dcrat | 1f6449bf99adac6a283e016227a1b6b5[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1f6449bf99adac6a283e016227a1b6b5.exe
Size

915KB
MD5

1f6449bf99adac6a283e016227a1b6b5
SHA1

b2142e82d2822b7f40adc1fc57e676dd07d41654
SHA256

46c1b480004cbfe8b389b97546d69f41c344f2c52e3ea86a766a5cca1cb97024
SHA512

ea527bb5bd78892fbb60ce84a9f58afb2f151c27f14a038247ecaddbbe073467d720561110d70568a98e68499f763fa876b9bcd694e5bb60b0e2b0ba89fca7fe
SSDEEP

24576:2fee0xoE3Ivkutg+7x3ME9hkLERMkVLZ:2GegmCGKWVL

Score

10^/10

rat dcrat

Malware Config

Signatures

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

resource	yara_rule
sample	dcrat

Dcrat family
dcrat

Files

1f6449bf99adac6a283e016227a1b6b5.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 901KB - Virtual size: 900KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 988B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ