General

  • Target
    dcrat (1).rar
  • Size 43.4MB
  • Sample240527-v2fllacf56
  • SHA256 8bc4d422624113b2af547b64fa7df842b821f189ca4d7bad6e75767fec4a9e59
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
upx

Malware Config

Signatures

  • Patched UPX-packed file 1 IoCs

    Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unsigned PE 97 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • dcrat (1).rar
    .rar 43.4MB
  • 123.bat
    66B
  • DCRat.exe
    .exe 72KB
  • data/7zxa.dll
    .dll 155KB
  • data/DCRAC.exe
    .exe 26KB
  • data/DCRCC.exe
    .exe 24KB
  • data/Default.SFX
    .exe 309KB
  • data/NCC2.dll
    .dll 13KB
  • data/NCC3.dll
    .dll 72KB
  • data/NCCheck.dll
    .dll 162KB
  • data/Rar.exe
    .exe 578KB
  • data/RarExt.dll
    .dll 481KB
  • data/RarExt64.dll
    .dll 554KB
  • data/WinCon.SFX
    .exe 275KB
  • data/Zip.SFX
    .exe 263KB
  • data/dnlib.dll
    .dll 1.1MB
  • data/dotNET_Reactor.Console.exe
    .exe 14KB
  • data/dotNET_Reactor.exe
    .exe 5.9MB
  • data/enc.vbe
    .vbe .jse 692B
  • data/kll.temp
    1KB
  • data/upx.exe
    .exe 402KB
  • data/wRar.exe
    .exe 2.4MB
  • design/ActiveWindowNotifierCommand.json
    1KB
  • design/BlockInput.json
    1022B
  • design/ClipboardLoggerControl.json
    899B
  • design/ClipperTableAddon.json
    187B
  • design/CrashLoggerDesign.json
    638B
  • design/CryptoStealerTableAddon.json
    1KB
  • design/DeleteAll_legacy.json
    505B
  • design/FakeSteamWindowsControl.json
    2KB
  • design/FileGrabberTableAddon.json
    285B
  • design/FileSearcherControl.json
    1KB
  • design/HostsEditorCommands.json
    1KB
  • design/PerformanceCounterDesign.json
    1KB
  • design/PluginsLoader_legacy.json
    1KB
  • design/ProcessKillerCommand.json
    1KB
  • design/RegEditorControl.json
    7KB
  • design/RunOncePanel.json
    519B
  • design/UserPingCounterTableAddon.json
    183B
  • install.php
    27KB
  • lib/IIIllllIlIlllIlIIIIlllIlIlIlllllIIIlIIllllIIIlIllIIlIIllllIIllllllIIlIIIIIIlllIIIlIllllllIIllIlIllIlllIllIlIIIIIIIIllllI.jar
    .jar 2.3MB
  • lib/IIIllllIlIlllIlIIIIlllIlIlIlllllIIIlIIllllIIIlIllIIlIIllllIIllllllIIlIIIIIIlllIIIlIllllllIIllIlIllIlllIllIlIIIIIIIIllllIIilIl.jar
    .jar 5.5MB
  • lib/IIlIlIllIIlIIllIIllIIlIIIllIlIlIlIIIIlIlIllIIlIIllIIIIIllIIIIlIIIlIIlIIlIIlIllIIlllIIIllIIIlIIlIllllIllIIIIlIIIlIllllllI.jar
    .jar 464KB
  • lib/IlIIlIllllIIIIIlIlllIllIlIlIIIIIlIIIlIlIlllIIllIllIIIIIIlIIlllIIIlIIIlllIIIlllllIlIlIlllllIIlIllIIlIIlIIlIIIlllllllIlIII.jar
    .jar 19KB
  • lib/IlIlIIIIIIIlIlllllllIllIIlIIllIllllIIIlIIIlIlIIlIIlIIlIllIlllIlIlIIllIIlIIIIIIIlIIIIIIIIIlIlllIIllIlIIlIIIlIlIlllIIIIIIl.jar
    .jar 250KB
  • lib/IlIllIIllllllllIlIIlllllIIIIllIIIlIIlllIIllIIllllIIllIlIIIlIIIIlIIIIIlllllllIllIIlIlIllIIlIlIlIIllIlIllIIIlIIIIlIllIIIIl.jar
    .jar 688KB
  • lib/IllIIIIllIlIIIIlIlIllIIlIIllIIlIllIIlllllIlllIllIlIIlIIlllIIlIlIlIllIllIIlIIIlIIIllIIIIIllIIlllllIlIIIIIlIIIIIIIIIIIIlII.jar
    .jar 226KB
  • lib/lIIllIIlIlllIlIlllIlIIlIIIlllllIIlIlIIllIllIlIlllIlIIlIlIlIIllIlIIIIIllIIlIIlIIlIIllIIIlIIllIlIIIIlIlIIlIIlIllIIlIIlIlIl.jar
    .jar 50KB
  • lib/llIlIIIIlIlIlllllIlIIllllIIIlIlIllllIIllllIlllIIlllllIIlIlllIIIIIIlIIllIIIlIlIlllIlIIIlIIIIIllIlllIlllIIllIIllIlIlIIlllI.jar
    .jar 16KB
  • lib/llIlIlIIIllllIIIllllllllllIllIlIlllIIlllIIlllIIllIIllllIlllIIIIIllllIIlllIIllIIIIlIlIlIlIIIlIIIlIlIlIlIIlllIIlllIlIlIlII.jar
    .jar 103KB
  • lib/lllIIlIlIIlIIllllIIllllIIlIllllIIIlIllllIIllIIIlllIIIIIIlIIlllIIllIllIIlllIlIIlIlIlllIIlllIlllIlIIlIIIllIlllIIIlIIIIIlll.jar
    .jar 12KB
  • lib/lllIlIIIIIlIllIlIlIIllIlIIIlIIllIllllIIIIIllIlllIllIIllIIllIllIllIIlIlllllIIlIllIllIIlIIlIIIllIlIlIIlIIIIIIIllIIlllIllIl.jar
    .jar 1.1MB
  • lib/llllIlIIIIIllllIlIIIlIllIlIIIllllIIIllIllllIIlllIlIIIlllIIlIlIlllIIlIIIIlIIIIlllIIlIIlIlIIIIIIIIllllIllIlIIIlIllIlIlIIll.jar
    .jar 16KB
  • lib/llllIlIIlIllllIlIlIIIlIIIlIllIlIIIIlIlIIlIlIIIIllIIlIIllIIIllllIlIllIlllllIIIIIIIIllIllIlIlllllllIllIIIllllIIllIIlIllIll.jar
    .jar 95KB
  • php/README.md
    5KB
  • php/deplister.exe
    .exe 134KB
  • php/dev/php8.lib
    863KB
  • php/ext/php_bz2.dll
    .dll 85KB
  • php/ext/php_com_dotnet.dll
    .dll 90KB
  • php/ext/php_curl.dll
    .dll 598KB
  • php/ext/php_dba.dll
    .dll 151KB
  • php/ext/php_dl_test.dll
    .dll 14KB
  • php/ext/php_enchant.dll
    .dll 25KB
  • php/ext/php_exif.dll
    .dll 71KB
  • php/ext/php_ffi.dll
    .dll 156KB
  • php/ext/php_fileinfo.dll
    .dll 6.8MB
  • php/ext/php_ftp.dll
    .dll 61KB
  • php/ext/php_gd.dll
    .dll 9.2MB
  • php/ext/php_gettext.dll
    .dll 54KB
  • php/ext/php_gmp.dll
    .dll 319KB
  • php/ext/php_imap.dll
    .dll 937KB
  • php/ext/php_intl.dll
    .dll 426KB
  • php/ext/php_ldap.dll
    .dll 252KB
  • php/ext/php_mbstring.dll
    .dll 1.5MB
  • php/ext/php_mysqli.dll
    .dll 117KB
  • php/ext/php_oci8_19.dll
    .dll 138KB
  • php/ext/php_odbc.dll
    .dll 65KB
  • php/ext/php_opcache.dll
    .dll 784KB
  • php/ext/php_openssl.dll
    .dll 147KB
  • php/ext/php_pdo_firebird.dll
    .dll 32KB
  • php/ext/php_pdo_mysql.dll
    .dll 30KB
  • php/ext/php_pdo_oci.dll
    .dll 36KB
  • php/ext/php_pdo_odbc.dll
    .dll 29KB
  • php/ext/php_pdo_pgsql.dll
    .dll 43KB
  • php/ext/php_pdo_sqlite.dll
    .dll 28KB
  • php/ext/php_pgsql.dll
    .dll 97KB
  • php/ext/php_shmop.dll
    .dll 17KB
  • php/ext/php_snmp.dll
    .dll 419KB
  • php/ext/php_soap.dll
    .dll 247KB
  • php/ext/php_sockets.dll
    .dll 77KB
  • php/ext/php_sodium.dll
    .dll 92KB
  • php/ext/php_sqlite3.dll
    .dll 52KB
  • php/ext/php_sysvshm.dll
    .dll 18KB
  • php/ext/php_tidy.dll
    .dll 735KB
  • php/ext/php_xsl.dll
    .dll 283KB
  • php/ext/php_zend_test.dll
    .dll 53KB
  • php/ext/php_zip.dll
    .dll 374KB
  • php/extras/ssl/legacy.dll
    .dll 153KB
  • php/extras/ssl/openssl.cnf
    12KB
  • php/glib-2.dll
    .dll 1.5MB
  • php/gmodule-2.dll
    .dll 18KB
  • php/icudt71.dll
    .dll 29.0MB
  • php/icuin71.dll
    .dll 2.9MB
  • php/icuio71.dll
    .dll 59KB
  • php/icuuc71.dll
    .dll 2.1MB
  • php/lib/enchant/libenchant2_hunspell.dll
    .dll 464KB
  • php/libcrypto-3-x64.dll
    .dll 5.0MB
  • php/libenchant2.dll
    .dll 41KB
  • php/libpq.dll
    .dll 283KB
  • php/libsasl.dll
    .dll 205KB
  • php/libsodium.dll
    .dll 296KB
  • php/libsqlite3.dll
    .dll 1.6MB
  • php/libssh2.dll
    .dll 372KB
  • php/libssl-3-x64.dll
    .dll 759KB
  • php/license.txt
    3KB
  • php/news.txt
    41KB
  • php/nghttp2.dll
    .dll 223KB
  • php/phar.phar.bat
    43B
  • php/pharcommand.phar
    .js 64KB
  • php/php-cgi.exe
    .exe 66KB
  • php/php-win.exe
    .exe 37KB
  • php/php.exe
    .exe 140KB
  • php/php.ini-development
    73KB
  • php/php.ini-production
    74KB
  • php/php8.dll
    .dll 8.5MB
  • php/php8embed.lib
    896KB
  • php/php8phpdbg.dll
    .dll 238KB
  • php/phpdbg.exe
    .exe 241KB
  • php/readme-redist-bins.txt
    30KB
  • php/snapshot.txt
    2KB
  • plugins/ActiveWindowNotifier.plg
    233B
  • plugins/ActiveWindowNotifier/ActiveWindowNotifier.dclib
    67KB
  • plugins/ActiveWindowNotifier/ActiveWindowNotifierConfig.json
    3KB
  • plugins/ActiveWindowNotifier/configuration.json
    112B
  • plugins/ActiveWindowNotifier/fav.png
    .png 2KB
  • plugins/AntiAnalysisPlugin.plg
    222B
  • plugins/AntiAnalysisPlugin/AntiAnalysis.json
    4KB
  • plugins/AntiAnalysisPlugin/AntiAnalysisPlugin.dclib
    72KB
  • plugins/AntiAnalysisPlugin/configuration.json
    96B
  • plugins/AntiAnalysisPlugin/fav.png
    .png 582KB
  • plugins/Audio_native.plg
    168B
  • plugins/Audio_native/Audio_native.dclib
    276KB
  • plugins/Audio_native/configuration.json
    102B
  • plugins/Audio_native/fav.png
    .png 2KB
  • plugins/BSoDProtection.plg
    285B
  • plugins/BSoDProtection/BSoDProtection.dclib
    .dll 4KB
  • plugins/BSoDProtection/configuration.json
    104B
  • plugins/BSoDProtection/fav.png
    .png 27KB
  • plugins/BlockInputPlugin.plg
    229B
  • plugins/BlockInputPlugin/BlockInputPlugin.dclib
    .dll 4KB
  • plugins/BlockInputPlugin/configuration.json
    106B
  • plugins/BlockInputPlugin/fav.png
    .png 67KB
  • plugins/BrowsersStealer_native.plg
    200B
  • plugins/BrowsersStealer_native/BrowsersStealer_native.dclib
    198KB
  • plugins/BrowsersStealer_native/configuration.json
    112B
  • plugins/BrowsersStealer_native/fav.png
    .png 2KB
  • plugins/BuildInstallationTweaksPlugin.plg
    302B
  • plugins/BuildInstallationTweaksPlugin/BuildInstallationTweaksConfig.json
    2KB
  • plugins/BuildInstallationTweaksPlugin/BuildInstallationTweaksPlugin.dclib
    .dll 38KB
  • plugins/BuildInstallationTweaksPlugin/configuration.json
    124B
  • plugins/BuildInstallationTweaksPlugin/fav.png
    .png 12KB
  • plugins/ClientsStealer_native.plg
    197B
  • plugins/ClientsStealer_native/ClientsStealer_native.dclib
    153KB
  • plugins/ClientsStealer_native/configuration.json
    111B
  • plugins/ClientsStealer_native/fav.png
    .png 2KB
  • plugins/ClipboardLogger.plg
    238B
  • plugins/ClipboardLogger/ClipboardLogger.dclib
    .dll 4KB
  • plugins/ClipboardLogger/configuration.json
    105B
  • plugins/ClipboardLogger/fav.png
    .png 6KB
  • plugins/Clipper.plg
    192B
  • plugins/Clipper/Clipper.dclib
    106KB
  • plugins/Clipper/ClipperConfig.json
    8KB
  • plugins/Clipper/configuration.json
    86B
  • plugins/Clipper/fav.png
    .png 831KB
  • plugins/CountryBlackList.plg
    214B
  • plugins/CountryBlackList/CountryBlackList.dclib
    50KB
  • plugins/CountryBlackList/CountryBlackListConfig.json
    5KB
  • plugins/CountryBlackList/configuration.json
    104B
  • plugins/CountryBlackList/fav.png
    .png 7KB
  • plugins/CrashLogger.plg
    181B
  • plugins/CrashLogger/CrashLogger.dclib
    .dll 3KB
  • plugins/CrashLogger/configuration.json
    101B
  • plugins/CrashLogger/fav.png
    .jpg 24KB
  • plugins/CryptoStealer.plg
    365B
  • plugins/CryptoStealer/CryptoStealer.dclib
    91KB
  • plugins/CryptoStealer/CryptoStealerConfig.json
    11KB
  • plugins/CryptoStealer/configuration.json
    98B
  • plugins/CryptoStealer/fav.png
    .png 96KB
  • plugins/DisableUAC.plg
    207B
  • plugins/DisableUAC/DisableUAC.dclib
    .dll 16KB
  • plugins/DisableUAC/configuration.json
    100B
  • plugins/DisableUAC/fav.png
    .png 29KB
  • plugins/FakeSteamWindows.plg
    210B
  • plugins/FakeSteamWindows/FakeSteamWindows.dclib
    754KB
  • plugins/FakeSteamWindows/configuration.json
    106B
  • plugins/FakeSteamWindows/fav.png
    .png 9KB
  • plugins/FileGrabberPlugin.plg
    231B
  • plugins/FileGrabberPlugin/FileGrabber.json
    3KB
  • plugins/FileGrabberPlugin/FileGrabberPlugin.dclib
    60KB
  • plugins/FileGrabberPlugin/configuration.json
    94B
  • plugins/FileGrabberPlugin/fav.png
    .png 4KB
  • plugins/FileSearcher.plg
    268B
  • plugins/FileSearcher/FileSearcher.dclib
    .dll 5KB
  • plugins/FileSearcher/configuration.json
    102B
  • plugins/FileSearcher/fav.png
    .png 34KB
  • plugins/ForceAdmin.plg
    238B
  • plugins/ForceAdmin/ForceAdmin.dclib
    51KB
  • plugins/ForceAdmin/configuration.json
    100B
  • plugins/ForceAdmin/fav.png
    .png 66KB
  • plugins/Fun_native.plg
    162B
  • plugins/Fun_native/Fun_native.dclib
    86KB
  • plugins/Fun_native/configuration.json
    100B
  • plugins/Fun_native/fav.png
    .png 2KB
  • plugins/HiddenRemoteDesktop_native.plg
    209B
  • plugins/HiddenRemoteDesktop_native/HiddenRemoteDesktop_native.dclib
    155KB
  • plugins/HiddenRemoteDesktop_native/configuration.json
    116B
  • plugins/HiddenRemoteDesktop_native/fav.png
    .png 2KB
  • plugins/HostsEditor.plg
    225B
  • plugins/HostsEditor/HostsEditor.dclib
    .dll 5KB
  • plugins/HostsEditor/HostsEditorDesign.json
    1KB
  • plugins/HostsEditor/configuration.json
    94B
  • plugins/HostsEditor/fav.png
    .png 116KB
  • plugins/Keylogger_native.plg
    179B
  • plugins/Keylogger_native/ConfigKeylogger_native.json
    2KB
  • plugins/Keylogger_native/Keylogger_native.dclib
    106KB
  • plugins/Keylogger_native/configuration.json
    104B
  • plugins/Keylogger_native/fav.png
    .png 2KB
  • plugins/MessageOnStart.plg
    222B
  • plugins/MessageOnStart/MessageOnStart.dclib
    .dll 21KB
  • plugins/MessageOnStart/MessageOnStartConfig.json
    2KB
  • plugins/MessageOnStart/configuration.json
    100B
  • plugins/MessageOnStart/fav.png
    .png 9KB
  • plugins/MiscInfoGrabber.plg
    290B
  • plugins/MiscInfoGrabber/MiscInfoGrabber.dclib
    .dll 18KB
  • plugins/MiscInfoGrabber/MiscInfoGrabberConfig.json
    3KB
  • plugins/MiscInfoGrabber/configuration.json
    102B
  • plugins/MiscInfoGrabber/fav.png
    .png 13KB
  • plugins/OBSGrabber.plg
    186B
  • plugins/OBSGrabber/OBSGrabber.dclib
    .dll 4KB
  • plugins/OBSGrabber/configuration.json
    100B
  • plugins/OBSGrabber/fav.png
    .png 12KB
  • plugins/PerformanceCounter.plg
    244B
  • plugins/PerformanceCounter/PerformanceCounter.dclib
    59KB
  • plugins/PerformanceCounter/configuration.json
    108B
  • plugins/PerformanceCounter/fav.png
    .png 65KB
  • plugins/ProcessKiller.plg
    253B
  • plugins/ProcessKiller/ProcessKiller.dclib
    .dll 24KB
  • plugins/ProcessKiller/ProcessKillerConfig.json
    1KB
  • plugins/ProcessKiller/configuration.json
    98B
  • plugins/ProcessKiller/fav.png
    .png 62KB
  • plugins/RegEditorPlugin.plg
    188B
  • plugins/RegEditorPlugin/RegEditorPlugin.dclib
    .dll 7KB
  • plugins/RegEditorPlugin/configuration.json
    105B
  • plugins/RegEditorPlugin/fav.png
    .png 22KB
  • plugins/RemoteCMD_native.plg
    180B
  • plugins/RemoteCMD_native/RemoteCMD_native.dclib
    90KB
  • plugins/RemoteCMD_native/configuration.json
    106B
  • plugins/RemoteCMD_native/fav.png
    .png 2KB
  • plugins/RunOnce.plg
    234B
  • plugins/RunOnce/RunOnce.dclib
    .dll 20KB
  • plugins/RunOnce/RunOnce_cfg.json
    882B
  • plugins/RunOnce/configuration.json
    84B
  • plugins/RunOnce/fav.png
    .png 2KB
  • plugins/SimpleProcessWatchdog.plg
    295B
  • plugins/SimpleProcessWatchdog/SimpleProcessWatchdog.dclib
    .dll 16KB
  • plugins/SimpleProcessWatchdog/configuration.json
    111B
  • plugins/SimpleProcessWatchdog/fav.png
    .png 162KB
  • plugins/SystemInformation_native.plg
    195B
  • plugins/SystemInformation_native/SystemInformation_native.dclib
    78KB
  • plugins/SystemInformation_native/configuration.json
    114B
  • plugins/SystemInformation_native/fav.png
    .png 2KB
  • plugins/SystemRestorePointsCleaner.plg
    251B
  • plugins/SystemRestorePointsCleaner/SystemRestorePointsCleaner.dclib
    .dll 4KB
  • plugins/SystemRestorePointsCleaner/configuration.json
    116B
  • plugins/SystemRestorePointsCleaner/fav.png
    .png 24KB
  • plugins/TelegramNotifier.plg
    193B
  • plugins/TelegramNotifier/TelegramNotifier.dclib
    71KB
  • plugins/TelegramNotifier/TelegramNotifierConfig.json
    5KB
  • plugins/TelegramNotifier/configuration.json
    104B
  • plugins/TelegramNotifier/fav.png
    .png 49KB
  • plugins/TestDCLIB.plg
    177B
  • plugins/TestDCLIB/configuration.json
    160B
  • plugins/TestDCLIB/fav.png
    .png 190KB
  • plugins/TestDCLIB/file.dclib
    .dll 6KB
  • plugins/TestDefault.plg
    185B
  • plugins/TestDefault/configuration.json
    209B
  • plugins/TestDefault/fav.png
    .png 190KB
  • plugins/TestDefault/file.vbs
    34B
  • plugins/USBSpread.plg
    226B
  • plugins/USBSpread/USBSpread.dclib
    .dll 22KB
  • plugins/USBSpread/configuration.json
    99B
  • plugins/USBSpread/fav.png
    .png 134KB
  • plugins/UserPingCounter.plg
    175B
  • plugins/UserPingCounter/UserPingCounter.dclib
    .dll 4KB
  • plugins/UserPingCounter/configuration.json
    105B
  • plugins/UserPingCounter/fav.png
    .png 21KB
  • plugins/VPNGrabber.plg
    206B
  • plugins/VPNGrabber/VPNGrabber.dclib
    .dll 16KB
  • plugins/VPNGrabber/configuration.json
    100B
  • plugins/VPNGrabber/fav.png
    .png 39KB
  • plugins/WebcamViewer_native.plg
    188B
  • plugins/WebcamViewer_native/WebcamViewer_native.dclib
    163KB
  • plugins/WebcamViewer_native/configuration.json
    109B
  • plugins/WebcamViewer_native/fav.png
    .png 2KB
  • plugins/WindowsDefenderExcluder.plg
    294B
  • plugins/WindowsDefenderExcluder/WindowsDefenderExcluder.dclib
    53KB
  • plugins/WindowsDefenderExcluder/WindowsDefenderExcluderConfig.json
    962B
  • plugins/WindowsDefenderExcluder/configuration.json
    118B
  • plugins/WindowsDefenderExcluder/fav.png
    .png 34KB
  • plugins/chat_native.plg
    164B
  • plugins/chat_native/chat_native.dclib
    95KB
  • plugins/chat_native/configuration.json
    101B
  • plugins/chat_native/fav.png
    .png 2KB
  • server/getblob.php
    419KB
  • server/vZGOpKmEUkU7BDMvGUZ97QNikJvrOmXSGsjWZ8g0kbT4Nv.php
    3KB

dcrat (1).rar

  • SHA256 8bc4d422624113b2af547b64fa7df842b821f189ca4d7bad6e75767fec4a9e59
  • MD5 SHA1 SHA512 SSDEEP