| Hash / Info | Value |
|---|---|
| SHA256 | 2edbb05408a450babfe1bde6104abe8c2ddf4a6aaa95ff6d3516835b48366b4e |
| MD5 | 2575cac4e7d2f4613c15ccbb7f07589a |
| SHA1 | 97770be3e67be430527e592b9c333215ddc2fd29 |
| File Adi | pythonw.zip |
| File Type | zip |
| Size | 4,374,774 bytes |
| First Seen | 2026-01-28 |
Tehdit Valuelendirmesi
Bu ornek, saldırganlara ele gecirilen sistemler uzerinde tam uzaktan kontrol imkani sunan bir RAT (Uzaktan Erisim Trojanı) olarak tespit edilmistir. Keylogging, ekran goruntüsü alma, dosya yonetimi ve kabuk erisimi gibi kapsamlı gozetleme yeteneklerine sahiptir.
Detected Capabilities
- Uzaktan Erisim
- Keylogging
- Ekran Goruntüsü
- File Yonetimi
- Kabuk Erisimi
MalwareBazaar Tags
Analysis Note
Bu ornek DCRat ailesine ait ve MalwareBazaar platformundan alınmıstır. KEYDAL Guvenlik Arastirmaları tarafından metadata analizi gerceklestirilmis ve IOC veritabanına eklenmistir.
DCRat — Malware Profile
DCRat Rusça RAT. sostener1.vbs VBScript dropper. PowerShell ExecutionPolicy Bypass. geutqmonpmjthuux.ru DGA C2.
Technical Details
.NET C#, AES-128-CBC sifreleme, plugin mimarisi (DLLler), TCP varsayilan port 5552, SQLite lokal depolama, Anti-VM/Sandbox (Process check, Registry), Loader, Stealer, RAT modulleri ayri
Capabilities & Behavior
IOC List (2 indicators)
# SHA256
2edbb05408a450babfe1bde6104abe8c2ddf4a6aaa95ff6d3516835b48366b4e
# MD5
2575cac4e7d2f4613c15ccbb7f07589a
| Type | Value | Note |
|---|---|---|
| sha256 | 2edbb05408a450babfe1bde6104abe8c2ddf4a6aaa95ff6d3516835b48366b4e | |
| md5 | 2575cac4e7d2f4613c15ccbb7f07589a |
C2 Servers (8 recorded servers for this family)
| Address | Type | Port | Protocol | Status | Country |
|---|---|---|---|---|---|
| microsoft.com | domain | — | TCP | active | — |
| digicert.com | domain | — | TCP | active | — |
| crypto.io | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
C2 addresses are provided only from malware samples manually verified by the KEYDAL team. Commercial use is prohibited.