dcrat | 01a0d97e3d9b352f9d909d5cf38efdb0[.]bin | Triage

Sharing

Copy URL Twitter E-mail

General

Target

01a0d97e3d9b352f9d909d5cf38efdb0.bin
Size

415KB
MD5

9b644c1a00d0480e8bcfb681748a9583
SHA1

8736f5a538f33a0100850a5a7ba4878ccc19d0f1
SHA256

a5ec7cec00ae3b6acba8bdc40b81447873096955e8cfde3eed196f388d68e3de
SHA512

90620f018a14bde14d36c9f1a990720042c2602010a012508c8390430e1589f688137f06ce45007993f75efb9dd3aa00990bf2cd22cfd23a0cb6fb079294e78a
SSDEEP

12288:BW6iyOP1ERxzjNjUR0/6b1uTeVDiLfVOq8h7A:BGAvNic6TpiLdz8NA

Score

10^/10

rat dcrat

Malware Config

Signatures

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

resource	yara_rule
static1/unpack001/73d391d8f9412be7a4a95bd2cfe6f49df7a6f439ae8d0e238ff9da210e5a63bc.exe	dcrat

Dcrat family
dcrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/73d391d8f9412be7a4a95bd2cfe6f49df7a6f439ae8d0e238ff9da210e5a63bc.exe

Files

01a0d97e3d9b352f9d909d5cf38efdb0.bin
.zip

Password: infected
73d391d8f9412be7a4a95bd2cfe6f49df7a6f439ae8d0e238ff9da210e5a63bc.exe
.exe windows:4 windows x86 arch:x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 813KB - Virtual size: 812KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 536B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ