dcrat | 2462e26144fa12fd2ca9dce4d2c13420[.]exe | Triage

Sharing

General

Target

2462e26144fa12fd2ca9dce4d2c13420.exe
Size

1002KB
MD5

2462e26144fa12fd2ca9dce4d2c13420
SHA1

39151c10b343122006aaa172f1f1554a38137528
SHA256

6fe3e7b8886862e6c2e9ea8684396da80e57ca2c1f85026e7edc0ae6cef80c35
SHA512

d9dc3df7635afd99e49f2851443ab274063badbfb3382eab4fdf373c5a5aede7d3755f009000bc6dd3a6318bf158e8c4bd00999cb1a09cfbb5239b513ea858ca
SSDEEP

24576:IxBKgJkikTpvNX6Uc3GawHa/Z2twSbIAflddj6T:IiXLv8UAw6/oPEudj6

Score

10^/10

rat dcrat

Malware Config

Signatures

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

resource	yara_rule
sample	dcrat

Dcrat family
dcrat

Files

2462e26144fa12fd2ca9dce4d2c13420.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 987KB - Virtual size: 987KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 796B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ