DcRat.zip
- SHA256 3379f86e6b7a13491a8aa668e567b7dfc532d79da5216fd50e3659f7ea9df372
Behavioral task
behavioral1
Sample
DcRat.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
DcRat.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target DcRat.zip
- Size 12.6MB
- Sample260930-sve1dabe67
- SHA256 3379f86e6b7a13491a8aa668e567b7dfc532d79da5216fd50e3659f7ea9df372
- MD5 052d669250a1910f422376ae7942571e
- SHA1 3ca460a0f9c1c2fa7f4b1ff5429bf9235a59ca1a
- SHA512 817e904af422d689d93c2700f7d3365ed5af9e0c7df81eb57b5323616e018ba76423707b40d032722f097ce2070af9827c1dc4838a0f1ee5e785c711bd7e83fb
- SSDEEP 196608:UaFaWsVko3+Q5cfdIRwVffkZ4w5lyjn78hyyWP0ZBOYf3zLHFL8PAOMbBKudRyeR:Uao3Zc6RYXkZ4NXFs//XFLePMboUr7
- TLSH T184D633976AD9D977CB7E09389DA5089E087E8B3814E7B73F8122520D632D71F4632C93
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Async RAT payload 1 IoCs
resource yara_rule static1/unpack001/Stub/Client.exe family_asyncrat - Unsigned PE 25 IoCs
Checks for missing Authenticode signature.
resource unpack001/DcRat.exe unpack001/Plugins/Audio.dll unpack001/Plugins/Chat.dll unpack001/Plugins/Discord.dll unpack001/Plugins/Extra.dll unpack001/Plugins/FileManager.dll unpack001/Plugins/FileSearcher.dll unpack001/Plugins/Fun.dll unpack001/Plugins/Information.dll unpack001/Plugins/Keylogger.exe unpack001/Plugins/Logger.dll unpack001/Plugins/MessagePackLib.dll unpack001/Plugins/Miscellaneous.dll unpack001/Plugins/Netstat.dll unpack001/Plugins/Options.dll unpack001/Plugins/ProcessManager.dll unpack001/Plugins/Ransomware.dll unpack001/Plugins/Recovery.dll unpack001/Plugins/Regedit.dll unpack001/Plugins/RemoteCamera.dll unpack001/Plugins/RemoteDesktop.dll unpack001/Plugins/ReverseProxy.dll unpack001/Plugins/SendFile.dll unpack001/Plugins/SendMemory.dll unpack001/Stub/Client.exe
File Explorer
-
DcRat.zip.zip 12.6MB
-
DcRat.exe.exe 21.6MB
-
DcRat.exe.config.xml 5KB
-
DcRat.pdb8.2MB
-
Plugins/Audio.dll.dll 22KB
-
Plugins/Audio.pdb37KB
-
Plugins/Chat.dll.dll 454KB
-
Plugins/Chat.pdb43KB
-
Plugins/Discord.dll.dll 24KB
-
Plugins/Discord.pdb37KB
-
Plugins/Extra.dll.dll .ps1 31KB
-
Plugins/Extra.pdb41KB
-
Plugins/FileManager.dll.dll 31KB
-
Plugins/FileManager.pdb43KB
-
Plugins/FileSearcher.dll.dll 277KB
-
Plugins/FileSearcher.pdb313KB
-
Plugins/Fun.dll.dll 33KB
-
Plugins/Fun.pdb75KB
-
Plugins/Information.dll.dll 24KB
-
Plugins/Information.pdb35KB
-
Plugins/Keylogger.exe.exe 10KB
-
Plugins/Keylogger.pdb13KB
-
Plugins/Logger.dll.dll 26KB
-
Plugins/Logger.pdb41KB
-
Plugins/MessagePackLib.dll.dll 16KB
-
Plugins/MessagePackLib.pdb27KB
-
Plugins/Miscellaneous.dll.dll 82KB
-
Plugins/Miscellaneous.pdb95KB
-
Plugins/Netstat.dll.dll 24KB
-
Plugins/Netstat.pdb39KB
-
Plugins/Options.dll.dll 378KB
-
Plugins/ProcessManager.dll.dll 25KB
-
Plugins/ProcessManager.pdb39KB
-
Plugins/Ransomware.dll.dll 97KB
-
Plugins/Ransomware.pdb41KB
-
Plugins/Recovery.dll.dll 1.3MB
-
Plugins/Recovery.pdb1.3MB
-
Plugins/Regedit.dll.dll 279KB
-
Plugins/Regedit.pdb493KB
-
Plugins/RemoteCamera.dll.dll 107KB
-
Plugins/RemoteCamera.pdb139KB
-
Plugins/RemoteDesktop.dll.dll 34KB
-
Plugins/RemoteDesktop.pdb47KB
-
Plugins/ReverseProxy.dll.dll 14KB
-
Plugins/ReverseProxy.pdb47KB
-
Plugins/SendFile.dll.dll 26KB
-
Plugins/SendFile.pdb39KB
-
Plugins/SendMemory.dll.dll 27KB
-
Plugins/SendMemory.pdb39KB
-
Stub/Client.exe.exe 60KB
-
Stub/Client.exe.config.xml 161B
-
Stub/Client.pdb57KB
DcRat.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 533c45a3400cceaf13703564aa125c4a17b613ea0964d140be0415d7df4f644b
- MD5 86f3de7b3546c538291820eb6f1d3d32
- SHA1 4b0994b910d67990c855b669f4124e6ebbbc0343
- SHA512 002449d99933ee6a61059a2722a2b75f5358b987f4853a93ef0dd5c0b5724835c449a810450f1d2ba6cb5114a106c8f05fbad2137b3c0b3c851663fa1a00d244
- SSDEEP 393216:q/nGTBP+Zw6NLIsFfskh1BmXGR1Bd+/2:q/GTBP+Zlnk0rmoBY
- TLSH T19637BF00FDA4C653D07B5AF6C0B246F597B0AD19EB1287AB15803FAC3AF27457926327
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22580646
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
D:\a\DcRat\DcRat\Binaries\Release\DcRat.pdb
mscoree
_CorExeMain
Name
.text
Size
21.5MB
Virtual Size
21.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
68KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
DcRat.exe.config
- SHA256 e99e5f117f710505f9f24fc0176a58d89b7cae4dc3c925e97931c2d0a4b4b634
- MD5 d1ce6bd32c1afe09a5e832940e4a997f
- SHA1 a54e46cf616601a50ad039d40b34be89d13e0ea8
- SHA512 4a7142d838bddb69e76b6b81b02574daa16c324b82385af16557b943eff39807b316607f20255f3783f0eb068b22f9c181d24c899401c7feb7cfc61ecc693971
- SSDEEP 96:ur71Y7KO7KTri0bGivwapdgaRzV6RXIAIUAvEnzH9V0BGivi4273I2TpV6RUGoKO:ur7S7x7krM3/I2GoKS/pv7sJ+J/qJvS
- TLSH T1F8B19308B1C19EDA02366B32EB3056D1EDA00667117674F478EE31679F71CDA4BB33A6
- MD5 SHA1 SHA512 SSDEEP TLSH
DcRat.pdb
- SHA256 99685ec760a55813f48591695eb80fc5e00bc975403c4ec4b1fd368cf1e39ca6
- MD5 27a012c5ff675c2859ce9db119d27df7
- SHA1 c4966319db3ffd27c72d07ce5e4401f7774216dc
- SHA512 d050ce516cb85c3c9763f6c7621b7b325dbc9fdc82a8cd3398cff4c76e646a4265fe0b2a986a3cdb381e08898eff08412c3be9b3efe7329aa7fb70a5c706714f
- SSDEEP 49152:43XLpRWrvVyFqQVqgYn3oMIZ+hGutKAp/rcMRDIR:43gU9vY3Bs
- TLSH T158866204BF40CB73D466CB3DE61ED70D1638F5A5AB83972F2A48F1362E4679A0E46358
- MD5 SHA1 SHA512 SSDEEP TLSH
Plugins/Audio.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e990d5fceb7889b8119020b2f6ec2861623a98a9f7a5fef43ae3caf071428eb0
- MD5 0a0a20f3cb14dd00f1f9944ace6157a3
- SHA1 ce7db5df66df4d67ff316f4c001b293bda6a062b
- SHA512 989e59ae063a419ee851ffdaf19367dc4347f987697bdfc669633b59baeabdd4f9238ef875d447d60ddf54011106ebe8d02ac9ce508e35e9fad34be4a8ec2d0d
- SSDEEP 384:+SRj1EfmW3sHmH+6kBdseXGDfICDzu5RQRjuAa04FOkh8:+SRj1N0sHieK/75uAhRO8
- TLSH T1BDA20A02BFA8D7B3DB9C077854B353402775D1A66902FF875E9840F69E137CA1A227CA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
29034
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
D:\a\DcRat\DcRat\Binaries\Release\Plugins\Audio.pdb
mscoree
_CorDllMain
Name
.text
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
804B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/Audio.pdb
- SHA256 553533364811d2a5bb45a48412ca1e1115d40ec95fde58e7aae8af04fe57b46f
- MD5 42b2c8d3197d8414ea5b9fd7359ff384
- SHA1 668a4edd36c3d12762b0c85cf813cc0a619da712
- SHA512 af78799897c499ee5399d6171a7dcf62153b5c60e0bbcb2793e2ccd55b29fdbb1a8b7fd0415a31a8f050392a91ac25dff1508227b360036f6aac20ef06cbcc28
- SSDEEP 384:gDnnPOvNUTf6kWce4QFTdtDKZMYnUwPfuaHVJR:gD3eLTDKCYnUw7
- TLSH T18C03C008BB80CB72D0628B3DD58EE35D0638FDA5BBC3876B2648B1353DB13691E56358
- MD5 SHA1 SHA512 SSDEEP TLSH
Plugins/Chat.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 55752fdc5e0b621dcf4a43558260e97dfc8f04a42ebbd71a5a3986ee60fa9746
- MD5 8333ab22b377dc992e950a36336a332e
- SHA1 e7b6642ce70ad0dfc0fc2413ba4d15532e68131d
- SHA512 2842afa20bcb75ac0d7db39990aa8319ff36f0435cc366a11e4e55fada6f57285b32d5f3730000da36467ce8ab51837941a0ddcd053c108f06b00a0dc87e4701
- SSDEEP 6144:YtBlKJ+p4JX0cZsaB6N83r2y/plBWnxfID/uKNlNQ7fOiLXyCrxO9w+KQqxe/t:YVKTkcZBB6NKbBWnxfIvNr4siQqx
- TLSH T152A412836B18C202D73D06F6D5A762F19265AE96D812DA473D913CDC35F3BCE90229C3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
471002
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
D:\a\DcRat\DcRat\Binaries\Release\Plugins\Chat.pdb
mscoree
_CorDllMain
Name
.text
Size
452KB
Virtual Size
452KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
804B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/Chat.pdb
- SHA256 0b210d903752a03e2c3d961ce76a36a10ba68ca7cf2ac3837cb6a350c0d535d6
- MD5 6eaeb50c3df1371f1e6572aa9eb73f7a
- SHA1 54ca317f0b0102199ab0ee88702ec16ce16802ce
- SHA512 7f0c075bfa07b6b603bb0d497ab60c3952b8fd2c61a82489bf99c74cb1ec31ae89c904e3de145d80ea0e4fe615dfbf6ba5c90a6bf66befe69d89b8371f31f2bb
- SSDEEP 384:F/coyOfhoqwhru0BuRKFY1cddYdmxb4Bfh2g3AWYxJpC9OX/JpSdrC/LsZ:F/bhoqF0oRncUXfAg3/YxJpCg/JpF4
- TLSH T16913CE14BB80CB73D0668F3CD58EA35D0638FD95BBC3572B2608B1363DB22662E56359
- MD5 SHA1 SHA512 SSDEEP TLSH
Plugins/Discord.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2635b2eac0808dae67aac619477e54f45cb1c80b8a6d479d272d4a3ea5fd192e
- MD5 46ff79eacaa4e9cebceb87c57e9edb6e
- SHA1 c25b45578c880512513062459ead1cee45e2f74e
- SHA512 2117ea8b74aebfd198a42081ce81dc87fba439fcd0f410129f1b7dca7bc923e14f6e707c3b72243fa2dd10638ea521035fc89abae0708f73b3fe1bd5582bdbff
- SSDEEP 384:+0FmIXW/ppmaCnN594J+Im/tvp2BdseXGcdh+JaL6EWAVuk5mSZ7rN2TD118KsuR:jECaC7iGqQ0jNZ5mSZZWDEKsw
- TLSH T1B0B21802AB449773DBAD47BD457353148379E2A6A902EB5B2ED860F21C133CE4F21AC7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
30810
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
D:\a\DcRat\DcRat\Binaries\Release\Plugins\Discord.pdb
mscoree
_CorDllMain
Name
.text
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
812B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/Discord.pdb
- SHA256 0e10d10f60dca075499eb3c38113ab74af5a3d7141883801cca5f2bb68f982cd
- MD5 1a333391011e49361c2c0d8e1e7641d1
- SHA1 d642a58dc028758bf1d61d3650f649d334f57b33
- SHA512 53a9e2b301f73b2c7650fbb8b9b93441a8da95e8dcf2e4ad121f4392b36ba1499eba0d8dc78de047c70145aa1e2cd5e9d734de865be585591a286273caf2abf6
- SSDEEP 384:ueqgDPmmCjfh63T1XnDvWic3b8+Jvh+KFXifJFNdE:uIihw9c3HJvcMXA6
- TLSH T1E503B108BB84DA72D0768B3CD58EE71D0638FD91BBC3976B260DB1353DB226A2D46345
- MD5 SHA1 SHA512 SSDEEP TLSH
Plugins/Extra.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e9b6a6cee7c9e7fcab0b88f64a993d9002d8c34a8d2bf2f358d01a2baa9c4775
- MD5 951c0c558b8cface27accb2ced40162a
- SHA1 8bb8df333cf2929045787ed0d8ec9cd825f7421b
- SHA512 bee8dcbe5c169842c9fc685d27228d45bdd545da24937f87c9c1c355c75e2e3f3a42216443f60b6e2244ae45fa42a64411f7e4c518e3a4742159248ae6df9f2a
- SSDEEP 384:AX8AFmmb7f0TOueKmVBy77udseXG8WIThDkz7R3bu4Uwvs7c9K7ZvEbJlXKyckeS:o8Avb7fjjcXuLRkVsA9K7Zvc6keFBF4
- TLSH T1F5E23A062F6CDA27CEBD477598B307188376C65B6803FB4A6CD420B86E43BEB46116C6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
37714
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
D:\a\DcRat\DcRat\Binaries\Release\Plugins\Extra.pdb
mscoree
_CorDllMain
Name
.text
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
804B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/Extra.pdb
- SHA256 2a2a982be71d16b0960fb6fecbe9b6f58aa8cecd634ab2c32943771875a50db1
- MD5 055acae11fb16988061425f2b1d879d3
- SHA1 f4f81ed61a73e3136a62c5b1ba740e69c96f08ca
- SHA512 0b206e8c741accb591e90b03497be31d16c417beed0721db30bc44e8aa7776fb0c2e4b84e939d78164976a6cd490f0283ea9a5cf179d8788ec6c71872255448a
- SSDEEP 384:9coX0SI1Ykt7c7huXDJsCmAvQV2R3kMYD8f81/Z4IvyfJiJukR:9Vh4TnQsR3fYD8fS/Z4Iv
- TLSH T10713C208BB94DB72D0368F3CD58EE31D0538FDA5BBC2576B2608B1353DB22662E56358
- MD5 SHA1 SHA512 SSDEEP TLSH
Plugins/FileManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cba6c28e0f96d775ff8f24c1324f7e4da1fc83c27053e95ce65a1684b99cdd66
- MD5 7eca574255ac9e859968a6378441c4c2
- SHA1 fd2cef00b6716e37cd5512830d9cf5d67ad998e3
- SHA512 f8cae653dbdaea7100800810e86149cacc0a97b9f1165efadf5a301659cb47ff0233c2e0fd1a5a21de395fdd39e812cc6ea8753ffb89c0c94fdb7fd828ec3857
- SSDEEP 384:MEGHWHugXvIgTmm49cj7ddseXGMBNhD8mouIXA4Pcg43YzMnIqE7GMiBrNelgU:Mb2fN49ydxZyXMXJnIr7GMarNk
- TLSH T148E21B01BFA89263D35E877968F3431802F5E46F6503DB4B8CD820F66B237EA5A05DD6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
38266
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
D:\a\DcRat\DcRat\Binaries\Release\Plugins\FileManager.pdb
mscoree
_CorDllMain
Name
.text
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
684B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/FileManager.pdb
- SHA256 d9ada001de93495cd1946b3fff54eae0db9a3b8f0a35beb5168059af56b8fcf7
- MD5 c2c0ea2b7f106391b697ae7ac50d8925
- SHA1 99fbe5fd6a536cd2fcb5bd67d5ac4264c4c3df38
- SHA512 afd6e991c0635bf7ca29546cd8c1ceb3766703593c7d2163c83b6346c55f46d36336126614189013387ad0a7577991a1a7ae64edb75e649133627e1205a8dd0f
- SSDEEP 384:JcoyOWVZRIWjishavA33inn8Mk9XP2S3kSy8AQvVyJZB1bxOxthDtkvROqpEp:JCzgllk9X+S3zy8VvVyJZDxomzG
- TLSH T1B013AE44BF80CB77D4668F3CD58E931D0638FC95ABC3976B2608F1363DB226A2D56258
- MD5 SHA1 SHA512 SSDEEP TLSH
Plugins/FileSearcher.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 62e8c83d9762f4dc50d5e359e6c990bed88fd11de86cfd64c66ae4b8b8fd157e
- MD5 71a50fb381374ac257c55b3644423402
- SHA1 1aed126cfc10538169a1a959db60835d3f66426a
- SHA512 148361dc04abb0fadc803cba194a0c92c7d1beabef2733251fce91d3b0ba14afebe7c7460790e43f576e982403f9af613458603da18583c8f734a80915dc2226
- SSDEEP 3072:7GFYQ/KZdG6oE1nKSYfTvqCjUKidQTs2pccc9k1DEIWcSCSLeyYcEeI/KQ73WmbJ:7nwLrSYfDjtlAx9k1AU4pE0
- TLSH T1B8544B406BE9CA57F1BF27B6C0F3525187B8E152A57EEB8F4C8014EE1917340DA217AB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
289942
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
D:\a\DcRat\DcRat\Binaries\Release\Plugins\FileSearcher.pdb
mscoree
_CorDllMain
Name
.text
Size
275KB
Virtual Size
275KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
836B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/FileSearcher.pdb
- SHA256 8a9c5801bb076b4254a2a6033d0695f167fbbee43bbfa7164b0c173ac8f1185a
- MD5 91a3c8f4dbb88a0c44bd57c0d8df4c49
- SHA1 9cf61fc9c75b06a51fe7d9756f3e1a6845cd4166
- SHA512 eaa7d2d2f6b912636d2bc9a904ea59de618bf1eb59b022609837a70d03edf776d5e865d68b5d68ad4d30f85089852f1cc627cd39e336b2c63ead3ae0e80d594f
- SSDEEP 3072:kts9hTGGbOg0p+EnTVpWy04b4booIpPXUnAaCAd4G7bG8I7B4Gpf2wiNfOaOkVp9:bbOg4NTXFPwvfGppfoOn0Ylt9hhj7Pu
- TLSH T12C646606BF40C673D062CB3CD69EE71D0738F5A4AB83936F1649B0362EB539A6D47294
- MD5 SHA1 SHA512 SSDEEP TLSH
Plugins/Fun.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ae77ad03383aa87699a3c706955c732ba73c1210b11babe981df4379079ca0d4
- MD5 e702d966aa0b7bc5e9bbcd72338753d3
- SHA1 33a34aa24c99c104fa79457e5b5e4ab9d0f0c505
- SHA512 111daf624538f39eae87f9b63eb4e3e99933450ee50d28c7bae17eb76eda0916a525082464d13e94215cca97db5689e3a56079eba86e2e3efeb11339e4b793ed
- SSDEEP 768:wOFmXPm7MACQnB5vrTh+gyR2Lybx9gnZ:wOFNnB5XrL88
- TLSH T16FF23A08EBA5D677EB5C0738E4B353148375D4E26403EF8A0CC820E66A477CA4F65BDA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
40258
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
D:\a\DcRat\DcRat\Binaries\Release\Plugins\Fun.pdb
mscoree
_CorDllMain
Name
.text
Size
31KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
836B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/Fun.pdb
- SHA256 3e5d9e150aae02fd74b6b95e9e296e4d879d201c86e2692dde88f81d82144421
- MD5 43355a9c2e8b2b4d87628bd9ea614a98
- SHA1 6437a78184e3ababeab361585cd45be808450a9f
- SHA512 f1eb09a4b9e33644ce07b1e1e98f77df929d714e4c62c2d870db117684af719ce1a8ed0398a7a8da23b0d7cf38129883b64f71a673634fb6b985a200215af7c5
- SSDEEP 1536:q4PWOMAFpZl/YNMjf5cWdbvgHIIzbYA53Q2eByyllqnypfR7+UR:PdMHI4bYA
- TLSH T14573FE07FB41CA32D029DB3C959F9B0D0738FD94AB82836B2A58F2393EB63551D56358
- MD5 SHA1 SHA512 SSDEEP TLSH
Plugins/Information.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5fa9dd9e738b20f026b5f88e7158e3c5183d46c64b25ed40c2faff23b10a3267
- MD5 35eb72e2b7c85e34fe4ea0be632ef247
- SHA1 82c760a3694fde480ed5500856341227dee21c2e
- SHA512 5438e395c302ebf3b07f9f2df9db984c4e89557aeb500a02f27b4ab22ba20706cb32581de48f407ed2a686f033f2742d398e380241aaf9fbde8001419af8a1b6
- SSDEEP 384:gSvmkKbpmUGZdseXGvXhDYLuqInXx3McZgRaYzwM3tllsXxMSq:T+kKb0bZIqInpXZgRtzAxMSq
- TLSH T16DB2FB05FBA88763D7AD1B7957B303084BB5F5A59822EB4E5D8010B6192B7CA8E213D3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
30638
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
D:\a\DcRat\DcRat\Binaries\Release\Plugins\Information.pdb
mscoree
_CorDllMain
Name
.text
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/Information.pdb
- SHA256 4a61588b16b13435e8b102b8a4f75142d6cc4c3f7080700746ba9c12f5c630b6
- MD5 3ec2282c965900bea3a316d032e4a2de
- SHA1 8360ec49bcbb714699a036d1394696b6a50aff02
- SHA512 bfa5fe69a1304fbceffe7c3c2cbd90ecaac365326fd0cab051731bd371499968f098faf8fc0c5a8a287df00da00d0f97a0b51926a5ada64689ccf2c0cd8d54d3
- SSDEEP 384:IiGFCfcoX0wSRCdgLge6FPTZTq63aDA/EUz3M+vntr5bl:IdFkDxbZTq63eAsUh
- TLSH T138F2C004BF94CB76D0628B3CD59EE31D0538FD95BBC2875B2618F1362EB226A1E47358
- MD5 SHA1 SHA512 SSDEEP TLSH
Plugins/Keylogger.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 85c1c0070b0bbe577cce521a39a4943e97120957fb5b69b0c0b913bbdc7f2f8c
- MD5 bb705e1212af49881a31f2de2bc48653
- SHA1 a9728d5a995b163d6d4c590b3d79836b469806f7
- SHA512 9526b5279478e01c37ed001cd7bc69a3583cc5ce4a7c9ac0e404a1d8b554878513abe3c282eda81f8c524bbbbe84e7ec66ecee22ca62e88dc8962aed58662aed
- SSDEEP 192:Htmcuq6MYDxi4maEYbRzmEsLkTgv5JHTUeJYHcwY7fazJFEi:HtlF6MWE9rUhVsL15pUrYyVFE
- TLSH T1A3221981B7E88775DD7927B69CF30B501A70E2055C77C9AF1898111E3EA73450F83BA6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15730
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
D:\a\DcRat\DcRat\Binaries\Release\Plugins\Keylogger.pdb
mscoree
_CorExeMain
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/Keylogger.pdb
- SHA256 083f6c64ac69235f2f5648f92e4b6c6740b90519cd569a482ee243297ff24cf2
- MD5 3cdb9acd0d39b6e02346065e1c444b6d
- SHA1 92623906e12e6a0f7e0996e60ffa143a1eb66449
- SHA512 276768d29b68ac0e3cd92263b57767cc6ea0b225b5095abf5fb00464d4da52ad54e033fb1a34de3bc94033115a7241ce69faab9165f6234176d826791758cae7
- SSDEEP 48:zQZ+6tlAcUZ5KKeI10os27DT3U1dYxrYoRAKTh8XCIZO:zQZBHLKF0os27DT3U1dYxrYoRAK6XzZ
- TLSH T1F452DD01FF55CAB3D0118B38889EE78E4225FD99EFD643973685B33E2DB13805E92194
- MD5 SHA1 SHA512 SSDEEP TLSH
Plugins/Logger.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e74d874a3667feac3a7a9e1f7052c7d6bd77996e6c7b87abb480d5d945cfc233
- MD5 9312c0416feb53f93f9ac86ada74ea49
- SHA1 864bd7e26d30d95e0bf8360e64c5dc05d1e85601
- SHA512 7736cd77ab92446d56d53d34e96f2c68eb2688f759fca4bf3c53b1f8568a770937067d2056e9ed51816d063338e32b5c44429b1ab98e1c74c3f3bcf0c76b8802
- SSDEEP 384:Ky2nOVC1a1WmAcsH2Co9KPdseXG8iIhDbuLCG4kNmCWuxb87AMF3:KrQ1hNsnPZ1JkR8753
- TLSH T170C219057F5497B7CBAC1BB8ACA7530543B1C29B2C13EB871C9460F64A537DB0B16ACA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
32290
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
D:\a\DcRat\DcRat\Binaries\Release\Plugins\Logger.pdb
mscoree
_CorDllMain
Name
.text
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
812B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/Logger.pdb
- SHA256 3c4d1395b0896f654eb2a18bddd4abd634b7757039d615d7f7c8740cd977d301
- MD5 4a913893f88ae7bf9f35193fbb5414ce
- SHA1 d404eed0f2d5d6541aec5bb42ead92fa46df79ec
- SHA512 280268f862eed21ec7c1f2f8b22d53a64574f033955fe8f02e8841bbf053f0fb9768c5e8d388d76ea44652181e394b3190813850a6a98a4f808cd9c9eab56d73
- SSDEEP 384:zcoyOlF5Lv0fqiNHegYkGo2f3b/JI7MR/FzZOB90Tq1lAM:zZvRiIkG7f3jJI7sJZf+l7
- TLSH T13A13C004BF94CB72D0668B3CD58EE34D0738FD95BBC2576B2608B1363DB226A2D56358
- MD5 SHA1 SHA512 SSDEEP TLSH
Plugins/MessagePackLib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4e5c67513e229da9e25476ea13d3df6958c9ea819a3a6fce0f179d6d76154792
- MD5 e1102f019724da3db202566e69daa9ad
- SHA1 2215bd2d98a3d8cc8cb3cac132c12f3f1ad55d4e
- SHA512 e64dd6383af168848016820a6cedacbd7d400b91c0ebb681d264d3aede2411a1a190c41ad9261384422e83cf7b3afe1068d5bf1266a3cb56be547cd757389d18
- SSDEEP 192:qbl2mHTq8EBOk7wt3exS7Nr1j1N4k/g5niseqdz/YGr8puYJekwDMRqNfCmMDRVM:/mnkO72iseXGr8puUUMmMDRVE7PuFRW
- TLSH T1BB72C606AF599623DA6D07F994A303045735A9A1A403FB9F4C58A1F25E233CF1B727CA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22098
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
D:\a\DcRat\DcRat\MessagePack\bin\Release\MessagePackLib.pdb
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
844B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/MessagePackLib.pdb
- SHA256 629edb371e9466e68c49f9126358f5168e80e1cfc599af5b94eacf491b4a0162
- MD5 934f6c7d7d42b346e2a93c0c706bd3d4
- SHA1 aa987037e39c7c9a7db095a37824e9123f14bf16
- SHA512 a7026fc8ac189edca1595ad38e64476cf88893deb006c2b5f2e277b75b249060c8da552235797a55cf4fa1d502b091ca8026a135eea4f05cfe398d212f531b3c
- SSDEEP 192:f+HmyVKlOr8oC4sTQGBtwTHkZxPtREXJdsGV87k/VdjZHXT6h8zrv2LvYYUxMCVQ:fOYoCttwKPPKJiQkHWE/rUKtVG
- TLSH T131C2DF44BB80CF33D4268B3CA58EE30D5539FCA1BBD2875B2A0AB1353DB23695D52359
- MD5 SHA1 SHA512 SSDEEP TLSH
Plugins/Miscellaneous.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 438f81782fa57262b6cf00c17c07e05d4c13612b6ee3c304db642b537092b768
- MD5 4ebad0c85bc7fd9fda2fe3faac0971e0
- SHA1 ae551bc56f59af2910e56c8bafd0c381f0be5632
- SHA512 25d099a9b0525d8fa53a6009b06931fa8f506cbc47f12dae3cf0c38508cf53413c123b2829bf698723a4a5c6a794cd970a41bcd154b41a87cf4395e7aa27fb5f
- SSDEEP 1536:pZce38lSJ3k45otUV251nos3O4RaamPab:pZceRU4KSV213O4Raah
- TLSH T135836D156BA8D927D8BE1BFA34B3061853F1D551B213EB6B9C8414EA1E137D20A237CF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
89986
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
D:\a\DcRat\DcRat\Binaries\Release\Plugins\Miscellaneous.pdb
mscoree
_CorDllMain
Name
.text
Size
80KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
692B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/Miscellaneous.pdb
- SHA256 02c892ccc529ec4c7a7631cd2fb3785d280d3d23d20f6c4b4dcc6a1d3f5354cd
- MD5 f928fe3f34c4f110d30a10d5ad3d0075
- SHA1 6454e9cb151b7fcd7dc2c6e0aaaa143d196cb126
- SHA512 024c7a5a0d7a93b8459f60b511a6370b9d0c2c25140dd05cf123bf68ee905fafb6f98472202b8872bec1048c7dd301d6bf6c2bf7bcd19516263660a34a2df4c6
- SSDEEP 1536:/CjnNTrvILK960Ebcr/N02ctyU/DPBgc2DYUzupg:/CjNT7IG9SsN02ctyUyc2Dgg
- TLSH T103A33414BF44C632D062CF3CE58EE74D0638FDA5BBC3976F2548B23A2EB52A51D46258
- MD5 SHA1 SHA512 SSDEEP TLSH
Plugins/Netstat.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6cc26e5fcad80b7cf16b14f30c226a47b78a8ba21f8a43b8b4b3c41d22f3d93e
- MD5 5d4842f9adbda550493f64b6494760f5
- SHA1 3f28d71d1abfdb2c7a22e038c40134a0fb294b08
- SHA512 d4f886ccbd2fefd1c8319230ca2bc4eb02282dc8d487e1773852c031b6ba07b4ed4aa41d028c35cac33b2e9ba4938085d8c10dd3e20eea4c82c8e590f8b1f8aa
- SSDEEP 384:Lrl+bbgmsHmxSRmqe5HPwKRsJGAdseXGOhBReDmYuFCJG0BBS93NNRk+rs25x55K:LwbWGcMqc45L6eC1Bu9Tk+gn8sL
- TLSH T1BFB2F905AB68D777DF5C077DA8F3030903B8D2A66512FB8A5CD830F61B067EA07656CA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
30994
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
D:\a\DcRat\DcRat\Binaries\Release\Plugins\Netstat.pdb
mscoree
_CorDllMain
Name
.text
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
812B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/Netstat.pdb
- SHA256 218053e9b698827532e71ed0823ad91a56cd859f464c0ed26af0b202167e8461
- MD5 d4ba6d61f514797bc61bd88dd0ffc658
- SHA1 783e58b29fccea8b4d0e9705fc90797592061388
- SHA512 cb34dc1db53d257d24c93ee49908904c915bdd5b3f6092eb3f5ca019d1b045f57f2aa3814fe573fe4e96f606b9b8284223f59aa62cdde80c72327ce5c26d3651
- SSDEEP 384:CcoyORXiXOX+5SmE7XtHhMd72o3xwatbWpVijwNDdSgCEilHNzp:CVXN+KtH+dCo3OaQplNhYEilHN
- TLSH T1CB03BF05BF80DB72D0368F3CD58EE31D1538FCA5BBC3576B2608B13A2D7626A1E56258
- MD5 SHA1 SHA512 SSDEEP TLSH
Plugins/Options.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 edfb9fccf0853fad2647060eb93a4c097c76c86e689c004cc0dfc9e897a1024a
- MD5 02a0461b1cc18677bef6fb62122bd091
- SHA1 fa77298641d2a499da56ba112296c5a469a7d6a6
- SHA512 4f8f5e9380302c5d5132a5cbb9a66dd73eceba5c7d899d48a7342dffbd18597311b095a25121fc0f16503dd895dd92e96c856aee1cfe688b4c01e7af2160901a
- SSDEEP 6144:zTG2nhDLZ03+biuOd1jScGHkl6GfIrOzXeiKvhzmYVV7+FWWz06v:vnnzEYcVXeiWBVqO
- TLSH T11F845C11DFE4C237E9BE17B5E8B3024147B5E48BE566EB4F988864D81C63304AD127BB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
393374
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
376KB
Virtual Size
376KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
812B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/ProcessManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 735e119b08c0283083e7ec9bdff3a778fca8925e897419edcd7617fe8439db6c
- MD5 72d79e1da2d15427a54b92c87e4aae9a
- SHA1 54662cfd0a384324bfd10c773a7fc224965628e0
- SHA512 61d90a5dadfc8c707e010ce0cd874e183c034a53afa4ed3ebfbd20f31cbb792c73b7a34dc929cd6d8116a8def4d054c73e2ad2e43341ecadcda9f17ce2d22355
- SSDEEP 384:qiL3RGwNe7Nm1T33T9OZNA8SwCguRvsPzHdseXGii6ZDWl9UZ5QDBfqFubvAzx/3:qiL3A2eg1L3B7wUvsPT9mbvixV1
- TLSH T151B24B056F88E777EABC077AA863531447B1D1B6B402EB8B9DD824F22B077C90A117D7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
31306
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
D:\a\DcRat\DcRat\Binaries\Release\Plugins\ProcessManager.pdb
mscoree
_CorDllMain
Name
.text
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
844B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/ProcessManager.pdb
- SHA256 4c1dae4976a40779ce9e905b6737e52dcfc45daaa6b37e910b8b80c218fee582
- MD5 b70e19c85d892ace8eba8bdba1258ece
- SHA1 31ee8480c977fc2acc402f8d9783d1d40be4f988
- SHA512 8a82fa94f576afd6a7ac908abe42ac08c47ce5c745d2bf8a2b7c50ff1bf61e42185f67282fc530c27d7d546687a91b56d116f51d36abbdec36510673999280c8
- SSDEEP 384:Tljgx/ayJ02Cs1XrZ0r7O9HJ0K0MSRHaUbMSzT0j23W3RR4HxNo:TPFwx9aKzSRHafSkuvr
- TLSH T18C03D104BF84DA72D0368F3CD58EE71D0538FD95BBC3976B2608B1362DB626A1E46358
- MD5 SHA1 SHA512 SSDEEP TLSH
Plugins/Ransomware.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0e2e473cc3fdca1c3f7f68fac0f6d8a2a7e18619451c65d4803cba81cd0a3023
- MD5 5c626e08fa4a6f68c6b6e89459d58842
- SHA1 b4b3450fdfbdbff28452dd17a06cef030fcc7ffe
- SHA512 1400ae6659a70766ac90f673617b5d4706fc56b4c05a057450b445ff9e8ee6460cd473082449d09e6480e052a609622441ccf18c9fb869a37153188ef80f12f7
- SSDEEP 1536:EQaxD6uxxNV41T56kDgJp+isYOmvZfi3Oqbh9r8vbVj:Dax2uxxNV41T5lkjvv83OqbjIZj
- TLSH T14EA3FB152FC486ABCAFD56FE7DA542180BF0D2D6B002FF47494864662CD33A3896D68F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
104946
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
D:\a\DcRat\DcRat\Binaries\Release\Plugins\Ransomware.pdb
mscoree
_CorDllMain
Name
.text
Size
95KB
Virtual Size
94KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/Ransomware.pdb
- SHA256 bb04cdbdb158034483ac7f338491844d4c1884526bdcdb839440bd2978966c04
- MD5 7413d6697a68348c7b5c84f420608768
- SHA1 5c61f25180c8647288668fb43efc4ae5aae96d19
- SHA512 d1fdd0d90311b91b25e0994845411ad5487d413fcbc05b5225e31d0586f78296e9bb087dcc7f9cd044655f7a7ed02376001630d5da4bc1bbef89a1b45f8f7b87
- SSDEEP 384:BcokG7OAk80/qFdRtB8HuAX+2W3x4j+Jh2hNFfxvkTjpPoB/D:BPV8OAXRW3qj+Jh2lfxvUW
- TLSH T1BD13AE04BB80CB73D0268F3CD59EA70D0638FD95BBC3976B2609B1353DB226A2D56358
- MD5 SHA1 SHA512 SSDEEP TLSH
Plugins/Recovery.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 51bbb230018e7cc58da418a000f250a5339d57367044f26e095cbedf310e0c73
- MD5 f5fc07298c4291f90de838bb13bb34c6
- SHA1 b9fc50f3792c80f23e8f6dd9d5b637e4046d462d
- SHA512 4deb0700948b4e1f14a6ef150fab8a88644449683d4805054f6fb18c729876076d6566d789b465d02dde3524377d90d5d4440097a5c92cc91a80cdb62561bcb9
- SSDEEP 24576:DbiHpeKuuOcI8FeZ1H9StDW+gmGIX4exFkJdjT:DbiHAG9cgymGIX4e8j
- TLSH T1F65549047BE4DA27D1EF6776D8F2065047B8E486E3B2E78F569496A92C13340AC443BF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1328838
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
D:\a\DcRat\DcRat\Binaries\Release\Plugins\Recovery.pdb
mscoree
_CorDllMain
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
820B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/Recovery.pdb
- SHA256 7887bbbf0bde8209f8337b45c65e776f1cf5cdb820f5cff3f90c4823cd543774
- MD5 dd43094f7f23f9aa058ec33050cd4ab1
- SHA1 069ce35b9b4ba7966fdc3898e140c203b948c0c4
- SHA512 1355880e5b447af7caee72b9bdc197a604ce6ef7a4d95af14749576768e94d45e40709e18fa81feab98a537acd1ae6749f2bf592072bfec50adf4e795b75b613
- SSDEEP 6144:JZiuiS+7nP6B182nMLmFXsQZVPrlXdrNF6AMVupwAw92I4efoupR77xW/IGNz6K9:h+dMbuAw9Ge3qepxU2+zSP3y+smS
- TLSH T163554355BB00CE76E0A3CB3DD59DE34D0738F4A4AB83D7AB2649F0363EA62951D16348
- MD5 SHA1 SHA512 SSDEEP TLSH
Plugins/Regedit.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e94c60401db37f29856ef538b58ed29e951d37c746a551b1b62fe6f05672087d
- MD5 37b49c604fc91cb11a6486868861ecad
- SHA1 5cebf2682baa64863d051f61d5087b8cc03d8894
- SHA512 5fa232c962c626620889d619d2b2b65c6a74de51f196b39ce8d8769420b054836fa20b60834d6b2b1580a177b26ace3488835824ae4085df9c59fc3755cb876a
- SSDEEP 3072:KzAqsjXBXBqf6ura3Rx7+HHgmIKxUI0oWFcgboxW5d5NkuoXxweMSfb/Fs:ouRRtL2HgmmoscZW5Nj6weMSJ
- TLSH T1F6542B006FECC717EABE23F5D87915088BF5F51AF61AE74A58A420F90C127846A117BF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
291946
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
D:\a\DcRat\DcRat\Binaries\Release\Plugins\Regedit.pdb
mscoree
_CorDllMain
Name
.text
Size
277KB
Virtual Size
277KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/Regedit.pdb
- SHA256 edaefbb6cab9593a1e776d67efc6b2f6c54cd73731abda42a0b1555b28ff569f
- MD5 eab2cd1e3328658928c22e33fbdf26ec
- SHA1 93fb6e1831d8d2eb44eaf5e915a7dd463873b21f
- SHA512 16a202c6391ab64b58b293b343a372b7333feb0608be940ddf35ad1490f81bd2dd02f3c49fd6c05d0913c9b9fe3ec2af551e0962059dd3b339a2752429e4779e
- SSDEEP 6144:P+UhMi4sCwV902xzrYzjB2rE+09HybVAv1L8Cb9rFQtJB7:XUutuA
- TLSH T12BB42F07BB40C973C42AEB3C969F974D0738F658AB47936F5E94B1353EE23852D06268
- MD5 SHA1 SHA512 SSDEEP TLSH
Plugins/RemoteCamera.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f27575bc796480908f84a9516ccd250b5ddbe89cd94e8dfae50cf396018371ef
- MD5 80758929cdfb90e29d2445b92068879f
- SHA1 255e7bd9342a010643192202e4ca0bcac2ec1815
- SHA512 13926254d38bcfc6517713f5414138a329b536a5c3e5481a00a4b58f5408aa61f17928fb3796617672f2b26ea88127eb9294cb9c13b1b654b84c28e300416061
- SSDEEP 3072:1OFFLLddftQGkkeeMMyDRRHHZZzmf7oQTLuxkyqIpQkosaZuYmBBvU83p+dg:UFFLLddfBkkeeMMyDRRHHZZzq/IpQkoG
- TLSH T1FFB349416B7CD667D79E17F9A0B357008BB1C212A217F3CA1EA814ED6D633805E127EB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
115254
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
D:\a\DcRat\DcRat\Binaries\Release\Plugins\RemoteCamera.pdb
mscoree
_CorDllMain
Name
.text
Size
105KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
836B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/RemoteCamera.pdb
- SHA256 0924fd378b09c2bcde15f71c18208705b58505f166d51766793dbcd56fc65898
- MD5 74d0e5401729c33ee2a601280d8b4bd0
- SHA1 581d2a5749d58ed24e6675fd1073bb5a710f8eec
- SHA512 f69f6c81285299891c448deec187b65c47eae04f3babe3ece8e3954e17969a080e041c0b9ca8fd7a2c0f261aa3c60c1960b21b90033066a307b265b0ff0845d5
- SSDEEP 1536:7MBIy6+7I72Fxya4mMwHPAaw1D7x3ugOQlxA0JbGhOuDe9:7Miy6uI7Ja4mMwH54y8A0JaOx9
- TLSH T118D32208BB54C673D062CB3CD54EE30E0538FE95BB83A76B2549F1352EB539A6E43258
- MD5 SHA1 SHA512 SSDEEP TLSH
Plugins/RemoteDesktop.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8fdeb344e90596eafa2881e877aefbdf0f628a7689f4e98d1381047df3c110cc
- MD5 0729c3edad32f883c527e844a2f76415
- SHA1 6de2cc4772523dbc9c5310976237c952cd35e9eb
- SHA512 eb9f302096c37a5c331aabfc77764864639c5d46174e6bcb17af2759b59bcd02e76f87ad2f531fecb5ac65fef321b0ea06f4a6e01b7b6ce58aa45ac603ec7729
- SSDEEP 768:pgkUHv6PH412Z9z9kqTYwXT/PP1ne1e74cb:pnbZXXT9j/PP1ne1q/
- TLSH T1AEF22948AB58D737E69C077AB4A353904379D0EB2503DF472D9084EA2A137CF0EA57DA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
40834
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
D:\a\DcRat\DcRat\Binaries\Release\Plugins\RemoteDesktop.pdb
mscoree
_CorDllMain
Name
.text
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
836B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/RemoteDesktop.pdb
- SHA256 2eb268be8b201c3ac37c5145365cd47edcdd4896b360d3b9ac1b78b142b572d7
- MD5 fecb8eb35abc77a30c58e3d93f30acd7
- SHA1 afd2b45b9d755e05566dfaa5915848b5de765709
- SHA512 7744c4eb2de9e2662dbaceac8947227f55f9a4c5fb6dd37a147ccfce76b669790b64e2aefef68ced3182b20e4150186479915797327979b82e990850d2b15218
- SSDEEP 384:tuEecvV+HvZor1yDKcoyOYyvlUNKCF2OCVZY85zLztt3Hq7h3afS+l:tunHdOFUNN25ZH5zH67h3u
- TLSH T10B23C104BF90CB72D0668F3C958EE34D1638FD55BBC3976F2649B1363EB22661D42298
- MD5 SHA1 SHA512 SSDEEP TLSH
Plugins/ReverseProxy.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c0085930bfc30e1c6efe79cbbdfd4f931443669c0dd309e5b53199119d13138b
- MD5 ce1fcb0c45581dd29ff95d8d290207eb
- SHA1 0b28c26e1b22c6c3dfc0bfa4fdd6bc383a1481d2
- SHA512 0e3434563367a962e59747a96761f0c3132ec41c07e67c91a5e105b5818121ed8465dfa2bfbf17961b11fd6d43eaf1cbba4a886ef27cd03cd873fb03503101ba
- SSDEEP 192:UbBTOv+EgIRtac3iIs8YviqeOLUVw1z4ra2ZHouB/By0t/WJIGWC9Pue2M:mIvpAcJOLUqFkP/By0Rc9PV2M
- TLSH T14552290177B04ABADABECF7454A183088376BB4E1943EA8F8DCC54C62F367D06215BC6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20282
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\DcRat\DcRat\Plugin\ReverseProxy\ReverseProxy\obj\Release\ReverseProxy.pdb
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/ReverseProxy.pdb
- SHA256 9fa3287c0804bf3ab26b8fdb147381191ad21c3d406cdde4cc75c179a63eb1fc
- MD5 4b87f2c03705983396670d5c69c7c7d8
- SHA1 5b749ab3bba988c46fee78b5d86d002f429b42b5
- SHA512 b70f2d4426af03d2cfb00870d3aacecc6b066cf53aee20ee970ef8edd1c5f5043acc13ab59380a0014c7ab43297b1b2e7095c956aae8d7488022f3dc385e71ea
- SSDEEP 768:KP2v2WU8sz26impxmTwTxttyLU8CVwOe:YzGmpxmcTntyC+Oe
- TLSH T162236202FB00CA73D46D46746A9B8F591338ED845F82930B73ADB13DBD7779A0E92294
- MD5 SHA1 SHA512 SSDEEP TLSH
Plugins/SendFile.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 187c24e617ca088245d900150a50603598761cc623cf9cf8f440bd2b92f33ebc
- MD5 d1597c94c927b7efc6b1e149204c859c
- SHA1 43d7fdf257b5a2e0397f67418da9885a9cd79839
- SHA512 eeacccd5467e9ea0a233aa59184f121ab24b059532dc8c88dc8f4373566f398df1ccf6acee7a9c52ea66329fca3e0ba07796736aa77432774fb67f43bf5fa7e9
- SSDEEP 384:KuDs6RbLDm9jJ5AftugdseXG88nhiU7eugRZAhrcvlCdBNI2qIcidq4jkcEjI+a:P1969jJ5KugTDvYQvg22TdPH3lEb
- TLSH T115C22905BFA8A623DB6C073DA4F3131543B1D16B7902EF8A5CD850E68B13BDB8A117D6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
32410
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
D:\a\DcRat\DcRat\Binaries\Release\Plugins\SendFile.pdb
mscoree
_CorDllMain
Name
.text
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
820B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/SendFile.pdb
- SHA256 ce3dcdfa7b1ee736e59d7b5d5e59c7bfc56e1fb89cadf8fc1cfcb7178d7d82a8
- MD5 8c6b34363069a46ffab157cda84bf256
- SHA1 ed5e6b5c5b0f94dd2fafeb56f3a570593c53a417
- SHA512 a3bcbae76475c4da446d8deced2e7b5fa884512c67821e404820d6ed3dfeecfbe0595457bc0a096b4cca59c129aea1e518d0cbfe3489c311dc5d22fe85cbc7d6
- SSDEEP 384:zy8cokGQBmhoBQZvX2lKEVbD3oG36wJArCiJMygnhcH:zy8nJZYVvn3lJArTMyXH
- TLSH T14303A004BB40CB73D0268F3CD58EA71D0638FD95BBC3576B2609B5353DB226A2D56358
- MD5 SHA1 SHA512 SSDEEP TLSH
Plugins/SendMemory.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4d543b87f131f652b548c0c8de07cd2eb98516238d3c069705a7b04e34603863
- MD5 e4de758aa5f85c48e3ef226e1d63ae68
- SHA1 f019f207c06aa49da9c4d746f40ef6e2f5dbb540
- SHA512 eb1dfe7e6448347badc5489bdc436d1517706afbb3574de82c86efe4fa0145d3e11067d50b4d806098cc451f4fb432ddeca92aa7cd1011dcd16cf17271d867a0
- SSDEEP 384:ro7mTJ92TmR0EMZadseXGUDfhD0uQ5MZm41SECqDjbAFUYZE5xWfNxTa52pJ5:roiTJ9NOVa9pX1AmYZE5xWl5g2pn
- TLSH T147C23B066F9896A7D76C077DA8E3030443B5D1BB5903DB4B6CD4D0E22B57BF60A60BC6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
34046
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
D:\a\DcRat\DcRat\Binaries\Release\Plugins\SendMemory.pdb
mscoree
_CorDllMain
Name
.text
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/SendMemory.pdb
- SHA256 72b6c3d76728106c1cc931a4998c9d0690934fe481211e664c49fec2f10b2693
- MD5 df4d31acdf86dde26bdfaf5f81210ae5
- SHA1 e0ad6159a6ae0f460bfa2ae56840cd9502401196
- SHA512 8ff2338d22433620dca302b13b05fc27877dd7a635f91512a1c3a507bb7a74d4aa777e1aa277057c750cd9dc3acdfcce0603b7aa5638086da5ee50ae6067c99d
- SSDEEP 384:mcoX0S5qgtCiU+eIt9Eb22Y3xGatbWpVijqKDdSgWt:mqriUJbpY3QaQp3Kh0
- TLSH T18003B104BF90CB72D0368F3CD58EA31D1538FD91BBC3975B2648B1363DB626A1E46258
- MD5 SHA1 SHA512 SSDEEP TLSH
Stub/Client.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 1f2b3f6585659f3f56b13f1ec0e9503b473dd4ebdfa01d54d8b80dd733d05515
- MD5 e3bc58e6db9c6abce5ccf852cbeaa4f1
- SHA1 8b7ea7da95f16fb66eff4e7b454ba7ddd0fb5bad
- SHA512 cd746533b1f06c241ccba6fb38e482581b2f6559a5221990039c88ac271f29ab0fee75af87398d6a4ef35f2e62818be218eaba131e46ffd68bae255a2c2644f5
- SSDEEP 1536:XcSP4c58ocxxHOKNgYLyBefLVj29AVclN:XcSP4c5jcxxHCBefLp296Y
- TLSH T130536C42276BCDF2E1AD16F87DA3410542B3C45710A2DB4B7CC854EDAB2BFCA56122DE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
65254
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
D:\a\DcRat\DcRat\Binaries\Release\Stub\Client.pdb
mscoree
_CorExeMain
Name
.text
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Stub/Client.exe.config
- SHA256 68cbb1295389a1bd6b830debfd0a8bb0a88bee2522304f5894c710912021194c
- MD5 8810b832f11b6e5a1afab929618059f2
- SHA1 5e198d58851231b69595a5800739f06b875cca3d
- SHA512 b7ff97e5be1a9585a53a570445f25070e2124f3a8d8eed760dc062ca41a9828dc7e3a53136faf68673cabedfc8512cc02333ec5556c62050232f9be8e8337b64
- TLSH T1D2C08C5940287D2BDC224F23A260C926FBF43362A424000CE06BAB660A2011E8246356
- MD5 SHA1 SHA512 TLSH
Stub/Client.pdb
- SHA256 4e8162852cc9159f69a48ab20bc6417a34b115586dc66e8b543cbdf7d6a5bb7d
- MD5 d1ec31c120d5c238c889d2fbf8a89458
- SHA1 2647d264e8ce7b1f35a8bd8ffb1f7fe2ac9b3e44
- SHA512 fab72ffdb76c01ed94c89a9423bd0bc2b07e70fc169ce25271a7f41ea859c37f2131e04bec2a3bec27683fe61963a3589faf7dae870f6820fc504f2096ba0cc7
- SSDEEP 768:pK39/IAdGeNabSpINf0qbeczCuNv+uVShBlk/eP:pK17dGiabhOqbe3xuchHk/
- TLSH T1A343D008BB80CA72D0668F3CD59EE74D1639FDA0ABC3976F2149F1392DB235A1D47258
- MD5 SHA1 SHA512 SSDEEP TLSH