dcrat | e95e7d38c2b506f6fef47cb48748f000[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e95e7d38c2b506f6fef47cb48748f000.exe
Size

1.4MB
MD5

e95e7d38c2b506f6fef47cb48748f000
SHA1

27a5dcb44079fb5aed75e34361c0db0729a66e53
SHA256

d4b1b7e1c45a5d779e1627b201e82e01733a63f0986be148a6fc81f9450a3daa
SHA512

4cb7efa2fe6b07d5fc45a6f6112344c397bca491844950ff51483ce99190df5ff2285de43de2b021c7aed72f236441c0524375acffd868390a990cb277a42512
SSDEEP

24576:mCes05m6gfJPeh4+0jwQZUKfkAU+Zqv60ajMo6ZzqHtLp9qfuiZ0eBWwhNvc:mCXkFYehQVovxif6ZKVsfGKnhF

Score

10^/10

rat dcrat

Malware Config

Signatures

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

resource	yara_rule
sample	dcrat

Dcrat family
dcrat

Files

e95e7d38c2b506f6fef47cb48748f000.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 796B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ