Malicious
Malicious

022cba7a01727a82a2f1cf6087e0a16d

PE Executable
|
MD5: 022cba7a01727a82a2f1cf6087e0a16d
|
Size: 46.08 KB
|
application/x-dosexec

Infection Chain
Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Very low

Hash
 Hash Value
MD5
022cba7a01727a82a2f1cf6087e0a16d
Sha1
efb303c9855b71ff1b57047f7f8349b33c7678d7
Sha256
7f14cf5740bb204942ae69690aea4bb17dea9bee17323311a6613c766a716b24
Sha384
0a31e16aa22c68a14ad8b54bb3dd3dba8ecf1d7bf103961af2d65600d4ec1c16b28bc17a3a110be1009f6f353f24ccd5
Sha512
ffea2f85e2b2d31bcf02bddcbf7b11ec273ff86b94a6feb0b9d0f568da705cdf2fdd04bc574bb626ac560058fc5639a7bf59046a252d47e6f8b9978f997af91c
SSDeep
768:pu2M1TwwL/dWUdN+3mo2qzEKjPGaG6PIyzjbFgX3iJ0TgdPE5tEGZwascBDZvx:pu2M1TwQk2tKTkDy3bCXS9Pwvc6dvx
TLSH
45233B003BE8C227F2BE4F749CF26145457AE2A73603DA492CC451DB5613FC69A52AFE

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
022cba7a01727a82a2f1cf6087e0a16d
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Malware Configuration - AsyncRAT config.
Config. Field
 Value
Key (AES_256)

UGl3d1I0WUFDc2lPcWF4cnY1SVZWSlpwN3p0Y1g2TFk=
Ports

37666
Hosts

namit-37666.port
Version

0.5.8
Install

false
Install-Folder

%AppData%
Install File

RtkkAudUService64.exe
Mutex

TbQ6vQi5RpQk
Certificate

MIIE8jCCAtqgAwIBAgIQALcQAqrotTaz9uRKHAbqMTANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjUwNjI5MTMzMDA5WhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAImVNlqwmM9oh8Eds1sSaUbEvqKVVp9KJ387aAP40XK79aassdFC0eWrQ5npBHRzaWehxq3MmsHBXHGRcKYNipzW4D/sHxPfPdrCCn2boXyElGnJhJhSqmnUceTU3FGhMPDsRa9r81dM6FEaOmB6ajEKfZI7VYBQH2dnw+ZqFiMLoRi5oySs6vP50V46fj73Pcxz8EKuod/c+rCDZYGn17GxSzZ9N2BMd4tbVauMTV0D7kLEQ0vhYfvfUQSpo7MZxLN6163i88y0AuNd+PmrNlYBDAerbBNXHfYPEQyME2e7Nxs1axvPUjqzPZ72507a/lHFgX1TgjUZgeKVnNx6RN+GFJtA8zgq0ZpYAe1ef9F1lxguaRfkh2RSU9Ou2AmCB6xATwX/h0WhWoxCluw08umLz12QGk8JPoP2UUNaxsZOOVoKTqmgkUkiMtne5ZIbB9rrKyxj3ksmF/y1rR9oSbcusLi9d9kJAOS+8mOpA0mIiGm6ma3V5mcIQNeZW9fOBaGYSG3v1bTuDLwzRo1ixvlc2gQfDOdQwRdM5qCf6Kaf2CWqrL/+hWvWBostaSbZzBSk2tj499z/ZfxGRwZxnSdVmpUSLkyJcVcKpPflPvGsR3PrtOzW/wwaJwRuH/pkGOTjbx+sxyPoN79gZOneNmGNFnsonKkmHlHAx7v93pvPAgMBAAGjMjAwMB0GA1UdDgQWBBRO9/mi1Dy+wY9y2+Z1e8knUcdX2jAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQAiK64+KD/xRnZ9GS2b47VNxFQZT5AoDLbzhB7zLRtR/+RzPN84cDGSfQprvK5YHiQFYIVbgFZDeBNjkWln8rgcGT6m8m4Nq7R5jtGgzs+nU8qEb89yuVQ1iSOUvXSyfLssEjxaYMUbgUx0bbSuqzSyOCwxDJAjY6R6qbY4MKBm0Lna4nHST2KPnRMfzZirbjoYZ1TZQ17FFFV/b7mQWOdY+/57IqmRqolXtedYyOyt9LBuDZ3iKRaatkVzPsJWkQbcIjemvKt34D/7nCaii3GEObIaYW8t2l+pQRMhM98kMigervVe/VHw+uTCjnULhPfFUI58YtSN4hV4LR6ba20nBHSiTI8gmMDr2DIM0Bqpu8rTq1ql2bbMdlzL2MBj0zQJxkvSaL1esrmpi4s5MKVwiG9QGDrWwjvvdaPmnt7tAWvvBhNVKV7gzAVtbHuLYm8TRBRLCuhTvqsZusRi7dEj6voVjfvytOBVfPyBKRXuS+aLV2s2fW2nSTAyP95ngXIDYY4KLVC2ylV+B06bwBnKLeijHaSE3fioj6oWdrVGYf2Fieflb2GpVZcxDhh7Xyr4kVYhOXiKo2DXkVkLSvYCHW7CSarWvG/il4jFSFPywkVzs25KZXX3Y3FigHQrkdw2wewEbriPnZqtZrMhoJ3YaauUycqxLDdxce2zgmwTMg==
ServerSignature

QmDySI/KC+pXHAPKySyAl8p0xgNpb8lxGkoB01vK9WXRlDrCH5RXxex10LQVkUY8wFybojoohwrAmgNRc8pHAqHLV8x61TmbHu89UpQGIP1KrbJSyiTCc+bw8Ece4Bs1fBzVWDYvNCZHkIqE+VNfFE/s3FqXJG+Nj4BBc4VFwsVMIC/uiCmYoOt03SoaeOzhHWALc0GfACtMVPazhxp75BIqF6b/vAXyaQtwMd2NIwgVM3us2sr9CVO1RCypJsz3jXmGYplDMKO1hi6BC9f3YjfE38OLXAzpT0U/YPqEFHnl3Q78Qu0B6BCPQY/8aBfmh6GDczkTCmuwQDzTVF6UgQNEE3sj7vOG9bac/3kbBagXVmfcu9QOdjfevGeI6w15Cg+aNXUNWcIrwKJOT535/A0ZFzny05ytH4DVCncvPWcQm8SrYcdbNaVtzNJ05HPR6EQgr9ACVh4+LD1s3bitW1J2+g2fm/YgL6zf105JGFmVcNKBgcJk7S74mZamCfB14UuWCyk9juxxOInaBc/ZT+naztJeCWXFfNocDotKC7XBrf+8DpqkXY31eV4x2y/CyUjC0SnrK1TZFxzCtXD0QIzRuFKm5NLiAovW0uPsKj8UQYDTJWOyAc7bY5SsEtMI4yfAojjM42Y0ebTRQAKXLd14zOujRBRF
Anti-VM

true
PasteBin

null
BDOS

true
Delay

3
Group

Default
Informations
Name
 Value
Module Name

AsyncClient.exe
Full Name

AsyncClient.exe
EntryPoint

System.Void Client.Program::Main()
Scope Name

AsyncClient.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

AsyncClient
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

120
Main Method

System.Void Client.Program::Main()
Main IL Instruction Count

51
Main IL

ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0043: ldsfld System.String Client.Settings::Anti ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String Client.Settings::Install call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() ldsfld System.String Client.Settings::Install call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BDOS call System.Void Client.Install.NormalStartup::Install() ldsfld System.String Client.Settings::BDOS call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.ProcessCritical::Set() call System.Void Client.Helper.Methods::PreventSleep() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Module Name

AsyncClient.exe
Full Name

AsyncClient.exe
EntryPoint

System.Void Client.Program::Main()
Scope Name

AsyncClient.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

AsyncClient
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

120
Main Method

System.Void Client.Program::Main()
Main IL Instruction Count

51
Main IL

ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0043: ldsfld System.String Client.Settings::Anti ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String Client.Settings::Install call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() ldsfld System.String Client.Settings::Install call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BDOS call System.Void Client.Install.NormalStartup::Install() ldsfld System.String Client.Settings::BDOS call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.ProcessCritical::Set() call System.Void Client.Helper.Methods::PreventSleep() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Artefacts
Name
 Value
Key (AES_256)

UGl3d1I0WUFDc2lPcWF4cnY1SVZWSlpwN3p0Y1g2TFk=
Ports

37666
CnC

namit-37666.port
Mutex

TbQ6vQi5RpQk
022cba7a01727a82a2f1cf6087e0a16d (46.08 KB)
File Structure
022cba7a01727a82a2f1cf6087e0a16d
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Characteristics
Malware Configuration - AsyncRAT config.
Config. Field
 Value
Key (AES_256)

UGl3d1I0WUFDc2lPcWF4cnY1SVZWSlpwN3p0Y1g2TFk=
Ports

37666
Hosts

namit-37666.port
Version

0.5.8
Install

false
Install-Folder

%AppData%
Install File

RtkkAudUService64.exe
Mutex

TbQ6vQi5RpQk
Certificate

MIIE8jCCAtqgAwIBAgIQALcQAqrotTaz9uRKHAbqMTANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjUwNjI5MTMzMDA5WhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAImVNlqwmM9oh8Eds1sSaUbEvqKVVp9KJ387aAP40XK79aassdFC0eWrQ5npBHRzaWehxq3MmsHBXHGRcKYNipzW4D/sHxPfPdrCCn2boXyElGnJhJhSqmnUceTU3FGhMPDsRa9r81dM6FEaOmB6ajEKfZI7VYBQH2dnw+ZqFiMLoRi5oySs6vP50V46fj73Pcxz8EKuod/c+rCDZYGn17GxSzZ9N2BMd4tbVauMTV0D7kLEQ0vhYfvfUQSpo7MZxLN6163i88y0AuNd+PmrNlYBDAerbBNXHfYPEQyME2e7Nxs1axvPUjqzPZ72507a/lHFgX1TgjUZgeKVnNx6RN+GFJtA8zgq0ZpYAe1ef9F1lxguaRfkh2RSU9Ou2AmCB6xATwX/h0WhWoxCluw08umLz12QGk8JPoP2UUNaxsZOOVoKTqmgkUkiMtne5ZIbB9rrKyxj3ksmF/y1rR9oSbcusLi9d9kJAOS+8mOpA0mIiGm6ma3V5mcIQNeZW9fOBaGYSG3v1bTuDLwzRo1ixvlc2gQfDOdQwRdM5qCf6Kaf2CWqrL/+hWvWBostaSbZzBSk2tj499z/ZfxGRwZxnSdVmpUSLkyJcVcKpPflPvGsR3PrtOzW/wwaJwRuH/pkGOTjbx+sxyPoN79gZOneNmGNFnsonKkmHlHAx7v93pvPAgMBAAGjMjAwMB0GA1UdDgQWBBRO9/mi1Dy+wY9y2+Z1e8knUcdX2jAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQAiK64+KD/xRnZ9GS2b47VNxFQZT5AoDLbzhB7zLRtR/+RzPN84cDGSfQprvK5YHiQFYIVbgFZDeBNjkWln8rgcGT6m8m4Nq7R5jtGgzs+nU8qEb89yuVQ1iSOUvXSyfLssEjxaYMUbgUx0bbSuqzSyOCwxDJAjY6R6qbY4MKBm0Lna4nHST2KPnRMfzZirbjoYZ1TZQ17FFFV/b7mQWOdY+/57IqmRqolXtedYyOyt9LBuDZ3iKRaatkVzPsJWkQbcIjemvKt34D/7nCaii3GEObIaYW8t2l+pQRMhM98kMigervVe/VHw+uTCjnULhPfFUI58YtSN4hV4LR6ba20nBHSiTI8gmMDr2DIM0Bqpu8rTq1ql2bbMdlzL2MBj0zQJxkvSaL1esrmpi4s5MKVwiG9QGDrWwjvvdaPmnt7tAWvvBhNVKV7gzAVtbHuLYm8TRBRLCuhTvqsZusRi7dEj6voVjfvytOBVfPyBKRXuS+aLV2s2fW2nSTAyP95ngXIDYY4KLVC2ylV+B06bwBnKLeijHaSE3fioj6oWdrVGYf2Fieflb2GpVZcxDhh7Xyr4kVYhOXiKo2DXkVkLSvYCHW7CSarWvG/il4jFSFPywkVzs25KZXX3Y3FigHQrkdw2wewEbriPnZqtZrMhoJ3YaauUycqxLDdxce2zgmwTMg==
ServerSignature

QmDySI/KC+pXHAPKySyAl8p0xgNpb8lxGkoB01vK9WXRlDrCH5RXxex10LQVkUY8wFybojoohwrAmgNRc8pHAqHLV8x61TmbHu89UpQGIP1KrbJSyiTCc+bw8Ece4Bs1fBzVWDYvNCZHkIqE+VNfFE/s3FqXJG+Nj4BBc4VFwsVMIC/uiCmYoOt03SoaeOzhHWALc0GfACtMVPazhxp75BIqF6b/vAXyaQtwMd2NIwgVM3us2sr9CVO1RCypJsz3jXmGYplDMKO1hi6BC9f3YjfE38OLXAzpT0U/YPqEFHnl3Q78Qu0B6BCPQY/8aBfmh6GDczkTCmuwQDzTVF6UgQNEE3sj7vOG9bac/3kbBagXVmfcu9QOdjfevGeI6w15Cg+aNXUNWcIrwKJOT535/A0ZFzny05ytH4DVCncvPWcQm8SrYcdbNaVtzNJ05HPR6EQgr9ACVh4+LD1s3bitW1J2+g2fm/YgL6zf105JGFmVcNKBgcJk7S74mZamCfB14UuWCyk9juxxOInaBc/ZT+naztJeCWXFfNocDotKC7XBrf+8DpqkXY31eV4x2y/CyUjC0SnrK1TZFxzCtXD0QIzRuFKm5NLiAovW0uPsKj8UQYDTJWOyAc7bY5SsEtMI4yfAojjM42Y0ebTRQAKXLd14zOujRBRF
Anti-VM

true
PasteBin

null
BDOS

true
Delay

3
Group

Default
Artefacts
Name
 Value Location
Key (AES_256)

UGl3d1I0WUFDc2lPcWF4cnY1SVZWSlpwN3p0Y1g2TFk=

Malicious

022cba7a01727a82a2f1cf6087e0a16d
Ports

37666

Malicious

022cba7a01727a82a2f1cf6087e0a16d
CnC

namit-37666.port

Malicious

022cba7a01727a82a2f1cf6087e0a16d
Mutex

TbQ6vQi5RpQk

Malicious

022cba7a01727a82a2f1cf6087e0a16d
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙