dcrat | 01262df075c88a30f2bba3422272bc74[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

01262df075c88a30f2bba3422272bc74.exe
Size

849KB
MD5

01262df075c88a30f2bba3422272bc74
SHA1

5f42b5ab2a7fd757b6a8fe3bbf1a811244fd7152
SHA256

40866d690c97baf594a3ddb844cb75decc7e5e604c17546bdf17090743a4f2ae
SHA512

05e120fba9499f203f22d83fc8045dc67ba9704dd8f04c8c2a9d79feeb9e16358275d1ca88b21efbc0f9ceb16673e629f8a051d27972d76a1a464cf8437b47ab
SSDEEP

12288:Q6NE5ig5Fttrh5PxjUm5SvDdLILaBFkjKuAMx6A5gtbGk84Ca04jtiPBgGKYTx:Q6N297PxbsKtC5AHgk

Score

10^/10

rat dcrat

Malware Config

Signatures

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

resource	yara_rule
sample	dcrat

Dcrat family
dcrat

Files

01262df075c88a30f2bba3422272bc74.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 847KB - Virtual size: 846KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 924B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ