Statik Analiz — DCRat | 高 | CVSS: 7.5

文件

SHA256bc790079efa258b16a7860e1ac26ca1d803c3107452cd9c8e0a9d6fceaba24a3
MD57f52fe52dd644fca6b55cd6f91b0515b
文件bc790079efa258b16a7860e1ac26ca1d803c3107452cd9c8e0a9d6fceaba24a3.exe
大小1,011,136 byte
类型PE32+ executable for MS Windows 6.00 (console), x86-64, 8 sections
Stringler2,144
PDB: C:\Users\PC2\Desktop\loader\x64\Release\loader.pdb

Bölümler

AdEntropi
.text6.16
.rdata4.33
.data2.08
.pdata0.0
.rsrc4.7
.reloc1.28
.enigma17.9
.enigma25.43

Import Tablosu

  • kernel32.dll
  • oleaut32.dll
  • user32.dll
  • advapi32.dll
  • ole32.dll
  • ntdll.dll
  • shlwapi.dll

IOC

SHA256bc790079efa258b16a7860e1ac26ca1d803c3107452cd9c8e0a9d6fceaba24a3
MD57f52fe52dd644fca6b55cd6f91b0515b
Domaindigicert.com
PDBC:\Users\PC2\Desktop\loader\x64\Release\loader.pdb
C2digicert.com

DCRat — 恶意软件档案

DCRat Rusça RAT. sostener1.vbs VBScript dropper. PowerShell ExecutionPolicy Bypass. geutqmonpmjthuux.ru DGA C2.

恶意软件类型
RAT
编程语言
C#/.NET
C2协议
HTTP
目标系统
Windows
别名 (AKA)
DarkCrystal

技术细节

.NET C#, AES-128-CBC sifreleme, plugin mimarisi (DLLler), TCP varsayilan port 5552, SQLite lokal depolama, Anti-VM/Sandbox (Process check, Registry), Loader, Stealer, RAT modulleri ayri

能力与行为

Uzaktan Erişim & Kontrol
Keylogger
Ekran Görüntüsü
Webcam Erişimi
Dosya Yönetimi
Süreç Yönetimi
Komut Yürütme
Kalıcılık Mekanizması

IOC列表 (2 个指标)

IOC — DCRat
# DOMAIN digicert.com # FILEPATH C:\Users\PC2\Desktop\loader\x64\Release\loader.pdb
类型值备注
domain digicert.com C2 domain
filepath C:\Users\PC2\Desktop\loader\x64\Release\loader.pdb PDB
DCRat — 查看完整档案 →

C2服务器 (该家族共有 8 台已记录服务器)

地址 类型 端口 协议 状态 国家
microsoft.com domain — TCP active —
digicert.com domain — TCP active —
crypto.io domain — TCP active —
microsoft.com domain — TCP active —
microsoft.com domain — TCP active —
microsoft.com domain — TCP active —
microsoft.com domain — TCP active —
microsoft.com domain — TCP active —

C2 地址仅来自 KEYDAL 团队人工验证的恶意软件样本。禁止用于商业用途。

标签
DCRatmalwarestatik-analizIOC