MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fd4d8a70a36460fb62abfbb47681b531b2b085456583e84918c2c3ab8603c6a7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DCRat


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fd4d8a70a36460fb62abfbb47681b531b2b085456583e84918c2c3ab8603c6a7
SHA3-384 hash: 3455fcb7de0e691d9289c4e8b7b0cd7e2e1ff655ccf36d4700a270d74fe83c18010d7f7077ccce95df02db240fae3082
SHA1 hash: 4c12a00fc3d5af49f555668643308e15bd583563
MD5 hash: 5386b04035633f75622920e5e8b8bf25
humanhash: black-william-maryland-green
File name:5386b04035633f75622920e5e8b8bf25
Download: download sample
Signature DCRat
Create hunting rule
File size:4'488'192 bytes
First seen:2021-10-03 10:05:04 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash d5d9d937853db8b666bd4b525813d7bd (40 x DCRat, 28 x njrat, 5 x RedLineStealer)
ssdeep 98304:+A9oWc1/CBfzprmBmBxyjDaff0wcKMIzbCtGgwmb:+A+/QqYxyjD1fKMIzbCtse
Threatray 132 similar samples on MalwareBazaar
TLSH T15126330CCAB08561CE64D8337A65F271C6BDBCE2D87D868B6DC1B6750B78125E0B3369
File icon (PE):PE icon
dhash icon d293839383939292 (1 x DCRat, 1 x LummaStealer)
Reporter zbetcheckin
Tags:32 DCRat exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
152
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
5386b04035633f75622920e5e8b8bf25
Verdict:
Malicious activity
Analysis date:
2021-10-03 10:08:30 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/a23fae4b-0626-4b11-bf15-35dd4434c4e4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/194335/
Detection(s):
Win.Trojan.Poison-8692
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a window
Searching for the window
Creating a file
Running batch commands
Creating a process with a hidden window
Creating a file in the Windows directory
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/615c2ed6e3d213d202b7738e/reports/48f54ce1-53c4-42c8-93c0-ad091fc97a6e/overview
Malware family:
KeyBase
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7c9a5622-d60e-49a3-a2b1-d73a74df0d9a
Result
Threat name:
DCRat
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/863391
Signature
Antivirus / Scanner detection for submitted sample
Creates an autostart registry key pointing to binary in C:\Windows
Creates multiple autostart registry keys
Creates processes via WMI
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected DCRat
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 495819 Sample: xEAcY3Uk3A Startdate: 03/10/2021 Architecture: WINDOWS Score: 88 78 Antivirus / Scanner detection for submitted sample 2->78 80 Multi AV Scanner detection for dropped file 2->80 82 Multi AV Scanner detection for submitted file 2->82 84 2 other signatures 2->84 11 xEAcY3Uk3A.exe 10 2->11         started        14 sihost.exe 2->14         started        17 CoVYFlaSsI.exe 3 2->17         started        19 2 other processes 2->19 process3 file4 66 C:\Users\user\AppData\Local\Temp\setup.exe, PE32 11->66 dropped 68 C:\Users\...\SkrinshoterSetup_v3.10.2.21.exe, PE32 11->68 dropped 21 setup.exe 3 6 11->21         started        24 SkrinshoterSetup_v3.10.2.21.exe 31 11->24         started        86 Multi AV Scanner detection for dropped file 14->86 signatures5 process6 file7 56 C:\...\IntoBrokerPerfMonitorReviewdriver.exe, PE32 21->56 dropped 26 wscript.exe 1 21->26         started        58 C:\Users\user\AppData\Local\...\nsResize.dll, PE32 24->58 dropped 60 C:\Users\user\AppData\...\downloader.exe, PE32 24->60 dropped 62 C:\Users\user\AppData\Local\Temp\...\UAC.dll, PE32 24->62 dropped 64 3 other files (none is malicious) 24->64 dropped 28 LauncherSRF.exe 24->28         started        process8 process9 30 cmd.exe 1 26->30         started        process10 32 IntoBrokerPerfMonitorReviewdriver.exe 8 21 30->32         started        36 conhost.exe 30->36         started        file11 48 C:\ProgramData\...\CoVYFlaSsI.exe, PE32 32->48 dropped 50 C:\PerfLogs\sihost.exe, PE32 32->50 dropped 52 C:\MSOCache\All Users\...\CoVYFlaSsI.exe, PE32 32->52 dropped 54 3 other files (none is malicious) 32->54 dropped 70 Multi AV Scanner detection for dropped file 32->70 72 Creates multiple autostart registry keys 32->72 74 Creates an autostart registry key pointing to binary in C:\Windows 32->74 76 Creates processes via WMI 32->76 38 cmd.exe 1 32->38         started        signatures12 process13 process14 40 w32tm.exe 1 38->40         started        42 conhost.exe 38->42         started        44 chcp.com 1 38->44         started        46 CoVYFlaSsI.exe 38->46         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fd4d8a70a36460fb62abfbb47681b531b2b085456583e84918c2c3ab8603c6a7/
Threat name:
Win32.Trojan.VBinder
Create hunting rule
Status:
Malicious
First seen:
2021-10-02 01:57:47 UTC
AV detection:
28 of 28 (100.00%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
0b976213f5961eb9720219d2624463ec6acc8947004710c7e9885746e2e27234
DCRat
49f8f8d74fc5f81ada3b288e56297334e35d07b0fc912f73aa9ba1b971639937
DCRat
4cced7c39444bc55a0cd79b0384b24517e355e0d70ab20019af96f2a7c181cd8
DCRat
65dee75f5d4f0d7e0c1065a689ebe79f67c87a4d3d9654193164128e859a0ddd
DCRat
6fd54cbf5a13356a0ecdd8b7ebda8cfee120e5a5ffc6efea36b096b273ac09b7
DCRat
d7fa1b64c4a5a79700791c113b5b2594a2194a8ca83bf18494337ef12d88fdb6
DCRat
f98183a2ad674f8aae6ad47e7da8b48c80175148ba333f0f57b3e6eca64bfaa6
DCRat
+ 122 additional samples on MalwareBazaar
Result
Malware family:
dcrat
Create hunting rule
Score:
  10/10
Tags:
family:dcrat infostealer persistence rat upx
Link:
https://tria.ge/reports/211003-l4hpasfcgq/
Behaviour
Creates scheduled task(s)
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Drops file in Windows directory
Drops file in System32 directory
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
UPX packed file
ACProtect 1.3x - 1.4x DLL software
DCRat Payload
DcRat
Process spawned unexpected child process
Unpacked files
SH256 hash:
418b3c26c374c3bcfb26df161905410c9ff4cd092cffd9421559e8e0ec447812
MD5 hash:
5686f2685cb7e4bb24eba81960719b53
SHA1 hash:
bdfe35ef0bfa7b318e29d60eab764090b05a7048
Link:
https://www.unpac.me/results/0c6a9e71-889c-49d5-8253-d614e8bac254/
SH256 hash:
f530069ef87a1c163c4fd63a3d5b053420ce3d7a98739c70211b4a99f90d6277
MD5 hash:
89351a0a6a89519c86c5531e20dab9ea
SHA1 hash:
9e801aaaae9e70d8f7fc52f6f12cedc55e4c8a00
Link:
https://www.unpac.me/results/0c6a9e71-889c-49d5-8253-d614e8bac254/
SH256 hash:
7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
MD5 hash:
bf712f32249029466fa86756f5546950
SHA1 hash:
75ac4dc4808ac148ddd78f6b89a51afbd4091c2e
Link:
https://www.unpac.me/results/0c6a9e71-889c-49d5-8253-d614e8bac254/
SH256 hash:
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
MD5 hash:
adb29e6b186daa765dc750128649b63d
SHA1 hash:
160cbdc4cb0ac2c142d361df138c537aa7e708c9
Link:
https://www.unpac.me/results/0c6a9e71-889c-49d5-8253-d614e8bac254/
Parent samples :
f5f3e5658f8ec6c1e7ffa7e7d6df06d04af1f3a5941206ce23b8be979c60ccb1
6e22c0f2732195063cb4984c6520c3b85e1236e967f8bb05b3c1b35139d2917b
713a497c8da97c2082758fd31147539f408a72b62041c6c9ed77037021621e94
dbde8a4bd71bb1fbc0511cdb657dfeffdaedc513aa425f856043532a7cba6fce
ac142a8087949b5ad4e3a503ca37609845112c4f7e0cd1376669c9d5c8f5cdf2
15d4dbafb6fb1770507db7769b2df6f3857da0ad3203a71c5f82a99688dac2b3
b96862087581adb9ecfb9615a46eedb29d13c606e708b7b532ce6ed3217925a4
4f2e6dc8e4d8e0dfcc44a28d34c10653bd833abb8832e47e609d255f246c67f0
df61dc2d24f2e475e0a8971c5d21c1c48e9505be67714aafb4afd670aad297e3
60b1aa37a4ac40d5c5adf2de28782976934731408b6c2e89511e1bc5947d5bbd
f7ae58f22cbdeb69318f6cb3ff3757a9888e8731febd66e85ee9938f874705c9
fbfe2108631e3ccaa8db2f5c4439009c7a5a53136481b422236eefe2e48b690f
340b93c76e6f489982a23d2e04df0ad05a03c3d744ecb5badc3c041eca945af2
34a5c9c0106b37687fbdd51a60a026d06e7301ec40b1f7fb49384d8fe748e9e6
503c9fae00b047a77059de8e9ff6dddb6d2584f18ccf6480d69d395c65492ad4
SH256 hash:
b7569e05cfe0da4b4dc9f4a16e72167bd17027e3769423ce5e816ffcdeca595b
MD5 hash:
b4f503419a3643ab93914422498b6073
SHA1 hash:
b0ed34feccb17a76420f86db610f4aad12bc6eb9
Link:
https://www.unpac.me/results/0c6a9e71-889c-49d5-8253-d614e8bac254/
SH256 hash:
f7d0a36d2f80e3034aa11258925dc93a0e623ed0ea2834e254d211af7aad5ee4
MD5 hash:
5d6030915e38c573ef67c0a03fb59cc1
SHA1 hash:
d144b106e07c4f501999aa3f316a3eeba9f67648
Link:
https://www.unpac.me/results/0c6a9e71-889c-49d5-8253-d614e8bac254/
Parent samples :
e0fa9c62364826149547d32728d06d155bdc6a54e90554695f8039bd7b73d036
54de552295e919218a7d43a1d0114bae169a79a1963113d615fd8bce428b385d
2774262a54ea6008d5b508f4d95eb811bd5d7dc50e1c0659d016ab33d966e729
aa7a05956ca47e164a10a94d0bdbe01123b84eb01fad5e581e1e72b10d93d5a9
26547389ff741eeba887fe39ec5f253d6597c03d1ffaf65c007ae5c40d897d5a
SH256 hash:
66e4732f64f15bd8d5c13dcba1bd533d12d759b41254ba0ed8d8b8ec2cc33135
MD5 hash:
d97b75d4f73f1ac378780cb64daa8d66
SHA1 hash:
5c430c9c63c1352af6f1b8b3f5270c9e3d53426b
Link:
https://www.unpac.me/results/0c6a9e71-889c-49d5-8253-d614e8bac254/
SH256 hash:
7e8c0ee189a620af5973762ad97757386326ee40414210db963cdf46e6d071d5
MD5 hash:
08d7191f707c341dd74b0a3dd277c5ea
SHA1 hash:
f841e172b6909789aebada20c35e7967a0a0612f
Link:
https://www.unpac.me/results/0c6a9e71-889c-49d5-8253-d614e8bac254/
SH256 hash:
b11ad1adfa96eacf5f18cf87785884947a6d35a1baebf4f20f16402b04d5109f
MD5 hash:
89bf0f7e9adf290c6d571eccf79206a9
SHA1 hash:
65f95791234ff93bc3e35f1d35d7a6664872dc56
Link:
https://www.unpac.me/results/0c6a9e71-889c-49d5-8253-d614e8bac254/
Parent samples :
d5775aecd2e8d149e2b9ba576ddc2db3624a974cafc8fc1df318226fc2c6d4b4
8e997bef9ad61722cb7b782da93b7373acd19dbdc4cb91b47e80280e2100b6a3
5ba1b028da2c0e52c38c7a55bf1e7952cc50c907576ec2f22b6a25d691dde2d6
be15d47389920ab9637eefc24bbf6c191607013a3d2608c1243a377aacb5d4ce
f027301d00c6bc4b1c87e5e3266775f395907fa04e2c768b7082381d60880f82
b1088573c2e783e97fb07ccf1d8d8e9372ccd8983cc07c7ee9c6989a3844b334
e5c9d1b6f77188c03e94713b41f00afc6d12e6f82daf3604d5f34c584c2389ff
45e1440acf3453915252d0d61ffcee6fd96170ccf2323c16178dfaaa186565f8
1a659b2d6922bd1ea186c53148094c26733368e9099ea037a83912c02a59d410
f733fbe95a7fe8a2c0ef459b05fed88b7a295de5e39c591bf62d3e0a5575e6fc
658b0a01404144b5da03574e2a05b6c02030baa2276b9e047174c6ccb3e8918d
cf4efad0b9d74151b09be4acfb12d1aea2a9e316b97a2eb7f4ca8ac12b0e6d8c
381bb149e04bec8f62336cdf3c81741c2c7a471f6dacc2f7835eb174643abad7
284f083103d1c160d9e4721ecce515646ce451a1b7ddf9dd89817904e21a4a2d
1a39cff5d5b0b550cd9b30f08c0e32430c2e1b92aecc663d4151789e54d13f64
1b881d8c3ba53e9b250de6d1118a27738fd8e88fd475e3e01afabd4e627f83a2
e0abb4fa147097a4fb1758ed20b7d1a54f020d0de2d8144a2beaec404acb4d4c
2ec983b4653f6a5ee028e9ecfa37d8cf2404a10e9691bb8ed39023be643ef55e
797bbd3d5e08ab4919540911ab6149be0c6f38de3659378bf38fc5ac01ccee48
4cc156f578777710f3ce0c217664b9830ddfcab407f0c6de0cae10d5501d1ca1
4d908524b238846077a6fb1df34be93ae926e13c15bb8ac5c45a8980ef4862ce
581a31b1ddaa6eea7b78a57b4615d8def8c688aeb0dd38da8a0ef3d248e88892
8ac5083f52da0ff312259331f65b326782803aa837a7b371a6d43a021b0c24c3
7816a1291d7c035b81b68f8e5f65e10f952beb2bf1ce9d125bfe9d44a378ee9f
e1a60229372db9d65dbadfe6db923edf3987ac9f908878491bd12497613324d8
41bd2718e24b2367c4a29a6eb94045d4ce1e29b4d6ca99d7d2d8b14e316e18f5
ab71530434f64e6aa105732c42dbb5a409ac0aae4258b3c3e7db1a7d5914cc30
3b88fdeb5144b0f3a710b42cefa937e57aed28001acb82562229472ce258a124
70fbebc77d5f37a0ffd373be6ee9f218a5ea30b86e395e7212b850f0f6934b6f
294003b3626890da222c7aeb34f7ac71cec614026c686fd88df269cc175a0e8c
a6ca0d0f6c47f310778e8d3a82f96ce6b6e70e1248a17f73fda6dff59653b761
9e90c1219aac375230e375f3d641f6b1edb2968acb41d542528ad744714c9b35
1d6628a6cd66f3dd7f3377ee1c30e8a92cedb1d40f5a121b84e5ab84a0e19909
841eb644979b3c640761762645c9cd26f9bb46e558eaeb7bf0c2a79e761878f4
1b304c8a2ae4546bd7958c7f22becaf6b682a5c88b7a01945a952de991b0ef0b
693cf45b243073eeb5479f4b29ff36c417b858b042363cf1a53d7623504a6d29
f9fd2f63fb1b73be1e960ab5a6572aa6968279e56a95bb846fa7ea4110ab867c
5680eb1ffa1fac4f1c5a78024331ff7dd8982138d89d2df4ec56996b44c9cc99
48be2502fad84657b383c41b2616f34a029f9a39d63aae1a1714faf7ba79e3da
SH256 hash:
f068b738e71868ec39137f6a432ac67f61cfc8d1d0100321d3c80526db5555f0
MD5 hash:
fdea279c3cdee7c508b88e18f17ac77c
SHA1 hash:
07b304223939bdecff42ac60dd83b05fd403ddd0
Link:
https://www.unpac.me/results/0c6a9e71-889c-49d5-8253-d614e8bac254/
SH256 hash:
f6daf5849308c9963a1156b47b86d90108c2b9f3e8812317fdcb10e3530b4d7f
MD5 hash:
bcf9de4ddc9ed723709588835badb358
SHA1 hash:
4c1e127e4fc3067d84a75f755aed7953688e6392
Link:
https://www.unpac.me/results/0c6a9e71-889c-49d5-8253-d614e8bac254/
SH256 hash:
fd4d8a70a36460fb62abfbb47681b531b2b085456583e84918c2c3ab8603c6a7
MD5 hash:
5386b04035633f75622920e5e8b8bf25
SHA1 hash:
4c12a00fc3d5af49f555668643308e15bd583563
Link:
https://www.unpac.me/results/0c6a9e71-889c-49d5-8253-d614e8bac254/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fd4d8a70a36460fb62abfbb47681b531b2b085456583e84918c2c3ab8603c6a7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DCRat

Executable exe fd4d8a70a36460fb62abfbb47681b531b2b085456583e84918c2c3ab8603c6a7

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/194335/
  
URLhaus
https://urlhaus.abuse.ch/url/1652620/

Comments


Avatar
zbet commented on 2021-10-03 10:05:06 UTC

url : hxxps://screenshoter.site/wp-content/uploads/screenshotersetap.exe