dcrat | 4c8b96177a7a90da10bc7557d87b95c8[.]exe | Triage

Sharing

General

Target

4c8b96177a7a90da10bc7557d87b95c8.exe
Size

965KB
MD5

4c8b96177a7a90da10bc7557d87b95c8
SHA1

c47e73204f36b3d317b8018d92801cd4fa1322ef
SHA256

93ef8a42cc1eb80c45aba9c680517c12f9e1f0b57bb3839eb152c235f2bae300
SHA512

77fe1d9934173042d9467646b7d562f9858ba7e0ecd0e8bdd7e638b012de574ce33b0798b7ac102fc3cc34434bbe433decb9bbd5adf07627efa71e9733abf1d4
SSDEEP

12288:2K5wpf3kJ7CZIgNw9DAlnZcUUNHuZdYD1cDN+jQ5x+lbbAKLCwzgMl+Vp:55wp/0CZwDAlnvPa1fjmKbbj+I0

Score

10^/10

rat dcrat

Malware Config

Signatures

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

resource	yara_rule
sample	dcrat

Dcrat family
dcrat

Files

4c8b96177a7a90da10bc7557d87b95c8.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 951KB - Virtual size: 950KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 924B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ