Behavioral task
behavioral1
Sample
3915927862667dcfed03c9f5cd6b9af7ff6840bcc4226b06404320f9e2212229.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
3915927862667dcfed03c9f5cd6b9af7ff6840bcc4226b06404320f9e2212229.exe
Resource
win10v2004-20240412-en
General
-
Target
3915927862667dcfed03c9f5cd6b9af7ff6840bcc4226b06404320f9e2212229
-
Size
1.2MB
-
MD5
1e1141a8c3483801e0520a803d004dfc
-
SHA1
4dd65bf996f2ab466e658208cc6d36b9bd63df7f
-
SHA256
3915927862667dcfed03c9f5cd6b9af7ff6840bcc4226b06404320f9e2212229
-
SHA512
cc1aa00306b66af19f3fe2e32c730d928da6e5f80b78c7131ef5936d9984d5a60190ec4a061446b77d797a44a7b9a5f034e64b1c39fb5bd52c8060ec1a24c562
-
SSDEEP
24576:FR28aergLxCcjZGKCKFuTBHNWdd2HAxWnUDTJ/yS3Rh:rJaDKf4p4UD1v
Malware Config
Signatures
-
Processes:
resource yara_rule sample dcrat -
Dcrat family
-
Detects executables containing bas64 encoded gzip files 1 IoCs
Processes:
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 3915927862667dcfed03c9f5cd6b9af7ff6840bcc4226b06404320f9e2212229
Files
-
3915927862667dcfed03c9f5cd6b9af7ff6840bcc4226b06404320f9e2212229.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 868B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ