🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e0d8f6ff6907a5520028d962ed0db8131e642de31b911926ae8df3b2f16c7384. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DCRat


Vendor detections: 17


Intelligence 17 IOCs 1 YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e0d8f6ff6907a5520028d962ed0db8131e642de31b911926ae8df3b2f16c7384
SHA3-384 hash: abe0725781489d2db58d9714715119e5c2e7abfa8ba09ce735a6c044daeda3a3313a29b8149b06c773bb57016ca62eb6
SHA1 hash: 7adf04850b41a0acc0f080c0fa0d36bed86760b2
MD5 hash: 2a1b0fe3a4e9dc6b1f6f51fe4f95dfe2
humanhash: oscar-table-alabama-arizona
File name:2a1b0fe3a4e9dc6b1f6f51fe4f95dfe2.exe
Download: download sample
Signature DCRat
Create hunting rule
File size:1'547'776 bytes
First seen:2024-09-26 18:55:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'272 x AgentTesla, 20'616 x Formbook, 12'394 x SnakeKeylogger)
ssdeep 24576:hQTn0P1dmAJMA+TCw7sULqPRhBmW8TAK6:6Tn0P1ddmA+l2p8
TLSH T1AD65B4282DFE502AF1B3AFB54BD47896D9AEF673370B944D1091038A4713B41DED263A
TrID 66.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.5% (.EXE) Win64 Executable (generic) (10523/12/4)
5.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.0% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
Reporter abuse_ch
Tags:DCRat exe


Avatar
abuse_ch
DCRat C2:
http://seroi.top/imageSecurelowlongpollapisqllocal.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://seroi.top/imageSecurelowlongpollapisqllocal.php https://threatfox.abuse.ch/ioc/1330163/

Intelligence

File Origin
# of uploads :
1
# of downloads :
467
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
dcrat
Create hunting rule
ID:
1
File name:
2a1b0fe3a4e9dc6b1f6f51fe4f95dfe2.exe
Verdict:
Malicious activity
Analysis date:
2024-09-26 18:57:38 UTC
Tags:
rat dcrat remote darkcrystal
Link:
https://app.any.run/tasks/c57a2a57-ed4a-4e68-81e6-6ad9bc48995f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
Win.Dropper.HawkEye-10027238-0
Create hunting rule

Win.Packed.Uztuby-10015486-0
Create hunting rule

Win.Packed.Uztuby-10017372-0
Create hunting rule

Win.Packed.Uztuby-10017373-0
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66f5ae4556c487103d52f85e
Tags:
Encryption Execution Generic Network Stealth Trojan Msil Phishing Autorun Gumen
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a file
Creating a file in the Program Files subdirectories
Using the Windows Management Instrumentation requests
Launching a process
Creating a file in the %temp% directory
Running batch commands
Creating a process with a hidden window
Creating a process from a recently created file
Loading a suspicious library
Sending a UDP request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process
Query of malicious DNS domain
Connection attempt to an infection source
Enabling autorun by creating a file
Enabling autorun
Sending an HTTP POST request to an infection source
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm cmd dcrat lolbin overlay
Link:
https://www.filescan.io/uploads/66f5ae4319fd255708d759c0/reports/8f3c26f1-fe1d-4e97-ba72-abcd79b23c7e/overview
Verdict:
Malicious
Labled as:
Trojan.MSIL.Basic.8
Link:
https://www.hybrid-analysis.com/sample/e0d8f6ff6907a5520028d962ed0db8131e642de31b911926ae8df3b2f16c7384
Malware family:
DCRat
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/60b87844-a457-4a80-acf9-f83e04d0d47d
Result
Threat name:
DCRat
Create hunting rule
Detection:
malicious
Classification:
spre.troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1519688
Signature
.NET source code contains potential unpacker
.NET source code contains very large strings
.NET source code references suspicious native API functions
AI detected suspicious sample
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Creates an undocumented autostart registry key
Creates multiple autostart registry keys
Creates processes via WMI
Found malware configuration
Infects executable files (exe, dll, sys, html)
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sample uses string decryption to hide its real strings
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: New RUN Key Pointing to Suspicious Folder
Suricata IDS alerts for network traffic
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected DCRat
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1519688 Sample: o2ymBtmuuW.exe Startdate: 26/09/2024 Architecture: WINDOWS Score: 100 74 seroi.top 2->74 78 Suricata IDS alerts for network traffic 2->78 80 Found malware configuration 2->80 82 Antivirus detection for URL or domain 2->82 84 15 other signatures 2->84 9 o2ymBtmuuW.exe 8 40 2->9         started        13 o2ymBtmuuW.exe 2->13         started        16 o2ymBtmuuW.exe 2->16         started        18 7 other processes 2->18 signatures3 process4 dnsIp5 56 C:\Users\user\Desktop\rRqqfPXN.log, PE32 9->56 dropped 58 C:\Users\user\Desktop\qdmhtBbP.log, PE32 9->58 dropped 68 20 other malicious files 9->68 dropped 92 Creates an undocumented autostart registry key 9->92 94 Creates multiple autostart registry keys 9->94 96 Uses schtasks.exe or at.exe to add and modify task schedules 9->96 98 Creates processes via WMI 9->98 20 cmd.exe 1 9->20         started        23 csc.exe 4 9->23         started        26 schtasks.exe 9->26         started        32 17 other processes 9->32 76 seroi.top 37.44.238.250, 49730, 49737, 49738 HARMONYHOSTING-ASFR France 13->76 60 C:\Users\user\Desktop\yfIhuTsp.log, PE32 13->60 dropped 62 C:\Users\user\Desktop\xpgheFLl.log, PE32 13->62 dropped 64 C:\Users\user\Desktop\vVmguANo.log, PE32 13->64 dropped 70 10 other malicious files 13->70 dropped 28 cmd.exe 13->28         started        66 C:\Users\user\Desktop\yyRZBxEh.log, PE32 16->66 dropped 72 12 other malicious files 16->72 dropped 30 cmd.exe 16->30         started        100 Multi AV Scanner detection for dropped file 18->100 file6 signatures7 process8 file9 86 Uses ping.exe to sleep 20->86 88 Uses ping.exe to check the status of other devices and networks 20->88 34 conhost.exe 20->34         started        36 chcp.com 20->36         started        38 PING.EXE 20->38         started        40 Idle.exe 20->40         started        54 C:\Windows\...\SecurityHealthSystray.exe, PE32 23->54 dropped 90 Infects executable files (exe, dll, sys, html) 23->90 42 conhost.exe 23->42         started        44 cvtres.exe 1 23->44         started        46 chcp.com 28->46         started        48 3 other processes 28->48 50 2 other processes 30->50 signatures10 process11 process12 52 Conhost.exe 46->52         started       
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/e0d8f6ff6907a5520028d962ed0db8131e642de31b911926ae8df3b2f16c7384
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e0d8f6ff6907a5520028d962ed0db8131e642de31b911926ae8df3b2f16c7384/
Threat name:
ByteCode-MSIL.Trojan.DCRat
Create hunting rule
Status:
Malicious
First seen:
2024-02-23 13:08:47 UTC
File Type:
PE (.Net Exe)
AV detection:
21 of 24 (87.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4dmpn73ja6sveabi3fro2dnycmpgilpddoirsjvorxz3f4lmooca._file
Verdict:
malicious
Label(s):
dcrat
Create hunting rule
Result
Malware family:
dcrat
Create hunting rule
Score:
  10/10
Tags:
family:dcrat discovery infostealer persistence rat
Link:
https://tria.ge/reports/240926-xlbzksseqk/
Behaviour
Modifies registry class
Runs ping.exe
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Enumerates physical storage devices
System Network Configuration Discovery: Internet Connection Discovery
Drops file in Program Files directory
Drops file in Windows directory
Drops file in System32 directory
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
DCRat payload
DcRat
Modifies WinLogon for persistence
Process spawned unexpected child process
Verdict:
Malicious
Tags:
rat dcrat
YARA:
MAL_EXE_DCRat_Jul_08_2
Link:
https://app.threat.zone/submission/a11b8ee4-0420-49cd-be03-8632e5643dac
Unpacked files
SH256 hash:
23992300bbc6bb0101e95720a5e6562e7870c30f48785cd1ce0e739253ef0c8f
MD5 hash:
b11c5e2268c765b610b2e10180664ae1
SHA1 hash:
15bfecbb0106c9d7bb82f8182df1a84c688ee6ba
Link:
https://www.unpac.me/results/24f3785f-ba62-4a62-a2f6-88332c2c0564/
SH256 hash:
e0d8f6ff6907a5520028d962ed0db8131e642de31b911926ae8df3b2f16c7384
MD5 hash:
2a1b0fe3a4e9dc6b1f6f51fe4f95dfe2
SHA1 hash:
7adf04850b41a0acc0f080c0fa0d36bed86760b2
Detections:
cn_utf8_windows_terminal
Create hunting rule
Link:
https://www.unpac.me/results/24f3785f-ba62-4a62-a2f6-88332c2c0564/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e0d8f6ff6907a5520028d962ed0db8131e642de31b911926ae8df3b2f16c7384

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DCRat
Create hunting rule
Author:Nikolaos 'n0t' Totosis
Description:DCRat Payload
Rule name:INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File
Create hunting rule
Author:ditekSHen
Description:Detects executables containing bas64 encoded gzip files
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments