DCRat | Threat Level: high | Type: RAT

Cryptographic Identifiers

SHA25606a3503b5be3450499323c6764a5edc840bc8df0ea19ad361ccd456770d38c40
MD5f3997426a03ffc9f9874cc23cee7c92d
File Typeexe
Size1732.0 KB
First Seen2026-02-05
File Name06a3503b5be3450499323c6764a5edc840bc8df0ea19ad361ccd456770d38c40
TagsDCRat, exe

Malware Family: DCRat

DCRat, modüler RAT'tır.

TypeRAT
Programming LanguageC#/.NET
Target PlatformWindows
C2 ProtocolHTTP
PurposePlugin tabanlı RAT
First Seen Year2019
AliasesDarkCrystal

Threat Indicators (IOC)

  • SHA256: 06a3503b5be3450499323c6764a5edc840bc8df0ea19ad361ccd456770d38c40
  • MD5: f3997426a03ffc9f9874cc23cee7c92d

System Cleanup Guide

  1. Disconnect the system from the network — unplug ethernet, disable Wi-Fi
  2. Terminate suspicious processes from Task Manager
  3. Run a full system scan with Malwarebytes or Kaspersky
  4. HKCU\Software\Microsoft\Windows\CurrentVersion\Run kayıtlarını kontrol edin
  5. Review newly created tasks in Task Scheduler
  6. Change all your account passwords from a clean device
  7. Gerekirse Windows'u yeniden yükleyin ve verilerinizi temiz bir yedeğe geri alın

YARA Rule Hints

rule DCRat_SHA256 {
    meta:
        description = "DCRat sample: 06a3503b5be34504"
        threat_level = "high"
        first_seen = "2026-02-05"
    condition:
        hash.sha256(0, filesize) == "06a3503b5be3450499323c6764a5edc840bc8df0ea19ad361ccd456770d38c40"
}

DCRat — Malware Profile

DCRat Rusça RAT. sostener1.vbs VBScript dropper. PowerShell ExecutionPolicy Bypass. geutqmonpmjthuux.ru DGA C2.

Malware Type
RAT
Programming Language
C#/.NET
C2 Protocol
HTTP
Target Systems
Windows
Also Known As (AKA)
DarkCrystal

Technical Details

.NET C#, AES-128-CBC sifreleme, plugin mimarisi (DLLler), TCP varsayilan port 5552, SQLite lokal depolama, Anti-VM/Sandbox (Process check, Registry), Loader, Stealer, RAT modulleri ayri

Capabilities & Behavior

Uzaktan Erişim & Kontrol
Keylogger
Ekran Görüntüsü
Webcam Erişimi
Dosya Yönetimi
Süreç Yönetimi
Komut Yürütme
Kalıcılık Mekanizması

IOC List (2 indicators)

IOC — DCRat
# SHA256 06a3503b5be3450499323c6764a5edc840bc8df0ea19ad361ccd456770d38c40 # MD5 f3997426a03ffc9f9874cc23cee7c92d
TypeValueNote
sha256 06a3503b5be3450499323c6764a5edc840bc8df0ea19ad361ccd456770d38c40
md5 f3997426a03ffc9f9874cc23cee7c92d

C2 Servers (8 recorded servers for this family)

Address Type Port Protocol Status Country
microsoft.com domain — TCP active —
digicert.com domain — TCP active —
crypto.io domain — TCP active —
microsoft.com domain — TCP active —
microsoft.com domain — TCP active —
microsoft.com domain — TCP active —
microsoft.com domain — TCP active —
microsoft.com domain — TCP active —

C2 addresses are provided only from malware samples manually verified by the KEYDAL team. Commercial use is prohibited.

Tags
dcratratmalwarehighsha256analizzenginleştirilmiş