| Hash / Info | Value |
|---|---|
| SHA256 | 0fb6e39dac04676095716c951ed42d5a30441fbbf9483032ddaaf076d0f80003 |
| MD5 | f1a44fb58ab859ac682d67df730f6cf5 |
| SHA1 | d24322e38e9a5be9d38770e3c351422c2a76d522 |
| ImpHash | cc1dab98ba766c8e185d82aa9209af71 |
| File Adi | python311.dll |
| File Type | exe |
| Size | 14,803,968 bytes |
| First Seen | 2026-01-28 |
Tehdit Valuelendirmesi
Bu ornek, saldırganlara ele gecirilen sistemler uzerinde tam uzaktan kontrol imkani sunan bir RAT (Uzaktan Erisim Trojanı) olarak tespit edilmistir. Keylogging, ekran goruntüsü alma, dosya yonetimi ve kabuk erisimi gibi kapsamlı gozetleme yeteneklerine sahiptir.
Detected Capabilities
- Uzaktan Erisim
- Keylogging
- Ekran Goruntüsü
- File Yonetimi
- Kabuk Erisimi
MalwareBazaar Tags
Analysis Note
Bu ornek DCRat ailesine ait ve MalwareBazaar platformundan alınmıstır. KEYDAL Guvenlik Arastirmaları tarafından metadata analizi gerceklestirilmis ve IOC veritabanına eklenmistir.
DCRat — Malware Profile
DCRat Rusça RAT. sostener1.vbs VBScript dropper. PowerShell ExecutionPolicy Bypass. geutqmonpmjthuux.ru DGA C2.
Technical Details
.NET C#, AES-128-CBC sifreleme, plugin mimarisi (DLLler), TCP varsayilan port 5552, SQLite lokal depolama, Anti-VM/Sandbox (Process check, Registry), Loader, Stealer, RAT modulleri ayri
Capabilities & Behavior
IOC List (2 indicators)
# SHA256
0fb6e39dac04676095716c951ed42d5a30441fbbf9483032ddaaf076d0f80003
# MD5
f1a44fb58ab859ac682d67df730f6cf5
| Type | Value | Note |
|---|---|---|
| sha256 | 0fb6e39dac04676095716c951ed42d5a30441fbbf9483032ddaaf076d0f80003 | |
| md5 | f1a44fb58ab859ac682d67df730f6cf5 |
C2 Servers (8 recorded servers for this family)
| Address | Type | Port | Protocol | Status | Country |
|---|---|---|---|---|---|
| microsoft.com | domain | — | TCP | active | — |
| digicert.com | domain | — | TCP | active | — |
| crypto.io | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
C2 addresses are provided only from malware samples manually verified by the KEYDAL team. Commercial use is prohibited.