dcrat | 30fb1e6f54d2d81cd464b46419bf35ef[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

30fb1e6f54d2d81cd464b46419bf35ef.exe
Size

1.2MB
MD5

30fb1e6f54d2d81cd464b46419bf35ef
SHA1

9934996cb195555caef91b39255167f9064601b3
SHA256

667774c9b0aa4bfeb3932e3702636520e50dbf291252614a30bd9d2be0dd0b70
SHA512

5ab7e6db122be392b1352d22a0a78a8a52677f9f51d5d3c792a55b02eafe3c8190f401c7b0cfd32f45cfb98fd000e84b48ed1043789ab6e4743c2a1e4e30a36a
SSDEEP

24576:vDlrXK5PNnTnjuOqfrOB9lKB2go1CAA0aN09OTFjQt+kPcT:7cbn+O/8B2vCAuN09OTGt

Score

10^/10

rat dcrat

Malware Config

Signatures

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

resource	yara_rule
sample	dcrat

Dcrat family
dcrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
30fb1e6f54d2d81cd464b46419bf35ef.exe

Files

30fb1e6f54d2d81cd464b46419bf35ef.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 536B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ