06cc24d1e0c1f80160c791c5969cc44a

PE Executable
|
MD5: 06cc24d1e0c1f80160c791c5969cc44a
|
Size: 49.15 KB
|
application/x-dosexec

Infection Chain

Summary by MalvaGPT

Characteristics

Hash	Hash Value
MD5	06cc24d1e0c1f80160c791c5969cc44a
Sha1	10d3b77e23089b694da5049a517b16abafa5e83d
Sha256	f10b6634e99ff37ec83b9fecbc7cee089c1c82999eff9a6dc4519071e38f8000
Sha384	4e77d81bfd76cd1488ab1286abff1007cf37cf15da7989a0e6073e63c570613391d57bdae8b0e9d897b5795a44834036
Sha512	ba51819bd7f014adf27f08659bcd24ab71e2c683d71a56d22ceb0f0d79ddfc1fb0edeaa40a178b9c3da4cea7275d07790f60b3593332b1e0e4e4c740c504fdd3
SSDeep	768:WuYi9T3kH1jWUvTqRmo2qbWfbGKTmrJydPIhYc00bAxBtT4Ya9AKvVCyBDZpr:WuYi9T34y2bFTmrVhYqbAxB2vyKvxdpr
TLSH	CB233C043BEA812BF27E4F74A9F25245867AB6633603D60E1CC441D75B13FC696826FE

PeID

.NET executable

Microsoft Visual C# / Basic .NET

Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL

Microsoft Visual C# v7.0 / Basic .NET

Microsoft Visual Studio .NET

File Structure

Malware Configuration - AsyncRAT config.

Config. Field0	Value
Key (AES_256)	emd4akdmQ2Y2TVYxVXVia1ZwNUFoQ0NnaGdPbTNpYnk=
Pastebin	-
Certificate	MIIE8jCCAtqgAwIBAgIQAO1NZlMTBmGEdOZgQbCTXTANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjYwNDAxMjMxMDM3WhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAJB3Zd11Tq7XCJnmEiqarWG38oEsssSuNZGx1HLmQH6loJK9JrFRdwwq6peOS4jXhMN8I7GvBB3TxdpuXH/GZt3/cvwdEAv/y/tCSX4NYR8lJ6JBZDbHdiuGq253TUsx2UUbqPKFneWNduCzoNgcLM7pBJvMtEmUBgOWnKqaNSV8G4gA3LtNfP1WOB1Wk+4YI5a3jr4dURQtvkfqfFVrZnFlUhuGtdIydL7/V5eLyFER+Mln/ZOpNraSmhoBR8twrFm0Nj5kpdR3MdWyNaUbyElR8VRObtdRu48R6ScjbAYjT8oajClpAYHrfMv+vUpspKQ+n+Jt34yA+tv13UIT5wFZiI7LDXq39oF+8uQwSGhPn1I5fWvY4bnG+fkMRo70ZgWbI3TwSIZPTnnE7K/d/XwM8EOwJ+QUPzueQJwMepvSvprVNuU2Vm/vHhQBeLhvxLD80795LwG9b44Ytf2AwSkC82tTROOGLZqrLzkW/jXpcDo9I7hwA7+tlcQ+tuqWkPIyUwyoMMJcNfXwfmwK2VCNdKo0QRvIF813b7MJ6+G0tUWA7r7A4NqqiNwwOdQbO4kNkiWSom85UEy66g5A6Gw0XcbJAcKfcbbZgteicd9s6ZuHscCSeJkHniMuJXlNgJ1Ggt7sWNMCWBTyfbC1/MxVnV+bNyXnqM35bjatxX9NAgMBAAGjMjAwMB0GA1UdDgQWBBTSaz2CiPHtQBwLMmOQstTOM4HXqzAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQCIaPHun/YjvxRNIhgJZ12eKXGrpfqfPSE24DNXnPSLwfzwRYno4mD1TgUKi6wIALIxBJsxik+UM7AE+iUrYORX5qinjWWTUggiwTclAnKGclKdlqNAc9WWUtrhtfFRDnsrnoRpRnmYzWKLPucscBEKL15IEJijlegb5ZbpMnr5aiQCWYqlLDYy57UysMRg8b1sKUKfoDAiqTQN7+KEazG49DDC6d1DWfecCNQD3m0TSHdLRgJIlYDpMCZYrY1f9an4ORa0gDRYHt5Y+UI9bJM/SNihiLzvhKhEPbWGCjm+sbeHS8KS+ws41ywM74AuOoEZ/IaxE1ypo9AAoy5DeBmEOkniL+1HQhI7T4VvPwHOedeLLX7P5c8vd9xGs7p5Jky78YO+4JSI358+Z7gY78R/X+GMytoTYbv6HCgJaIl9mNynPwmG4RNxw5eOmxKjyrL9R3F3rLeLB3qqR//QIFA2sZTb4/Ip0kP19KKCvaexp7ZLZ471sEJFw/nE3+TN3ocCcWli3PCFmXZ0nSKtPNMP4GzCmq93TtCrcyiWotUqqIKmNI9YwIOg/EUIHaC8KBp7OcOFfo05BbPJgHj3yM4tobw1x8NNP7fL4VDnwWpjDUGmJfRquO/hjNH+A8kVbnth+Yfl8LgPxDn3cfYgmLw5EAziFrtXv27KvsHkq2b5ZA==
ServerSignature	ERMLvTer8Bu0X8ir9i5g8A0x5vTuaNpv3OTrIjRQCC5Q51RKMIrnJgFQv4Q/K64DkGbafEQ6tTZAvMTcYKgH+Rguo4h5RfR+bQ4zIlUPenIYEdxgxFB8ZfvpWTHrPx/vCkbzq0v3NmkpkE6q8C7rN6E4jgkj9TyA3Z0EH5ZBEFAkNkoJRExnMJ/V8K+nFP/lScQSOMBDwTAtDKww52cAuCvYd/d2F2XitojqX+0NVaEETWAJHqJxP3fRy9d8kfVFC8Yp/BlKuWMu96Xo1IQP3kVE5SMCUOod3yeTHjaEyZcX55nvYgegZBKwlYcyDFfWctHu6xHXnDgnn4t+lqZfluolbNL24jxtnBm5k8fa8+UfVgCFQXL5zztMQAR8bn0f0ujjkGgTcpykIralR83vAiFMrCzLoOu8h52NtiU+W9wQpAUWCmTGPHJANYTemsLhuAfRfR4j8sQrj4P71uldACblfff2j5yA89JgweWzlO/BbY+I5UVMUmLwSvrJ4FY/rnPGd7zvzM4NT6klCB8M3z2uc0q7Ca27Nla/YdnYAUzl2h7UXG/iSoPJrG3Gk6Ni1wcUouPT5M9CQTOlu4eyewPn9B8OdoBgvYMmXSgRPlN1d34wP+Ah3Op9/c1EU5MgyVCL0L2S7NXJSbKnTbi0i6JGqbPPMsOT41QXORwVtKA=
Install	true
BDOS	true
Anti-VM	true
Install File	Edge.exe
Install-Folder	%AppData%
Hosts	bk7pwxz9yt.localto.net
Ports	4444,6606,7707,8610,8808
Mutex	AerMSz0iM6hD
Version	0.5.8
Delay	3
Group	Default

Informations

Name0	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	AhJAyyqSSQOB
Full Name	AhJAyyqSSQOB
EntryPoint	System.Void APkfRfAJDKKLxqglJ.AlSdDYEfsbVH::Main()
Scope Name	AhJAyyqSSQOB
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	AsynaaaasdsadsadsadddddcClient
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	120
Main Method	System.Void APkfRfAJDKKLxqglJ.AlSdDYEfsbVH::Main()
Main IL Instruction Count	51
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String APkfRfAJDKKLxqglJ.FEvCEJggFnX::lamavxEiafwGk call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean APkfRfAJDKKLxqglJ.FEvCEJggFnX::dvQSYcTJcjnxr() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean bmUdgsEvccD.toqBnjfcfCWnZ::PXDypWOOUOOsW() brtrue IL_0043: ldsfld System.String APkfRfAJDKKLxqglJ.FEvCEJggFnX::XVqyByDnYTRC ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String APkfRfAJDKKLxqglJ.FEvCEJggFnX::XVqyByDnYTRC call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String APkfRfAJDKKLxqglJ.FEvCEJggFnX::OwnnGzqFhC call System.Void bmUdgsEvccD.JZQNDyvbvAbiemlEz::ujrJbhKtZYbkYg() ldsfld System.String APkfRfAJDKKLxqglJ.FEvCEJggFnX::OwnnGzqFhC call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String APkfRfAJDKKLxqglJ.FEvCEJggFnX::TIJPMhQnIDBEYn call System.Void QjfVaOizKYWPm.pwJjaQKXbwGjlCepM::gsTbmEhAIysEZ() ldsfld System.String APkfRfAJDKKLxqglJ.FEvCEJggFnX::TIJPMhQnIDBEYn call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void bmUdgsEvccD.WUbVtRjvGRhgW::tThFvSTnisjmasm() call System.Boolean bmUdgsEvccD.WUbVtRjvGRhgW::lNXNRTtPeNB() brfalse IL_0089: call System.Void bmUdgsEvccD.WUbVtRjvGRhgW::tThFvSTnisjmasm() call System.Void bmUdgsEvccD.AHShWJYfPCOQ::rcLBTKKWDmNQxKb() call System.Void bmUdgsEvccD.WUbVtRjvGRhgW::tThFvSTnisjmasm() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean LZqLumJBGmbyU.Tgtlflbxxhho::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void LZqLumJBGmbyU.Tgtlflbxxhho::wbeMWiBdAoHRDh() call System.Void LZqLumJBGmbyU.Tgtlflbxxhho::UvrCcQbokTNv() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Module Name	AhJAyyqSSQOB
Full Name	AhJAyyqSSQOB
EntryPoint	System.Void APkfRfAJDKKLxqglJ.AlSdDYEfsbVH::Main()
Scope Name	AhJAyyqSSQOB
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	AsynaaaasdsadsadsadddddcClient
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	120
Main Method	System.Void APkfRfAJDKKLxqglJ.AlSdDYEfsbVH::Main()
Main IL Instruction Count	51
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String APkfRfAJDKKLxqglJ.FEvCEJggFnX::lamavxEiafwGk call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean APkfRfAJDKKLxqglJ.FEvCEJggFnX::dvQSYcTJcjnxr() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean bmUdgsEvccD.toqBnjfcfCWnZ::PXDypWOOUOOsW() brtrue IL_0043: ldsfld System.String APkfRfAJDKKLxqglJ.FEvCEJggFnX::XVqyByDnYTRC ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String APkfRfAJDKKLxqglJ.FEvCEJggFnX::XVqyByDnYTRC call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String APkfRfAJDKKLxqglJ.FEvCEJggFnX::OwnnGzqFhC call System.Void bmUdgsEvccD.JZQNDyvbvAbiemlEz::ujrJbhKtZYbkYg() ldsfld System.String APkfRfAJDKKLxqglJ.FEvCEJggFnX::OwnnGzqFhC call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String APkfRfAJDKKLxqglJ.FEvCEJggFnX::TIJPMhQnIDBEYn call System.Void QjfVaOizKYWPm.pwJjaQKXbwGjlCepM::gsTbmEhAIysEZ() ldsfld System.String APkfRfAJDKKLxqglJ.FEvCEJggFnX::TIJPMhQnIDBEYn call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void bmUdgsEvccD.WUbVtRjvGRhgW::tThFvSTnisjmasm() call System.Boolean bmUdgsEvccD.WUbVtRjvGRhgW::lNXNRTtPeNB() brfalse IL_0089: call System.Void bmUdgsEvccD.WUbVtRjvGRhgW::tThFvSTnisjmasm() call System.Void bmUdgsEvccD.AHShWJYfPCOQ::rcLBTKKWDmNQxKb() call System.Void bmUdgsEvccD.WUbVtRjvGRhgW::tThFvSTnisjmasm() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean LZqLumJBGmbyU.Tgtlflbxxhho::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void LZqLumJBGmbyU.Tgtlflbxxhho::wbeMWiBdAoHRDh() call System.Void LZqLumJBGmbyU.Tgtlflbxxhho::UvrCcQbokTNv() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop

Artefacts

Name0	Value
Key (AES_256)	emd4akdmQ2Y2TVYxVXVia1ZwNUFoQ0NnaGdPbTNpYnk=
CnC	bk7pwxz9yt.localto.net
Ports	4444
Ports	6606
Ports	7707
Ports	8610
Ports	8808
Mutex	AerMSz0iM6hD

06cc24d1e0c1f80160c791c5969cc44a (49.15 KB)