MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dba74d8a8f16ef2438c3d2a9ba7ce4ff8a6da3f7ce7cb779842de8b7010b54c2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

DarkCoreRAT

Vendor detections: 10

Intelligence 10 IOCs YARA 33 File information Comments

SHA256 hash:	dba74d8a8f16ef2438c3d2a9ba7ce4ff8a6da3f7ce7cb779842de8b7010b54c2
SHA3-384 hash:	d63a9ff19d9f5b858904b9a1a896197322ad85e81730e027db5f1ffe29c0cd9737e9d8d1394a17ce2c3b44946fccf28d
SHA1 hash:	f7b9b1c319582eccd6c356ef49f69b59ac1e26e8
MD5 hash:	fe923d5ee3eecf0f67a8f89fa15a99dc
humanhash:	utah-high-south-jig
File name:	kayrat.bin
Download:	download sample
Signature	DarkCoreRAT Create hunting rule
File size:	5'619'226 bytes
First seen:	2026-11-01 11:33:34 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
ssdeep	98304:bRIJOtevQngzlysowjQ+IIoNOdFDa2PQorFts7M:bRIJOHnJwjK9NODrrFL
TLSH	T19F46E11173E84169F5F3AFB599760210E7BABC477A38C28F029495AD1E33BC09A75732
TrID	43.0% (.EXE) UPX compressed Win64 Executable (70117/5/12) 25.5% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9) 16.6% (.EXE) UPX compressed Win32 Executable (27066/9/6) 4.0% (.EXE) Win64 Executable (generic) (6522/11/2) 3.0% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika	pebin
dhash icon	c1c0ccde9c8cf039 (1 x DarkCoreRAT)
Reporter	abuse_ch
Tags:	bin DarkCoreRAT exe

Intelligence

File Origin

# of uploads :

# of downloads :

160

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

Obfuscar

Details

Link:

https://research.acce.ciphertechsolutions.com/results/adb7c1df-3d28-46e0-a352-d5ad9c118370/

Malware family:

n/a

ID:

File name:

exe

Verdict:

No threats detected

Analysis date:

2026-11-01 11:42:36 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/742e5b62-af13-47d1-95f9-58675169ea08

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/96525/

Detection(s):

SecuriteInfo.com.Win64.MalwareX-gen.53747477.UNOFFICIAL

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ae723c8b175ade21dcee48f

Tags:

vmdetect

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a file

Creating synchronization primitives

Creating a window

Sending a custom TCP request

Gathering data

Verdict:

Malicious

Labled as:

Win/malicious_confidence_60%

Link:

https://www.hybrid-analysis.com/sample/dba74d8a8f16ef2438c3d2a9ba7ce4ff8a6da3f7ce7cb779842de8b7010b54c2

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-10-02T11:12:00Z UTC

Last seen:

2026-10-10T19:11:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/dba74d8a8f16ef2438c3d2a9ba7ce4ff8a6da3f7ce7cb779842de8b7010b54c2/results?tab=lookup

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/496c0025-a15f-41a9-a9a0-2943949d1f70

Result

Threat name:

DarkCore RAT

Detection:

malicious

Classification:

troj.evad.mine

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/1996088

Signature

.NET source code contains very large array initializations

Found strings related to Crypto-Mining

Joe Sandbox ML detected suspicious sample

Multi AV Scanner detection for submitted file

Yara detected DarkCore RAT

Behaviour

Behavior Graph:

Download SVG

Score:

Verdict:

Benign

File Type:

Link:

https://malprob.io/report/dba74d8a8f16ef2438c3d2a9ba7ce4ff8a6da3f7ce7cb779842de8b7010b54c2

Verdict:

inconclusive

YARA:

10 match(es)

Tags:

.Net Executable Managed .NET Obfuscated PDB Path PE (Portable Executable) PE File Layout SOS: 0.25 SOS: 0.35 SOS: 0.40 T1027 T1059.007 Win 64 Exe x64

Link:

https://app.malva.re/file/fe923d5ee3eecf0f67a8f89fa15a99dc

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/dba74d8a8f16ef2438c3d2a9ba7ce4ff8a6da3f7ce7cb779842de8b7010b54c2/

Threat name:

Win64.Trojan.Sonbokli

Status:

Malicious

First seen:

2026-10-02 15:50:19 UTC

File Type:

PE+ (.Net Exe)

Extracted files:

AV detection:

26 of 36 (72.22%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3otu3cupc3xsiogd2ku3u7he76fg3i7xzz6lo6mefxuloailktba._file

Result

Malware family:

n/a

Score:

7/10

Tags:

defense_evasion discovery trojan

Link:

https://tria.ge/reports/261101-npme2sb12j/

Behaviour

Checks SCSI registry key(s)

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of WriteProcessMemory

Drops file in Program Files directory

Drops file in Windows directory

Checks whether UAC is enabled

Network Share Discovery

Loads dropped DLL

Unpacked files

SH256 hash:

dba74d8a8f16ef2438c3d2a9ba7ce4ff8a6da3f7ce7cb779842de8b7010b54c2

MD5 hash:

fe923d5ee3eecf0f67a8f89fa15a99dc

SHA1 hash:

f7b9b1c319582eccd6c356ef49f69b59ac1e26e8

Detections:

win_isfb_a5

cn_utf8_windows_terminal

Suspicious_PowerShell_WebDownload_1

Link:

https://www.unpac.me/results/71d38ee0-d6bd-426c-8feb-f76d9edda1b0/

SH256 hash:

d60e6e94245078cb56e44ebd5f360dc04bf18e460136be93bfc4cfca43b98505

MD5 hash:

e336cd4cc1f67e3f57ead4e72a24c93b

SHA1 hash:

c03565235315e597786b287b52e00f27bf0de806

Link:

https://www.unpac.me/results/71d38ee0-d6bd-426c-8feb-f76d9edda1b0/

SH256 hash:

67900f5b4d6d1b61a934f5111cd6987e5043dfa4957fcce5a277949b16ee47b1

MD5 hash:

dea70359c432def510bbba2eda3d1bec

SHA1 hash:

34822a2bac16614625fc58f62cf2160cef2e5e6e

Detections:

cn_utf8_windows_terminal

Suspicious_PowerShell_WebDownload_1

Link:

https://www.unpac.me/results/71d38ee0-d6bd-426c-8feb-f76d9edda1b0/

SH256 hash:

7b7cf6cab158b5b0a572e33b9707f10b1b4c2f444ccb40f7f4a3bb38cc270bd0

MD5 hash:

cb1a648a66a2e78a0322aca4c2fb599a

SHA1 hash:

5dd52d105ae3084e775da5b7aa9f4c63f80d3684

Link:

https://www.unpac.me/results/71d38ee0-d6bd-426c-8feb-f76d9edda1b0/

SH256 hash:

6a9e6856f23c463783c3afb0ca5d78f56324c86657162ccb16d5227b3233b32a

MD5 hash:

f1a15a22fe0874e4bb2e8f05dfd62f57

SHA1 hash:

aa06e407c7b4241ae559aee616ef156540a76a12

Link:

https://www.unpac.me/results/71d38ee0-d6bd-426c-8feb-f76d9edda1b0/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/dba74d8a8f16ef2438c3d2a9ba7ce4ff8a6da3f7ce7cb779842de8b7010b54c2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	command_and_control Create hunting rule
Author:	CD_R0M_
Description:	This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	exploit_any_poppopret Create hunting rule
Author:	Jeff White [karttoon@gmail.com] @noottrak
Description:	Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	Lumma_Stealer_Detection Create hunting rule
Author:	ashizZz
Description:	Detects a specific Lumma Stealer malware sample using unique strings and behaviors
Reference:	https://seanthegeek.net/posts/compromized-store-spread-lumma-stealer-using-fake-captcha/

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	MULTI_Malware_RemcosRAT_ForgeAuto_4785f0c3 Create hunting rule
Author:	Marjoriefort
Description:	Detects RemcosRAT (inconnu, etat binaire)

Rule name:	MULTI_Malware_Unknown_ForgeAuto_4ca5a35d Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (inconnu, etat binaire)

Rule name:	MULTI_Malware_Unknown_ForgeAuto_caef9d5a_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (inconnu, etat extrait)

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETDLLMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	Suspicious_Process Create hunting rule
Author:	Security Research Team
Description:	Suspicious process creation

Rule name:	Sus_All_Windows_PE_Malware Create hunting rule
Author:	DiegoAnalytics
Description:	Detects Windows PE malware of all types, avoids non-executables like .html

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	test_Malaysia Create hunting rule
Author:	rectifyq
Description:	Detects file containing malaysia string

Rule name:	UPX Create hunting rule
Author:	kevoreilly
Description:	UPX Unpacker: dump on OEP (original entry point)

Rule name:	vmdetect Create hunting rule
Author:	nex
Description:	Possibly employs anti-virtualization techniques

Rule name:	WHIRLPOOL_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for WhirlPool constants

Rule name:	WIN_Malware_Unknown_ForgeAuto_2ffc3572 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_3ee43008 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_43faefd2 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_4fa7e284_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat extrait)

Rule name:	WIN_Malware_Unknown_ForgeAuto_5001c94c Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_6717780a_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat extrait)

Rule name:	WIN_Malware_Unknown_ForgeAuto_74566f98 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_79234c04 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_7e8e91c4 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_92a28498 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_f1079127 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_XWorm_ForgeAuto_6b06c990_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects XWorm (pe, etat extrait)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DarkCoreRAT

exe dba74d8a8f16ef2438c3d2a9ba7ce4ff8a6da3f7ce7cb779842de8b7010b54c2

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/4049574/

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/96525/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample