dcrat | 0b0ec65382f89a78a0fe6e8806692b3c[.]exe | Triage

Sharing

General

Target

0b0ec65382f89a78a0fe6e8806692b3c.exe
Size

1.4MB
MD5

0b0ec65382f89a78a0fe6e8806692b3c
SHA1

c53d487fe509f97d8f25565afa6b93a7ddc5a32d
SHA256

025f59dd06ad2bd27f44923788303977c9c35274632bd4a0068a4d2d01faec5f
SHA512

7672df5a954cc1be0d507d9e87af0301d70f031ce083b0bb145ba5f45b4de3c5478c27b8f34e8c304e556728e81389c5cde30242f2bb40b3eff7ddbadb0c9c92
SSDEEP

24576:DnTvNh6VDOAxsd05hhdshr0SafxxyiDSvGzNlZhlUmbhL:DLNh6ViAxsqr6r0hfqY/lb2

Score

10^/10

rat dcrat

Malware Config

Signatures

DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
rat

Processes:

resource yara_rule

sample dcrat
Dcrat family
dcrat

Files

0b0ec65382f89a78a0fe6e8806692b3c.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 876B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ