ThreatFox: DCRat IOCs | SOC Hunt Feed

Hunt Hypothesis

DCRat is a remote access Trojan that enables adversaries to exfiltrate sensitive data, establish command-and-control channels, and maintain persistence on compromised hosts. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify and isolate infected endpoints before the malware can fully establish its foothold and escalate privileges.

IOC Summary

Malware Family: DCRat Total IOCs: 6 IOC Types: md5_hash, sha1_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`8931f8386d5fee0947a7e52adf9760a2030e1ab4`	payload	2026-09-07	95%
md5_hash	`fb7afbebc72c93238cbc81bb69c997f9`	payload	2026-09-07	95%
sha256_hash	`79726ccd6ec7ac397288d9cb9ad01ec961fe687f04ebd195cfcd2f336bdd7403`	payload	2026-09-07	95%
sha1_hash	`5ddfabeae2e1976cae639330a26c00ae7f88191a`	payload	2026-09-07	95%
md5_hash	`23e2483bf694f39d708fa972f3e10b25`	payload	2026-09-07	95%
sha256_hash	`feda8e699c00a33f4910a6f664ea8fab031af3324e5b51b4a3cc64a2fa1f8b50`	payload	2026-09-07	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - DCRat
let malicious_hashes = dynamic(["8931f8386d5fee0947a7e52adf9760a2030e1ab4", "fb7afbebc72c93238cbc81bb69c997f9", "79726ccd6ec7ac397288d9cb9ad01ec961fe687f04ebd195cfcd2f336bdd7403", "5ddfabeae2e1976cae639330a26c00ae7f88191a", "23e2483bf694f39d708fa972f3e10b25", "feda8e699c00a33f4910a6f664ea8fab031af3324e5b51b4a3cc64a2fa1f8b50"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — DCRat

False Positive Guidance

Legitimate C2 Frameworks for Red Team Exercises: Security teams or external consultants may use frameworks like Cobalt Strike or Metasploit that utilize beaconing intervals or specific C2 domains similar to DCRat’s known IOCs during authorized penetration tests.
- Filter: Exclude alerts where the source user is a member of the RedTeam or SecurityOps group, or where the destination IP/domain is tagged in the CMDB as PenTest-Approved.
Scheduled Backup and Sync Agents: Enterprise backup solutions such as Veeam, Rubrik, or Acronis often establish persistent outbound connections to cloud storage endpoints or management consoles. If these endpoints share port 443 or specific TLS fingerprints with DCRat C2 channels, they may trigger the rule.
- Filter: Exclude processes named VeeamBackup.exe, rubikd.exe, or acronis_service.exe when communicating with known internal backup subnets (e.g., 10.20.0.0/16) or verified S3/Azure Blob endpoints.
Development and CI/CD Pipeline Agents: Build agents in Jenkins, GitLab CI, or Azure DevOps frequently poll remote repositories or artifact servers. If the agent uses a generic user-agent string or connects to a public IP that overlaps with DCRat’s threat intelligence feeds, it can appear as a beacon.
- Filter: Exclude alerts originating from hosts tagged with Role=CI-CD-Agent or processes matching jenkins-agent.jar, gitlab-runner, or vsts-agent.exe when the destination is a known internal Git server or public artifact registry (e.g., registry.npmjs.org, maven.apache.org).
Remote Support and Monitoring Tools: IT helpdesk