dcrat | 03ba818acec1c6a76a40f5a33d69790d[.]bin

General

Target
03ba818acec1c6a76a40f5a33d69790d.bin
Size 416KB
Sample240108-bdqbcahdeq
SHA256 3867000e89023844b663b4ab47b32c2cb75e0e7ee73f93856955cbfe385bf23b
MD5 115bda2264fd7d75e0b5be9c8404b9c1
SHA1 11b25adace2d940020bde4bf0600e898b51a25a3
SHA512 f92a5dcfda37193101eba0b9ff60f370f7556e2375c0a8a1f4404b996b67508583a2f193067b546362eb41195c53d9f4d79cada7a9e31b4cbe3f60d015528974
SSDEEP 12288:v3lQ7xp+hflkSTlM2Ht5kt3DbT6WVrTKaWTyJUAsv:/m7xp+h9M4t5UfT62tWyUAsv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat dcrat

Malware Config

Signatures

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
static1/unpack001/2fcb6730a335fe6f41ba9d12579bdadbdc9655290132da53a4864f475a55dee9.exe	dcrat

Dcrat family
dcrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/2fcb6730a335fe6f41ba9d12579bdadbdc9655290132da53a4864f475a55dee9.exe

File Explorer

03ba818acec1c6a76a40f5a33d69790d.bin

.zip 416KB
2fcb6730a335fe6f41ba9d12579bdadbdc9655290132da53a4864f475a55dee9.exe

.exe 828KB

03ba818acec1c6a76a40f5a33d69790d.bin

SHA256 3867000e89023844b663b4ab47b32c2cb75e0e7ee73f93856955cbfe385bf23b
MD5 115bda2264fd7d75e0b5be9c8404b9c1
SHA1 11b25adace2d940020bde4bf0600e898b51a25a3
SHA512 f92a5dcfda37193101eba0b9ff60f370f7556e2375c0a8a1f4404b996b67508583a2f193067b546362eb41195c53d9f4d79cada7a9e31b4cbe3f60d015528974
SSDEEP 12288:v3lQ7xp+hflkSTlM2Ht5kt3DbT6WVrTKaWTyJUAsv:/m7xp+h9M4t5UfT62tWyUAsv
MD5 SHA1 SHA512 SSDEEP

Password

infected

2fcb6730a335fe6f41ba9d12579bdadbdc9655290132da53a4864f475a55dee9.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 2fcb6730a335fe6f41ba9d12579bdadbdc9655290132da53a4864f475a55dee9
MD5 03ba818acec1c6a76a40f5a33d69790d
SHA1 363a8cf4982e58ee0725d983eda2fc5cd803039f
SHA512 733f630bbcb8e1410415e0f19b8e2b027839cefa1fd0306d2f8ff2d141503b651fa738dea43849ac52b3df6dbcf7bcbd9fafa167576e58e370cdcf3ad500a0ec
SSDEEP 12288:FShWS/H5U/WcjmHEGjcKdmZmXAO6Eo2aigheINqM+bCPn0DcL:FShdvtcjmLmZmQOrdghRsbUnfL
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

DCRat payload

Detects payload of DCRat, commonly dropped by NSIS installers.

rat
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

4

Entry point

840990

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

03ba818acec1c6a76a40f5a33d69790d.bin

2fcb6730a335fe6f41ba9d12579bdadbdc9655290132da53a4864f475a55dee9.exe

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

03ba818acec1c6a76a40f5a33d69790d.bin

2fcb6730a335fe6f41ba9d12579bdadbdc9655290132da53a4864f475a55dee9.exe

mscoree

dotnet