Malicious
Malicious

05fedf4fc7c145a3e8b813dec21df3db

PE Executable
|
MD5: 05fedf4fc7c145a3e8b813dec21df3db
|
Size: 77.82 KB
|
application/x-dosexec

Print
Infection Chain
Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

High

Hash
 Hash Value
MD5
05fedf4fc7c145a3e8b813dec21df3db
Sha1
b8fc7cd4a2492ed187535e12ee1cfc69760e9e1f
Sha256
c328d5317e30eea13b03519f9b46f2cc0c80d08e45b9a83d3df702ac1f1604df
Sha384
a1de36e0dc1df48b36f9abe21eac6f4f2770cc91f85987f81b14ca1b5ae9b7db9c3cd9c99a08a766ce528f3455ef7f03
Sha512
4ac833a9d5a4f9fa2c5852b1a49a207fc7d3b84580c44ed9f756f94a5dbc9a063e6e7eec4ab27c2c36742a8d7a20e645983d5e4fe33e3ca9adc6b743484031ad
SSDeep
1536:h6sYRaSaVr5oJvLEWwNiuKAGXDkIhu+/l2J2:o/Ra/VrWJvsiuB+h92J2
TLSH
EE734C187BDBD536E1AD9A7985E113050379D3173213DB4F2CC8029A4F23BC79F86A9A

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
05fedf4fc7c145a3e8b813dec21df3db
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
b0494a1f-4bd3-sFuO8sRWF2aQfulVj78LmA==
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Client.g.resources
aR3nbf8dQp2feLmk31.lSfgApatkdxsVcGcrktoFd.resources
$this.Icon
[NBF]root.IconData
progressBar1.Modifiers
$this.Language
$this.GridSize
Malware Configuration - AsyncRAT config.
Config. Field
 Value
Key (AES_256)

MGVHZE40U0IySFdIMnVMdmRCWnRBQmdFRTJxV2dGVks=
Pastebin

-
Certificate

MIIE8jCCAtqgAwIBAgIQAKxLlAkF1WRT8tAExBlQyzANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjIwOTIwMTQyNzUwWhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKrrWexesJSLqGeYC6kTxL6e4fbMdbCF6T1opNgSYFlyavRm733h8x2GXmzipr8dl/UHWmWcPmk8g2zwjmE7GxoR1aZvC706J8/1cezY8r/KN3wk63Og1nfs4IBpiAAS1FiZYe5mIVFU4np9SfOmuY/FdcCEd8OUu7UbHl28KhuwIMDKtBn2K/rCw9CIzH/KBD4ll1OszTjzf9NLX5bBhz42/lRQE3fvO2gHrewjgy99RFWXdo4YLOZiJqDSQLBMtVezMBTFgGGNeRMzAnwNFyl5/8h0T2GtcdqGhwOTYTQR+Rsj02iuogScF7rgqwrBr5uYxYrZoI36ewAdl2wN1JklGJRx11puu0hDRzCjrFE0CxXcVtdrIztzChIltYHZBKZyxRiZXGmvpZzPIzjCEO3ChXJTBdYqQP2aOQSBVEliDXuxuBNS11uRB1A/D6TQOAy0TWigbjfniDKBvzeSr3dnQxyjH6srvuGD6DFONwba7CVaKadGrmxreDm8vucoUYpaJ4cjOK+ouqQrG7btjHfDhc4MtgSSwR72/Me97QQ0Uybis0q0/im9hhKxZr6I0jhZglfZ/ouZiTjvPsT38azYeUXVo4uYmcbJ3RPTNVv9xwc3DPkFsMkRmDXCp2UWlGVSb7ZjeRz36kW7fnIiQbN2cG5levzLVAWtOjFwjr3/AgMBAAGjMjAwMB0GA1UdDgQWBBRnnpfEE8/fplVj0LmNEhbg781l4TAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQBYfqUFr9Bld91t6lqV5NrngVezAFI4ZBHTDxhyvkrPQZhVxCvGVhOl5WqtmkUrdkUQbs+BS3rm1BBi2c5F4cC5f02v4lehtsM+EXifLaAU5DCE0WQ+/5CCEBh5VZ5dWoszKSIJFZFzktODyhLHwix/SgNcQ7k4+NtAjb6LTg0rSzcDfttAHcgKTCHpIYxR4FdbEAJ0iwBK1w2oBj/aVm9/nW8mQlzTAIyeEIBcfAL95asjkTOj/MrTElXz09nulfPrVSElidHMHsMXMnn7VZKM5rzhpA/zwV/NGYV6U8f9pF+bwZ1ubJKANo0CbkxCMO6BzMwBj+5pdhVCi9Sl6wg9QyYI5RuICLN03MNGEU0G0tVLkMiE3uzx7/evyrTguZJaAOiTmcSrdoToTCpS7znuLwCRyCNMCu0iUxCxbVE27IRxtOJBtVYqUD2Na8ZjaJQPQ5T+afCaeorSXHPX+/TKaqJqPALKVjNt8D6iYPmUXGZy2ED5YxV+QxFi3kibZe3QmR8MnJJs82mz5Tj0czZoZCnEIhm3bRG2BOSXmtwEC1raIXlgYbxmYr4FGYeUBDPL+sDr38YZ3fW2kRvpxocsUrmzYEbqRr3oLFppdKQIbTFNmdtBXOtEfqj8XcERQ4VA3qtOrDFulsAp7lWtoW6Cw6iCcO/1UWkCk6yC0jqdJA==
ServerSignature

XuSelaIJJ1g8antvbloWhJiJY2ym2zOJOmTLSLYgS/MLNFkp8+XEe6ZfkkFAC+h+BTCyqVtjVy/Qz8tfwHYypRoKoth4o4ltR6E37lm4dN83xQ9yzNbRLPpGKxLRRIzDEQVmFibhiXJmkcLA0wvc7l+nE4NEDIYBYmbwAYnQpuKvR6ej/Pmp/mHzfTtPf9ZQCaD20y6daG8OoTKsndxmngZ23Ur5LZ3c57QAnHfj4MXpR1r0nzOMZn5drftO6v2EMinpOKt0fh780X2gWM/NLXLVurjSMIpHKyFfDmgKMOH1IKmGyqgMRACXOD8wUk+s0XFonVEsEobIlCOJ9HFPdO1C5EndV35iaZdP4MfQKbUoTdcdSDBz6NbS5gHP1Ne5uTGuOjivxYn187EGjIhZj/9LJpDvwBbKStQPjncTwfDRLhJh0JqBzFrX0Hgn7jm+EfIdLastO8VLXWAY1/1jzpbGSXPeFmFNGuTr/lJBvq+xh7hq1nas6vpwK6qDwPAd1dinzZ0QhoE40BlxywXuf0Sxj750lE+nxu7wQl7sDdz9SxjpXF8LNZ7Jydhsy1iBKM4g37E90BeR3I0zYHiCYqd/hbC5GSpvtv8PPgc6fpV9tHK0vlqqupfhaBJ63EdSMe6nsbvB9OmAKJXyNNkGvPPNHmLK5yTx
Install

false
BDOS

false
Anti-VM

false
Install-Folder

%AppData%
Version

0.5.7B
Ports

8050
Mutex

AsyncMutex_6SI8O
Delay

3
Group

RICARDOARZUAGA
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

SERVERRICARDOARZUAGA.exe
Full Name

SERVERRICARDOARZUAGA.exe
EntryPoint

System.Void <PrivateImplementationDetails>{C9D51624-7BE3-4530-BBD7-5A7744545664}::Main()
Scope Name

SERVERRICARDOARZUAGA.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

SERVERRICARDOARZUAGA
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0
Total Strings

135
Main Method

System.Void <PrivateImplementationDetails>{C9D51624-7BE3-4530-BBD7-5A7744545664}::Main()
Main IL Instruction Count

3
Main IL

call System.Void hyBi4B7CHOZ0PcM2da.BrEOWILUFmZ9AtRTw7::lLHifFIsCLsZtjvFfN0i() call System.Void Client.Program::Main() ret <null>
Module Name

SERVERRICARDOARZUAGA.exe
Full Name

SERVERRICARDOARZUAGA.exe
EntryPoint

System.Void <PrivateImplementationDetails>{C9D51624-7BE3-4530-BBD7-5A7744545664}::Main()
Scope Name

SERVERRICARDOARZUAGA.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

SERVERRICARDOARZUAGA
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0
Total Strings

135
Main Method

System.Void <PrivateImplementationDetails>{C9D51624-7BE3-4530-BBD7-5A7744545664}::Main()
Main IL Instruction Count

3
Main IL

call System.Void hyBi4B7CHOZ0PcM2da.BrEOWILUFmZ9AtRTw7::lLHifFIsCLsZtjvFfN0i() call System.Void Client.Program::Main() ret <null>
Artefacts
Name
 Value
Key (AES_256)

MGVHZE40U0IySFdIMnVMdmRCWnRBQmdFRTJxV2dGVks=
Ports

8050
Mutex

AsyncMutex_6SI8O
05fedf4fc7c145a3e8b813dec21df3db (77.82 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙