dcrat | ad25c07c65ad5115577db24f1a7c2a62[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ad25c07c65ad5115577db24f1a7c2a62.exe
Size

3.8MB
MD5

ad25c07c65ad5115577db24f1a7c2a62
SHA1

c3d8352a8518b3449b7783ecbc2a2bd39ddd1c9a
SHA256

1d48431be1f611837e73da503863ad7d1f2aba779c238cd9a22099c7907f6101
SHA512

470e435ba8a2fbcecfa8f9197a1fa50d44c050ec22b6446b96d294959a354586979895eab5ec5a29c3d9bdc692a6b132df7dc57fdbb39b97bc064064dd983eab
SSDEEP

98304:V7b3a0t2TiPhx6Sp+ybfnDA4qo34n1oO:VH3Z8cp+gDZ4n1

Score

10^/10

rat dcrat

Malware Config

Signatures

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

resource	yara_rule
sample	dcrat

Dcrat family
dcrat

Files

ad25c07c65ad5115577db24f1a7c2a62.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 3.7MB - Virtual size: 3.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ