dcrat | c8a258553fa26f0582454b493322e37d05d1a7b811b4c9d831682000d0588490 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c8a258553fa26f0582454b493322e37d05d1a7b811b4c9d831682000d0588490
Size

1.2MB
MD5

c70bb10f0f42d00b71c2ddff04d69d62
SHA1

9ab3f8c632efe2fd81ca0740e9fccc8bb715599b
SHA256

c8a258553fa26f0582454b493322e37d05d1a7b811b4c9d831682000d0588490
SHA512

c84e7b91647cb8188965bdc7ec0ef2c8fea746d63015a749aeb04a1b81c8267ae3e14b2996729679f82fb8dbd9fdb387fb4789e421ea993bd89f21e830e5903e
SSDEEP

24576:linPXeVB3y6h9Q7T3UlJkbuIkpcJwOUP49sV:ry6XxkbnEP1

Score

10^/10

rat dcrat

Malware Config

Signatures

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

resource	yara_rule
sample	dcrat

Dcrat family
dcrat

Files

c8a258553fa26f0582454b493322e37d05d1a7b811b4c9d831682000d0588490
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 908B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ