dcrat | 125ef93b1d3162aede8c49768d1c9007[.]bin | Triage

Sharing

General

Target

125ef93b1d3162aede8c49768d1c9007.bin
Size

415KB
MD5

5d1016e92807a0396206e9ba9483728b
SHA1

8401738fe5b09145aad5c970d15a0f0f0706597b
SHA256

d6f4814f6bf4d7cbe9cc70904df3e9ca02c189576883f35eb6e19ab193508e32
SHA512

cc8beab05e418fd15cfd581133e538e92e00c96e4c2e10492fa65081b02a78c4b9e0c64cebb1b22f246fb387a8b81b6a935341db5dd4b365d9ec0bfc18538942
SSDEEP

12288:S+SYlpBLNx19l4ngoz7MdopamzPdq0EVEd:AYl3pr9MgmMupbzo0EVEd

Score

10^/10

rat dcrat

Malware Config

Signatures

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

resource	yara_rule
static1/unpack001/5de166439e50ddf65e251538313e9dc29eab58929e6735d70385615f7fcf4f70.exe	dcrat

Dcrat family
dcrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/5de166439e50ddf65e251538313e9dc29eab58929e6735d70385615f7fcf4f70.exe

Files

125ef93b1d3162aede8c49768d1c9007.bin
.zip

Password: infected
5de166439e50ddf65e251538313e9dc29eab58929e6735d70385615f7fcf4f70.exe
.exe windows:4 windows x86 arch:x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 813KB - Virtual size: 813KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 536B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ