dcrat | b817873fadd6af466832355a47d1e9ae[.]bin

Resubmissions

30/05/2024, 03:05

240530-dk6b9acb7110

30/05/2024, 03:04

240530-dkymeacb7x10

30/05/2024, 02:59

240530-dgr1fsda3910

Sharing

Copy URL Twitter E-mail

General

Target
b817873fadd6af466832355a47d1e9ae.bin
Size 589KB
Sample240530-dk6b9acb71
SHA256 0f6215b559b8436f2bd82dacca1a3ea76c1cee35c3f7f526388c0282ecb699db
MD5 bd26a798cd0e16293854efa0d1c3eeba
SHA1 9379d72142a44e21ef8fb10b032143e68ffd27af
SHA512 8f5344a6c1f6e016f4b1f366034f4cf2ebe55efd08cab33e35e58ca4cdedcc93fd1fe22b9377ec534bc72185025b33e9226f21b88ef0272c520ae209b9b64df5
SSDEEP 12288:gTchTNOFhNeSDIXXNduWfR8ax5XoUEMSeRlRFZPyHLx1akNeaMEL:3DehNClR8uXoUEnerRnKH91akIaMEL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat dcrat

Malware Config

Signatures

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
static1/unpack001/c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe	dcrat

Dcrat family
dcrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe

File Explorer

b817873fadd6af466832355a47d1e9ae.bin

.zip 589KB
c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe

.exe 1000KB

b817873fadd6af466832355a47d1e9ae.bin

SHA256 0f6215b559b8436f2bd82dacca1a3ea76c1cee35c3f7f526388c0282ecb699db
MD5 bd26a798cd0e16293854efa0d1c3eeba
SHA1 9379d72142a44e21ef8fb10b032143e68ffd27af
SHA512 8f5344a6c1f6e016f4b1f366034f4cf2ebe55efd08cab33e35e58ca4cdedcc93fd1fe22b9377ec534bc72185025b33e9226f21b88ef0272c520ae209b9b64df5
SSDEEP 12288:gTchTNOFhNeSDIXXNduWfR8ax5XoUEMSeRlRFZPyHLx1akNeaMEL:3DehNClR8uXoUEnerRnKH91akIaMEL
MD5 SHA1 SHA512 SSDEEP

Password

infected

c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581
MD5 b817873fadd6af466832355a47d1e9ae
SHA1 e06db2031ed495fd73c7c0d60cb581702f668ec4
SHA512 1ed7a3060d0f7298f969152968b18db5211ca087480ef650415b297747576e033151bfb5b6494e0e1b79ddc609b25412a3707c475a8cd12f3fca95894a6e4a77
SSDEEP 24576:jzZgodRLKBXQEyRt7d/bZJfKp491BaDwoA:jz9W29vlp9Ok
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

DCRat payload

Detects payload of DCRat, commonly dropped by NSIS installers.

rat
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

1017694

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

b817873fadd6af466832355a47d1e9ae.bin

c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe

mscoree

dotnet