dcrat | 8d1eb69334dee45138506e742158c35ed890071fa66d038c0142c54ba18af032

General

Target

8d1eb69334dee45138506e742158c35ed890071fa66d038c0142c54ba18af032
Size

415KB
MD5

cf8a5517df56ee4003a71823e3059f38
SHA1

0d49e04c51a2a0bf0639cdfcf6835edee35cd0a5
SHA256

8d1eb69334dee45138506e742158c35ed890071fa66d038c0142c54ba18af032
SHA512

202d964f78c200e9c41c46d3da264b4fcbce60446919750782299e23e699cd2e4fcbb20d05f5b52d337d16b35745ffcfa3ce678a6bc4472248dc5e00335f70ba
SSDEEP

12288:fHlXTiu2sqTO87dLBcoFTaGyQg2dG9HwEOK9/xhL:fJTXTuH7dtZgig2ds0KZxt

Score

10^/10

rat dcrat

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

resource	yara_rule
static1/unpack001/3b7b020f8ce69d4b810468c03b4bfd1cc6e56080c7b754cafebfd4ba500c7855.exe	dcrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/3b7b020f8ce69d4b810468c03b4bfd1cc6e56080c7b754cafebfd4ba500c7855.exe

8d1eb69334dee45138506e742158c35ed890071fa66d038c0142c54ba18af032
.zip

Password: infected
3b7b020f8ce69d4b810468c03b4bfd1cc6e56080c7b754cafebfd4ba500c7855.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 813KB - Virtual size: 812KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 536B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ