dcrat | 27e28c0509f0685673ae9435e44f163f[.]bin | Triage

Sharing

Copy URL Twitter E-mail

General

Target

27e28c0509f0685673ae9435e44f163f.bin
Size

459KB
MD5

80ec8f63251d808b65ac41dce9fc7259
SHA1

bd0f8bd8a546a4e812f31219c7a0ef21cad75165
SHA256

b85f573d4bc8a1731f577363be7bf2326d5e6d691a668b1f8b9e80c4502b2a2a
SHA512

4a760a17162c1619108e87326c3b700eb18248c37dcf8828f64c9cc6c18b8bb048c1ec511bb27e19bcf40c587f67b8272f4042b8128b2eee3f0da0213dbe005d
SSDEEP

12288:NmXsLjDXAI0YBn6p7tD8coApGpKehKEiD4lHL+NnFowjWBUM8m:0iDXAIR6/zfeh5b9wFoV+M8m

Score

10^/10

rat dcrat

Malware Config

Signatures

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

resource	yara_rule
static1/unpack001/122f5fbdf16a82a90c358ec2e39933e8a5ef43d76cb4fd63ae68863023ecfa01.exe	dcrat

Dcrat family
dcrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/122f5fbdf16a82a90c358ec2e39933e8a5ef43d76cb4fd63ae68863023ecfa01.exe

Files

27e28c0509f0685673ae9435e44f163f.bin
.zip

Password: infected
122f5fbdf16a82a90c358ec2e39933e8a5ef43d76cb4fd63ae68863023ecfa01.exe
.exe windows x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 906KB - Virtual size: 905KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 544B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ