dcrat | 77ffbcba22bcdbd8df644193be949eba[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

77ffbcba22bcdbd8df644193be949eba.exe
Size

1.1MB
MD5

77ffbcba22bcdbd8df644193be949eba
SHA1

a9c14e0c4fcac5d0293659972621dbdf5bb6ed2b
SHA256

6026cc6696e186fecda886a02020df3a0fd831b990c3f5386efe35cb427e095c
SHA512

9509d030bb6786f57ddf34840bcf987fb89e68f80407690b587e07fb0246c83f03400c6ae29ba2fa4bb2135110013354d857dfc6b9aed8df23ceae5227a6bdd2
SSDEEP

24576:K2Yn0rHtuW7/nhCEqQayuigl0Ujs20TwTcd0Rq:s8tuW7N6/1g0R

Score

10^/10

rat dcrat

Malware Config

Signatures

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

resource	yara_rule
sample	dcrat

Dcrat family
dcrat

Files

77ffbcba22bcdbd8df644193be949eba.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 796B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ