DcRat PE Executable malware analysis – 46727cbc2551

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Low

1 malicious · 3 files

EXE46727cbc255133532210441f03729590DcRat

Structure

BINResources

Config. Field	Value
Key (AES_256)	VEZHSHhuhuhuhuhuhuhuhuhuhuhu
Pastebin	-huhuhuhu
Certificate	MIICMDhuhuhuhuhuhuhuhuhuhuhu
ServerSignature	Pnk7PMhuhuhuhuhuhuhuhuhuhuhu
Install	fhuhuhuhu
BDOS	fhuhuhuhu
Anti-VM	fhuhuhuhu
Install-Folder	%Aphuhuhuhu
Hosts	172.huhuhuhuhuhuhu
Ports	8huhuhuhu
Mutex	DcRatMhuhuhuhuhuhuhu
Version	1huhuhuhu
Delay	1huhuhuhu
Group	Dehuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void Client.Program::Main()
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.0.7.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	150
Main Method	System.Void Client.Program::Main()
Main IL Instruction Count	59
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::De_lay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> ldsfld System.String Client.Settings::An_ti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0047: call System.Boolean Client.Helper.MutexControl::CreateMutex() call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0057: ldsfld System.String Client.Settings::Anti_Process ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti_Process call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BS_OD call System.Void Client.Helper.AntiProcess::StartBlock() ldsfld System.String Client.Settings::BS_OD call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: ldsfld System.String Client.Settings::In_stall call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: ldsfld System.String Client.Settings::In_stall call System.Void Client.Helper.ProcessCritical::Set() ldsfld System.String Client.Settings::In_stall call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_009D: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Install.NormalStartup::Install() call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_00B1: call System.Void Client.Connection.Amsi::Bypass() call System.Void Client.Helper.Methods::ClearSetting() call System.Void Client.Connection.Amsi::Bypass() leave IL_00C1: nop pop <null> leave IL_00C1: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00D6: leave IL_00E1 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00E1: ldc.i4 5000 pop <null> leave IL_00E1: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_00C1: nop
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void Client.Program::Main()
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.0.7.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	150
Main Method	System.Void Client.Program::Main()
Main IL Instruction Count	59
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::De_lay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> ldsfld System.String Client.Settings::An_ti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0047: call System.Boolean Client.Helper.MutexControl::CreateMutex() call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0057: ldsfld System.String Client.Settings::Anti_Process ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti_Process call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BS_OD call System.Void Client.Helper.AntiProcess::StartBlock() ldsfld System.String Client.Settings::BS_OD call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: ldsfld System.String Client.Settings::In_stall call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: ldsfld System.String Client.Settings::In_stall call System.Void Client.Helper.ProcessCritical::Set() ldsfld System.String Client.Settings::In_stall call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_009D: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Install.NormalStartup::Install() call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_00B1: call System.Void Client.Connection.Amsi::Bypass() call System.Void Client.Helper.Methods::ClearSetting() call System.Void Client.Connection.Amsi::Bypass() leave IL_00C1: nop pop <null> leave IL_00C1: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00D6: leave IL_00E1 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00E1: ldc.i4 5000 pop <null> leave IL_00E1: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_00C1: nop

Key (AES_256) MUTEXmalicious

VEZHSHhuhuhuhuhuhuhuhuhuhuhu

CnC CNCmalicious

172.huhuhuhuhuhuhu

Ports PORTmalicious

8huhuhuhu

Mutex MUTEXmalicious

DcRatMhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential