dcrat | 499f14a1e407d82bac24d6ac62b1f7ee[.]bin

General

Target
499f14a1e407d82bac24d6ac62b1f7ee.bin
Size 1.9MB
Sample240614-b4sjdsthkn
SHA256 07ded566e4fb6aef08946ca3aa07ccc46d53df78a7716280410801bcf2f48cec
MD5 eb2e463cb9a33267ae9e30734965ac39
SHA1 1f274615048f775755fc0659df5002531e4949f1
SHA512 1880e77350f4b578fb98dc8c4441d638f8d0ff7300474657c2ae3f123846388985ba8edb373a526db38606e171ff12eac6300089f1ce41978af6237931c30f68
SSDEEP 49152:2IuxyFTxI9kbyolBF10kxdULBYVh7l2k2DlAEy/bmq+a:2IuxyFTxvby+F10rLa3lwiEyaq+a
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat dcrat

Malware Config

Signatures

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
static1/unpack001/c7d5c20a8f8704cd72855276ade10f22dc95cbce0d89aedcaab2ad64a8753693.exe	dcrat

Dcrat family
dcrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/c7d5c20a8f8704cd72855276ade10f22dc95cbce0d89aedcaab2ad64a8753693.exe

File Explorer

499f14a1e407d82bac24d6ac62b1f7ee.bin

.zip 1.9MB
c7d5c20a8f8704cd72855276ade10f22dc95cbce0d89aedcaab2ad64a8753693.exe

.exe 2.3MB

499f14a1e407d82bac24d6ac62b1f7ee.bin

SHA256 07ded566e4fb6aef08946ca3aa07ccc46d53df78a7716280410801bcf2f48cec
MD5 eb2e463cb9a33267ae9e30734965ac39
SHA1 1f274615048f775755fc0659df5002531e4949f1
SHA512 1880e77350f4b578fb98dc8c4441d638f8d0ff7300474657c2ae3f123846388985ba8edb373a526db38606e171ff12eac6300089f1ce41978af6237931c30f68
SSDEEP 49152:2IuxyFTxI9kbyolBF10kxdULBYVh7l2k2DlAEy/bmq+a:2IuxyFTxvby+F10rLa3lwiEyaq+a
MD5 SHA1 SHA512 SSDEEP

Password

infected

c7d5c20a8f8704cd72855276ade10f22dc95cbce0d89aedcaab2ad64a8753693.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 c7d5c20a8f8704cd72855276ade10f22dc95cbce0d89aedcaab2ad64a8753693
MD5 499f14a1e407d82bac24d6ac62b1f7ee
SHA1 f6c0cbae4795f6c0590fa6db2da41a70f840cec6
SHA512 72701089d14891d69ba46c44fbf38e98011313271971c4ba4b2044ae375bcf8474098b1d17a7823ee4afc4c495e27b76a38741fe6ad33252232671a2e094b07b
SSDEEP 24576:NY5J0GMnewFiryL/VSXXn++KN5BGbLPv0LfQceR9EqbIlHgzVEPRA8ElB/p3FIrx:NYj0obkY1XifQ7RHbJK+8qrIrufZTpI
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

DCRat payload

Detects payload of DCRat, commonly dropped by NSIS installers.

rat
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

4

Entry point

2396798

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

499f14a1e407d82bac24d6ac62b1f7ee.bin

c7d5c20a8f8704cd72855276ade10f22dc95cbce0d89aedcaab2ad64a8753693.exe

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

499f14a1e407d82bac24d6ac62b1f7ee.bin

c7d5c20a8f8704cd72855276ade10f22dc95cbce0d89aedcaab2ad64a8753693.exe

mscoree

dotnet