dcrat | CL_Installer_protected[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
CL_Installer_protected.exe
Size 4.7MB
Sample240622-pyl2baycrd
SHA256 7dd637c7e0728ed077ed7dbab8186cec5164150a9c82e7cc53e0fb63536a27c1
MD5 3aa4277897f9d555fbd3bc184727287d
SHA1 748fb910c560f1462189236fd731b7a98c5a9242
SHA512 617c81f7b239af3888806200fb546e99e3b6fb3b1cef695a3007cff45e63937b1490f7e39690617030e49c087ce827253ab23d3adbea1dadf7d7db15728ea09e
SSDEEP 98304:9hasxuRbNIrSFuwbg1veebOM0TBd0I0agEFNYBMDk7H0FyH:jdQbMog4hqvRW7o7Hm2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat themida dcrat

Malware Config

Signatures

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
sample	dcrat

Dcrat family
dcrat

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

File Explorer

CL_Installer_protected.exe

.exe 4.7MB

CL_Installer_protected.exe

SHA256 7dd637c7e0728ed077ed7dbab8186cec5164150a9c82e7cc53e0fb63536a27c1
MD5 3aa4277897f9d555fbd3bc184727287d
SHA1 748fb910c560f1462189236fd731b7a98c5a9242
SHA512 617c81f7b239af3888806200fb546e99e3b6fb3b1cef695a3007cff45e63937b1490f7e39690617030e49c087ce827253ab23d3adbea1dadf7d7db15728ea09e
SSDEEP 98304:9hasxuRbNIrSFuwbg1veebOM0TBd0I0agEFNYBMDk7H0FyH:jdQbMog4hqvRW7o7Hm2
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

DCRat payload

Detects payload of DCRat, commonly dropped by NSIS installers.

rat
Themida packer

Detects Themida, an advanced Windows software protection system.

themida

PE Signature issue

Digest

f2:90:ec:13:38:52:d7:6a:84:ac:44:b6:cc:49:c3:7d:0d:c6:9b:78:96:90:40:9c:bd:f6:a1:7a:f5:c1:d2:bb

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=C 86211,CN=JetBrains s.r.o.,O=JetBrains s.r.o.,L=Prague,C=CZ,1.3.6.1.4.1.311.60.2.1.3=#1302435a,1.3.6.1.4.1.311.60.2.1.2=#1306507261677565,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jul 28, 2023

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Serial Number

62:f8:12:a3:5f:52:bd:74:b7:18:d6:10:ac:4b:47:83

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 11, 2018 - Sep 11, 2023

Subject

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04

Issuer

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 26, 2019 - Mar 22, 2034

Subject

Serial Number

78:55:9d:9a:1e:2f:c1:a4:79:d6:27:68:4d:11:3a:59

Issuer

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 19, 2021 - Aug 18, 2024

Subject

CN=SSL.com Timestamping Unit 2022,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

1a:d6:08:a7:d6:34:b5:cd:de:97:cb:a3:cc:f0:d0:4b

Issuer

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 9, 2022 - Dec 6, 2032

Subject

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Serial Number

e4:27:04:95:f6:8c:91:d6:d0:ec:7b:49:4e:a4:df:1c

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 11, 2018 - Sep 11, 2023

Subject

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Nov 13, 2019 - Nov 12, 2034

Minor OS version

Major OS version

Entry point

4997208

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

Size

117KB

Virtual Size

196KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

18KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

1KB

Virtual Size

141KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

512B

Virtual Size

392B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

33KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.edata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

CL_Installer_protected.exe

PE Signature issue

generic