dcrat | bf7e49d8147870246a28bd5aa0c199ce85a5cee6dc2984ad7a3197aed546f3e8

General

Target

bf7e49d8147870246a28bd5aa0c199ce85a5cee6dc2984ad7a3197aed546f3e8
Size

415KB
MD5

c5a1573d85b27c350e5f76b36c150fd3
SHA1

db0a99fe4163874184c4fef633ffb91ef262d14c
SHA256

bf7e49d8147870246a28bd5aa0c199ce85a5cee6dc2984ad7a3197aed546f3e8
SHA512

7041d384188b6269c36c567ab7adb023b08b37726be574db4d984c85080941bf746251a1315e06dcf629214cfb4ed55686a8c07c018a7364cdf33987a4316ad2
SSDEEP

6144:8/SR66cG+hD0IBEDzxM1o2AtwRY1nDH0Jm+oFJ3Tz3dBj3kapV2gTuGgTkXKFNf4:8FhboMOjt86nDUJmDzJOgTDtirRn+ldb

Score

10^/10

rat dcrat

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

resource	yara_rule
static1/unpack001/99e64babb02ebc1d5b30582b30d0fbe153cc33ebcc55dd382f9dce4abfe76ed0.exe	dcrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/99e64babb02ebc1d5b30582b30d0fbe153cc33ebcc55dd382f9dce4abfe76ed0.exe

bf7e49d8147870246a28bd5aa0c199ce85a5cee6dc2984ad7a3197aed546f3e8
.zip

Password: infected
99e64babb02ebc1d5b30582b30d0fbe153cc33ebcc55dd382f9dce4abfe76ed0.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 813KB - Virtual size: 812KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 536B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ