dtrack | bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364[.]exe

General

Target
bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364.exe
Size 820KB
Sample260217-jqs7rscs8a
SHA256 bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364
MD5 4f8091a5513659b2980cb53578d3f798
SHA1 60f925ca7f6d2ea77fd58b14d6259c4256fba899
SHA512 ad99a6e51e4bb68856f7ae2d85eee777ba55fd93808805df8991535bbc72ebe28a3f20557ca234aa76702608fa2539c02011b3f17b4b571fd1b06970a42b0fe5
SSDEEP 24576:4AzX0QVt4LjwctL0fn7J7eKj6a5VCxoq:bRccw47J7Fj99q
TLSH
T1CE051901E660D039F69301FBC7B681B8AE24AF30134554DFA2D879E59B368E63D3752B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat apt lazarus dtrack

Malware Config

Signatures

Detects Dtrack RAT 1 IoCs

Dtrack aka Preft TroyRAT is RAT developed by Lazarus group written in C++.T

rat apt lazarus

resource	yara_rule
sample	family_dtrack

Dtrack family
dtrack

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364.exe

File Explorer

bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364.exe

.exe 820KB

bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364.exe

IMPHASH 75171549224b4292974d6ee3cf397db8
SHA256 bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364
MD5 4f8091a5513659b2980cb53578d3f798
SHA1 60f925ca7f6d2ea77fd58b14d6259c4256fba899
SHA512 ad99a6e51e4bb68856f7ae2d85eee777ba55fd93808805df8991535bbc72ebe28a3f20557ca234aa76702608fa2539c02011b3f17b4b571fd1b06970a42b0fe5
SSDEEP 24576:4AzX0QVt4LjwctL0fn7J7eKj6a5VCxoq:bRccw47J7Fj99q
TLSH
T1CE051901E660D039F69301FBC7B681B8AE24AF30134554DFA2D879E59B368E63D3752B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects Dtrack RAT

Dtrack aka Preft TroyRAT is RAT developed by Lazarus group written in C++.T

rat apt lazarus
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

609715

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

lstrcmpA FindFirstFileA CopyFileA FindClose FindNextFileA GetVersionExA GetTempPathA DeleteFileA lstrcpyA GetDriveTypeA GetVolumeInformationA Sleep GetComputerNameA GetLocalTime WaitForSingleObject GetCurrentThread GetEnvironmentVariableA CreateDirectoryA RemoveDirectoryA SetFileAttributesA FreeLibrary GetCurrentProcess GetStdHandle GetFullPathNameW GetFullPathNameA HeapReAlloc CreateFileA GetFileSize CreateMutexW HeapCompact SetFilePointer TryEnterCriticalSection MapViewOfFile UnmapViewOfFile SetEndOfFile HeapAlloc SystemTimeToFileTime QueryPerformanceCounter HeapFree InterlockedCompareExchange UnlockFile FlushViewOfFile LockFile WaitForSingleObjectEx LoadLibraryA GetTickCount UnlockFileEx GetProcessHeap GetSystemTimeAsFileTime FormatMessageA WriteFile InitializeCriticalSection WideCharToMultiByte LoadLibraryW FormatMessageW GetVersionExW HeapDestroy LeaveCriticalSection GetFileAttributesA HeapCreate HeapValidate GetFileAttributesW ReadFile CreateFileW MultiByteToWideChar FlushFileBuffers GetTempPathW GetLastError HeapSize LockFileEx EnterCriticalSection GetDiskFreeSpaceW CreateFileMappingA CreateFileMappingW GetDiskFreeSpaceA GetSystemInfo GetFileAttributesExW DeleteCriticalSection GetCurrentThreadId OutputDebugStringA CloseHandle DeleteFileW GetCurrentProcessId LocalFree GetSystemTime AreFileApisANSI FileTimeToSystemTime GetFileInformationByHandle SetEnvironmentVariableA CompareStringW CompareStringA OutputDebugStringW GetProcAddress GetModuleHandleW ExitProcess ExitThread CreateThread GetCommandLineA GetStartupInfoA TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlUnwind SetHandleCount GetFileType VirtualFree VirtualAlloc GetModuleFileNameA GetConsoleCP GetConsoleMode TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement InitializeCriticalSectionAndSpinCount GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringA LCMapStringW SetStdHandle GetTimeZoneInformation RaiseException FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW WriteConsoleA GetConsoleOutputCP WriteConsoleW GetLocaleInfoA GetStringTypeA GetStringTypeW GetModuleHandleA

shlwapi

PathFileExistsA PathAppendA

iphlpapi

GetAdaptersInfo

Sharing