Skip to main content

DCRat

Malware Family

6 236 indicators of compromise attributed to DCRat across abuse.ch threat intelligence feeds.

Domains

82

IPs

394

URLs

140

Hashes

5 620

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Need continuous updates instead of static lists? The same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&CpayloadPayload Delivery

Sample indicators

IndicatorType
comienzo.ydns.eudomain
velve12.duckdns.orgdomain
id-located-lphone.topdomain
device-findmi.com.trdomain
v2.xoilaczskzxpt.tvdomain
csam.mallukas.comdomain
open88.cheapdomain
open88.kimdomain
open88.reddomain
open888.bizdomain
58win-vi.comdomain
58wincom.shopdomain
fbk.uk.comdomain
m.58wincom.shopdomain
ok8386.autosdomain
marzomarzo20262026.dynuddns.netdomain
smartmultiservice.in.netdomain
w188.cheapdomain
weuy.sa.comdomain
sealllyzo-56611.portmap.hostdomain
104.225.104.237ip
77.91.97.156ip
158.94.208.29ip
128.90.112.237ip
46.246.6.27ip
144.172.88.193ip
91.92.241.80ip
23.94.197.128ip
45.142.30.100ip
172.111.201.220ip
78.17.213.180ip
45.81.115.197ip
23.177.185.166ip
172.111.139.78ip
207.56.7.37ip
192.162.199.143ip
46.246.84.10ip
116.213.43.169ip
94.154.35.114ip
128.90.108.184ip
http://a0993996.xsph.ru/528ed93e.phpurl
http://ck563224.tw1.ru/L1nc0In.phpurl
http://ce768042.tw1.ru/L1nc0In.phpurl
http://51.144.45.141/exe_0707/Client.exeurl
http://cz78587.tw1.ru/843cd6c6.phpurl
http://allanhorca.temp.swtest.ru/1a26e1f6.phpurl
http://a0991129.xsph.ru/63ab30c8.phpurl
http://196.199.55.26:7777/b367c5ea.phpurl
http://cy060322.tw1.ru/L1nc0In.phpurl
http://cj45439.tw1.ru/3464bd73.phpurl
http://cp917571.tw1.ru/L1nc0In.phpurl
http://cz762927.tw1.ru/L1nc0In.phpurl
http://chsk.stayland.space/4d74e561.phpurl
http://cn631389.tw1.ru/L1nc0In.phpurl
http://a1073401.xsph.ru/4e2c0615.phpurl
http://f1232411.xsph.ru/9b6d596f.phpurl
http://a1159717.xsph.ru/34d86416.phpurl
http://a1020713.xsph.ru/313f2d0c.phpurl
http://a1108904.xsph.ru/18369bd4.phpurl
http://ce419619.tw1.ru/L1nc0In.phpurl

Another file to check? Run a file hash reputation check.