Skip to main content

DCRat

Malware Family

6 298 indicators of compromise attributed to DCRat across abuse.ch threat intelligence feeds.

Domains

83

IPs

411

URLs

142

Hashes

5 662

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

For continuous updates, the same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&CpayloadPayload Delivery

Sample indicators

IndicatorType
guaricha.ydns.eudomain
segurityopen12.mysynology.netdomain
id-located-lphone.topdomain
device-supportlost.com.trdomain
lcloud-suportecom.helpdomain
v2.www.dengedenetleme.orgdomain
andryyylostveyna-31915.portmap.hostdomain
v2.xoilaczskzxpt.tvdomain
v3.adept.uk.comdomain
open88.reddomain
slot365.bizdomain
top88-br.comdomain
58win.visiondomain
8xx-online.comdomain
8xxcom.appdomain
3000vps.kozow.comdomain
73bet.appdomain
km-ok365.sitedomain
denidsdneisaas3.dynuddns.comdomain
sealllyzo-56611.portmap.hostdomain
64.89.161.196ip
46.246.6.27ip
172.94.58.29ip
156.247.40.190ip
190.255.93.218ip
120.26.6.141ip
192.159.99.94ip
45.142.30.100ip
61.158.61.134ip
172.111.139.65ip
104.251.181.111ip
104.243.242.50ip
91.219.238.189ip
203.104.42.92ip
194.58.47.81ip
156.247.47.109ip
94.143.143.253ip
118.107.46.204ip
128.241.244.3ip
45.143.200.173ip
http://a1156871.xsph.ru/c693e2aa.phpurl
http://92.119.165.248/L1nc0In.phpurl
http://a1308700.xsph.ru/L1nc0In.phpurl
http://dsfdsfs.xsph.ru/L1nc0In.phpurl
http://a1088739.xsph.ru/9f1b8aa0.phpurl
http://a0916535.xsph.ru/db059622.phpurl
http://a1071976.xsph.ru/0cd6972b.phpurl
http://a0990904.xsph.ru/5a549f96.phpurl
http://a1155181.xsph.ru/0b4a9acb.phpurl
http://a1083054.xsph.ru/267be9dc.phpurl
http://cc011590.tw1.ru/L1nc0In.phpurl
http://a1167511.xsph.ru/c22857bf.phpurl
http://a1033964.xsph.ru/7c157dfb.phpurl
http://ch375962.tw1.ru/L1nc0In.phpurl
http://a1073401.xsph.ru/4e2c0615.phpurl
http://62.109.7.0/PrivateTemporary.phpurl
http://f1232411.xsph.ru/9b6d596f.phpurl
http://f1070307.xsph.ru/3b39b74d.phpurl
http://cf396743.tw1.ru/L1nc0In.phpurl
http://a0571516.xsph.ru/PythonsecureProcessorgeneratoruniversal.phpurl

Another file to check? Run a file hash reputation check.