Behavioral task
behavioral1
Sample
ac0fc303f893f17ebe04ea11090b5c6787357a3a6f4d4d2e12fe14e84f10b340.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
ac0fc303f893f17ebe04ea11090b5c6787357a3a6f4d4d2e12fe14e84f10b340.exe
Resource
win10v2004-20230915-en
General
-
Target
40c500a3b5442fa218bdcde8a69936ae.bin
-
Size
364KB
-
MD5
331ab3dbce2bc28f2d05910690650cc3
-
SHA1
215870271ba9488a5494e6848d6cf6544e43fe54
-
SHA256
69dd09f6848a73013ec90c4de13923fff3fb4aecddc847e0ab8d93609360de4e
-
SHA512
3d460e44a58e7356dd1231433211937eec722ab4804b516031879b119b4a9432c2cb6308cc5d402925039f52fb44e481760c38ceb8098d9b5d213a5d97edd8c6
-
SSDEEP
6144:eSuqH+dVDSv/hwkbVjp3fz4ZsllLcrPoKBM5toJCdffk6pjM0mec0R5Vf/GyWV9Q:eSd0VDl8FHlGPoqM5tUk8EJ5J2kS4
Malware Config
Signatures
-
resource yara_rule static1/unpack001/ac0fc303f893f17ebe04ea11090b5c6787357a3a6f4d4d2e12fe14e84f10b340.exe dcrat -
Dcrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/ac0fc303f893f17ebe04ea11090b5c6787357a3a6f4d4d2e12fe14e84f10b340.exe
Files
-
40c500a3b5442fa218bdcde8a69936ae.bin.zip
Password: infected
-
ac0fc303f893f17ebe04ea11090b5c6787357a3a6f4d4d2e12fe14e84f10b340.exe.exe windows:4 windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 796KB - Virtual size: 795KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 796B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ