ace7b80c825a032
DCRat
4faac7b368c5b46e3a5cc10300e9be5ad85463c29a8d38025c8ec386ed06a9de
DCRat
7fed6406da8c6fac0504f899f2d88cf18c82b40d10d28e0651d851aa8113a13b
DCRat
b61b1c4320db7f1ac101de2b059636b51896c2b2fae336febd59b62a2947a7fd
DCRat
+ 220 additional samples on MalwareBazaar
Result
Malware family:
dcrat
Create hunting rule
Score:
  10/10
Tags:
family:dcrat infostealer rat
Link:
https://tria.ge/reports/240207-3lj8vadbal/
Behaviour
Creates scheduled task(s)
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Enumerates physical storage devices
Drops file in Program Files directory
Drops file in Windows directory
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
DCRat payload
DcRat
Process spawned unexpected child process
Unpacked files
SH256 hash:
afc110b177dd0eb576db6b12e6e7a5c1335829cc9ff4688c4c28102212ced808
MD5 hash:
c3a48339c83e0c996e1b98039c8e458d
SHA1 hash:
458fedf27a50b49cb151438e3326b8838a1bf331
Link:
https://www.unpac.me/results/d55a1593-cf25-49ec-9d67-1824c3c1641e/
SH256 hash:
d860e3c6d73e49c3b4851235cd64cdc98bbd87e6fb1b6fb13a981b3c405a9f50
MD5 hash:
613a66305ca8993bae644c4ab53fe78a
SHA1 hash:
b6b24524a296f2e6d39ed23ee185b61b04654e2b
Link:
https://www.unpac.me/results/d55a1593-cf25-49ec-9d67-1824c3c1641e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d860e3c6d73e49c3b4851235cd64cdc98bbd87e6fb1b6fb13a981b3c405a9f50

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SelfExtractingRAR
Create hunting rule
Author:Xavier Mertens
Description:Detects an SFX archive with automatic script execution
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/475245/

Comments