Managed XDR

libcrypto (DCRat) — malware analysis report

File info

Filename
libcrypto
File type
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size
833 KB
First seen
Last seen

Environment

w10/x64 en

Hashes

SHA1
78060ec310ba0d557bf6c07d7c7c1cc501be7a0b
SHA256
20cfc27a3a9a52cac5cfd6d045820b1b200322f2564c61d9a4fba69f1ed159f6
MD5
7f8c342d6a0154cb15c0e9199842ae0b

Malwares

  • DCRat

Signatures

Other

yara_rules: Static rules
dotnet_suspicious_module_name: Dotnet program has suspicious module name
dotnet_import_unmanaged_code: Dotnet program statically imports unmanaged functions/modules
suspicious_network_port: Performs TCP or UDP request to non-standard port
dotnet_suspicious_entrypoint: Dotnet program has suspicious entrypoint
dotnet_downloader_possible_network_problem: Dotnet program possibly has network problem

Related reports