MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dbc947a5e1eb6a84e3224e6a1a05969c87cc596f86eae1078d4d9200efded647. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DCRat


Vendor detections: 12


Intelligence 12 IOCs 1 YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dbc947a5e1eb6a84e3224e6a1a05969c87cc596f86eae1078d4d9200efded647
SHA3-384 hash: 26d050fab1befac9cc9d1d821a51845c48831d88329d5f1e911b6fc5c3497b32afbef07e21149db91d89ecef8f0d5f37
SHA1 hash: 9535b4d7e73ef6d0ce705bda9379d8552eed41a1
MD5 hash: 1bd952b272a0ccf301e7f76a1201aab7
humanhash: berlin-virginia-winter-west
File name:1bd952b272a0ccf301e7f76a1201aab7.exe
Download: download sample
Signature DCRat
Create hunting rule
File size:704'000 bytes
First seen:2022-10-14 20:26:28 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 0343a73af53f0d71382f530981e07cd2 (4 x RedLineStealer, 1 x DCRat)
ssdeep 12288:ZU592inUZ3PMsqL5SUUC/rTw/mEiQRsPMKiA0xLogsHGu8BCYHU5A6c7hCEERlq:6T2inm3PMsqwKEi6yviA6sH237hWa
Threatray 3'797 similar samples on MalwareBazaar
TLSH T14DE4AF2535E18035D673343249A9F6B4697DA8390B224AEB63C41F7E5F345E17E3233A
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter abuse_ch
Tags:DCRat exe


Avatar
abuse_ch
DCRat C2:
http://webaitech.xyz/Jstemporary.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://webaitech.xyz/Jstemporary.php https://threatfox.abuse.ch/ioc/889683/

Intelligence

File Origin
# of uploads :
1
# of downloads :
319
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/320497/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Stealer.32450.31024.16194.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/43201/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
CheckCmdLine
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
bladabindi greyware redline
Link:
https://www.filescan.io/uploads/6349c617a67b0a5ed57a08ec/reports/e2f5a051-dbae-48b1-ba0c-f3ab8153f814/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d0b6f865-c2da-4e7b-9fdd-bffe6c165a0e
Result
Threat name:
DCRat, RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1091027
Signature
Allocates memory in foreign processes
Antivirus detection for dropped file
Creates processes via WMI
Downloads files with wrong headers with respect to MIME Content-Type
Drops PE files to the user root directory
Drops PE files with benign system names
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected DCRat
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 723637 Sample: ltnpzcCPoX.exe Startdate: 14/10/2022 Architecture: WINDOWS Score: 100 59 webaitech.xyz 2->59 67 Snort IDS alert for network traffic 2->67 69 Multi AV Scanner detection for domain / URL 2->69 71 Malicious sample detected (through community Yara rule) 2->71 73 11 other signatures 2->73 11 ltnpzcCPoX.exe 1 2->11         started        14 explorer.exe 2->14         started        16 schtasks.exe 2->16         started        18 12 other processes 2->18 signatures3 process4 signatures5 91 Writes to foreign memory regions 11->91 93 Allocates memory in foreign processes 11->93 95 Injects a PE file into a foreign processes 11->95 20 RegSvcs.exe 15 7 11->20         started        25 WerFault.exe 23 9 11->25         started        27 conhost.exe 11->27         started        97 Antivirus detection for dropped file 14->97 99 Multi AV Scanner detection for dropped file 14->99 101 Machine Learning detection for dropped file 14->101 process6 dnsIp7 61 apartzcaner.top 78.47.246.148, 37397, 49725 HETZNER-ASDE Germany 20->61 63 95.217.30.31, 49740, 80 HETZNER-ASDE Germany 20->63 65 192.168.2.1 unknown unknown 20->65 43 C:\Users\user\AppData\...\vc_redistx64.exe, PE32 20->43 dropped 75 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 20->75 77 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 20->77 79 Tries to harvest and steal browser information (history, passwords, etc) 20->79 81 Tries to steal Crypto Currency Wallets 20->81 29 vc_redistx64.exe 3 10 20->29         started        45 C:\ProgramData\Microsoft\...\Report.wer, Unicode 25->45 dropped file8 signatures9 process10 file11 55 C:\Users\user\AppData\Roaming\...\windhcp.exe, PE32 29->55 dropped 57 C:\Users\user\AppData\...\gkUPEZliA19zs.vbe, data 29->57 dropped 103 Antivirus detection for dropped file 29->103 105 Multi AV Scanner detection for dropped file 29->105 107 Machine Learning detection for dropped file 29->107 33 wscript.exe 1 29->33         started        signatures12 process13 process14 35 cmd.exe 1 33->35         started        process15 37 windhcp.exe 1 34 35->37         started        41 conhost.exe 35->41         started        file16 47 C:\Windows\Panther\UnattendGC\WmiPrvSE.exe, PE32 37->47 dropped 49 C:\Users\user\RuntimeBroker.exe, PE32 37->49 dropped 51 C:\Users\user\OneDrive\fontdrvhost.exe, PE32 37->51 dropped 53 12 other malicious files 37->53 dropped 83 Antivirus detection for dropped file 37->83 85 Multi AV Scanner detection for dropped file 37->85 87 Machine Learning detection for dropped file 37->87 89 3 other signatures 37->89 signatures17
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dbc947a5e1eb6a84e3224e6a1a05969c87cc596f86eae1078d4d9200efded647/
Threat name:
Win32.Trojan.Raccoon
Create hunting rule
Status:
Malicious
First seen:
2022-10-12 12:22:29 UTC
File Type:
PE (Exe)
AV detection:
20 of 26 (76.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3peupjpb5nvijyzcjzvbubmwtsd4ywlpq3vocb4njwjab3662zdq._file
Verdict:
malicious
Similar samples:
36ec3a4e758608a2d7a4a1b50a8dfd864dc2feea084df89ce8063c9ee18027ea
DCRat
4229f6a24d9d659d05cfd70c8446ddb45ce9c974620e3983a9d554fb916015a9
DCRat
a9106d039f5e4f3d00b53a7c4cbcb0f41bc1eb1dfdf6f4b82e71d30cc6c7a8e3
DCRat
ca9b5d2b0c5fc5b14e70069085adb67c499ea17bb2c981de59824d81ad85be9a
DCRat
d56a39deca5258feb3a5d7b7488103e9950adbf25435655cf32050b08986f606
DCRat
e6fb897a53f94207c141e97becd73ecbdf471d34759e4edbce4b57c7ae26659f
DCRat
ebf9be3e9df8a6a0bb0a6148d43a4e6a10013fe5286a43118bff5a6be0d997ec
DCRat
+ 3'787 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/221014-y8d8wseddp/
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/bb044730-7710-4c41-84b9-e5931c434291
Unpacked files
SH256 hash:
dbc947a5e1eb6a84e3224e6a1a05969c87cc596f86eae1078d4d9200efded647
MD5 hash:
1bd952b272a0ccf301e7f76a1201aab7
SHA1 hash:
9535b4d7e73ef6d0ce705bda9379d8552eed41a1
Link:
https://www.unpac.me/results/3c23a5e4-0f3a-4584-a82e-19201c2ba134/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/dbc947a5e1eb6a84e3224e6a1a05969c87cc596f86eae1078d4d9200efded647

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/320497/

Comments