Overview

overview

10

Static

static

10

MsSavesSes...YY.bat

windows7-x64

8

MsSavesSes...YY.bat

windows10-2004-x64

8

MsSavesSes...O1.vbe

windows7-x64

3

MsSavesSes...O1.vbe

windows10-2004-x64

3

MsSavesSes...rf.exe

windows7-x64

10

MsSavesSes...rf.exe

windows10-2004-x64

10

MsSavesSes...le.vbs

windows7-x64

1

MsSavesSes...le.vbs

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a2f2e7faee09ff22d394d74ca44ec2a153199d3af3936d1841f3d57c8eae721c.zip

  • Size

    1.9MB

  • MD5

    ca992f98e8cf0653e5ac5b39d7b5be38

  • SHA1

    99b01d44d0528f61bd20b4a419aece6fa03cbb53

  • SHA256

    a2f2e7faee09ff22d394d74ca44ec2a153199d3af3936d1841f3d57c8eae721c

  • SHA512

    aa083ced01c13a76b54dc9b45e1e91056dbb3dc6ac7f1764f0cddca3fb6e60465f8999daae8d7e219d5313c5c2a01dfe1f3579a8c4e63a8cf8b56446e4e6a835

  • SSDEEP

    49152:agcpU2Cn4cFusy9lh5v0IcmB7pX+n2PCgPi0TzuQHqgxFJKRKHKpU4:wU2Cfuj3v0sBuQRjJKRKHKU4

Score
10/10
ratdcrat

Malware Config

Signatures

  • DCRat payload 1 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Dcrat family
    dcrat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • a2f2e7faee09ff22d394d74ca44ec2a153199d3af3936d1841f3d57c8eae721c.zip
    .zip
  • MsSavesSessionDll/9KjI6fqbs0yhjc5d8qYY.bat
  • MsSavesSessionDll/KGvUTlEKtYKB1JaFEhyBUO1.vbe
    .vbe .jse
  • MsSavesSessionDll/agentreviewPerf.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • MsSavesSessionDll/file.vbs