dcrat | 61fb2f0a769a75bca6edfd58557d04eef089bc5ab8a1e61465e44f35c204a109 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

61fb2f0a769a75bca6edfd58557d04eef089bc5ab8a1e61465e44f35c204a109
Size

3.2MB
MD5

cd014e4627b8aba4c578071e8033553c
SHA1

c8473ca15ff9428b7449e4a68314b306bfc3eda7
SHA256

61fb2f0a769a75bca6edfd58557d04eef089bc5ab8a1e61465e44f35c204a109
SHA512

7031e97d9721d2dc53f7a3c9a5a1b1cb36a84a0133cc36b8ae0ece9979518b67b15e510a49955ba79090977a34da6caee24289ca62e9bb9c2447d42c0f4b59f0
SSDEEP

49152:HC0Fl8v/911bwaEYpdYUVsk3DZGAy55kBsfJGAW6KyWUcPmWQpE:HC0Fl8v/qXYrv5tG9uKJGAWl5N

Score

10^/10

rat dcrat

Malware Config

Signatures

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

resource	yara_rule
sample	dcrat

Dcrat family
dcrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
61fb2f0a769a75bca6edfd58557d04eef089bc5ab8a1e61465e44f35c204a109

Files

61fb2f0a769a75bca6edfd58557d04eef089bc5ab8a1e61465e44f35c204a109
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 980B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ