dcrat | aa645d0afecfc51f0d86cac5fdcd8a5f6be3d1231532fd582ddecf7214ec3d2f | Triage

Sharing

General

Target

aa645d0afecfc51f0d86cac5fdcd8a5f6be3d1231532fd582ddecf7214ec3d2f
Size

2.7MB
MD5

00885de1e26bc400dcb780eeae9fac98
SHA1

721c09a48674f7cfb8c02c95ff8e2365981c8174
SHA256

aa645d0afecfc51f0d86cac5fdcd8a5f6be3d1231532fd582ddecf7214ec3d2f
SHA512

7b182db613647af3e8888d822332e9b07bcda29e3d92d82bce102126ce8413e1488106040365b7cea422cc2fabf4d96a50c7ac4e1dfc88ff60f0239661b9d185
SSDEEP

49152:qH64y2XDuLlIY14o9/yDzr1xJ8XbRrC9mWvR08Yv7yP3GcY:qHfE5Ad8Xd295UmGc

Score

10^/10

rat dcrat

Malware Config

Signatures

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

resource	yara_rule
sample	dcrat

Dcrat family
dcrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aa645d0afecfc51f0d86cac5fdcd8a5f6be3d1231532fd582ddecf7214ec3d2f

Files

aa645d0afecfc51f0d86cac5fdcd8a5f6be3d1231532fd582ddecf7214ec3d2f
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 792B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ