dcrat | 2aeec7ffda2b40e4f4824c5721a8c60db0b32823485324523650f2637b6001bf | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2aeec7ffda2b40e4f4824c5721a8c60db0b32823485324523650f2637b6001bf
Size

1.9MB
MD5

5aa5cb5ce24b691631921f6da269d1b0
SHA1

887c371fd46d71ca6c921c113ced77684275d3f0
SHA256

2aeec7ffda2b40e4f4824c5721a8c60db0b32823485324523650f2637b6001bf
SHA512

20e7300336be53c752424ee54656710f82007ef7b4611ad3134cbc41b196e29476f547e3e9dfe49b71e2d7d5d737ede42d3c4f1a205fbcbea4e6dfe5834f231b
SSDEEP

49152:wThlm4eTvCt9GWXsQDrnokrvLbg2H/4HCO/:ClzooGWXs8ouv3df4H

Score

10^/10

rat dcrat

Malware Config

Signatures

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

resource	yara_rule
sample	dcrat

Dcrat family
dcrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2aeec7ffda2b40e4f4824c5721a8c60db0b32823485324523650f2637b6001bf

Files

2aeec7ffda2b40e4f4824c5721a8c60db0b32823485324523650f2637b6001bf
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 968B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ