Malicious
Malicious

06cc24d1e0c1f80160c791c5969cc44a

PE Executable
|
MD5: 06cc24d1e0c1f80160c791c5969cc44a
|
Size: 49.15 KB
|
application/x-dosexec

Print
Infection Chain
Summary by MalvaGPT
Characteristics

Symbol Obfuscation Score

Very high

Hash
 Hash Value
MD5
06cc24d1e0c1f80160c791c5969cc44a
Sha1
10d3b77e23089b694da5049a517b16abafa5e83d
Sha256
f10b6634e99ff37ec83b9fecbc7cee089c1c82999eff9a6dc4519071e38f8000
Sha384
4e77d81bfd76cd1488ab1286abff1007cf37cf15da7989a0e6073e63c570613391d57bdae8b0e9d897b5795a44834036
Sha512
ba51819bd7f014adf27f08659bcd24ab71e2c683d71a56d22ceb0f0d79ddfc1fb0edeaa40a178b9c3da4cea7275d07790f60b3593332b1e0e4e4c740c504fdd3
SSDeep
768:WuYi9T3kH1jWUvTqRmo2qbWfbGKTmrJydPIhYc00bAxBtT4Ya9AKvVCyBDZpr:WuYi9T34y2bFTmrVhYqbAxB2vyKvxdpr
TLSH
CB233C043BEA812BF27E4F74A9F25245867AB6633603D60E1CC441D75B13FC696826FE

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
06cc24d1e0c1f80160c791c5969cc44a
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Malware Configuration - AsyncRAT config.
Config. Field
 Value
Key (AES_256)

emd4akdmQ2Y2TVYxVXVia1ZwNUFoQ0NnaGdPbTNpYnk=
Pastebin

-
Certificate

MIIE8jCCAtqgAwIBAgIQAO1NZlMTBmGEdOZgQbCTXTANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjYwNDAxMjMxMDM3WhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAJB3Zd11Tq7XCJnmEiqarWG38oEsssSuNZGx1HLmQH6loJK9JrFRdwwq6peOS4jXhMN8I7GvBB3TxdpuXH/GZt3/cvwdEAv/y/tCSX4NYR8lJ6JBZDbHdiuGq253TUsx2UUbqPKFneWNduCzoNgcLM7pBJvMtEmUBgOWnKqaNSV8G4gA3LtNfP1WOB1Wk+4YI5a3jr4dURQtvkfqfFVrZnFlUhuGtdIydL7/V5eLyFER+Mln/ZOpNraSmhoBR8twrFm0Nj5kpdR3MdWyNaUbyElR8VRObtdRu48R6ScjbAYjT8oajClpAYHrfMv+vUpspKQ+n+Jt34yA+tv13UIT5wFZiI7LDXq39oF+8uQwSGhPn1I5fWvY4bnG+fkMRo70ZgWbI3TwSIZPTnnE7K/d/XwM8EOwJ+QUPzueQJwMepvSvprVNuU2Vm/vHhQBeLhvxLD80795LwG9b44Ytf2AwSkC82tTROOGLZqrLzkW/jXpcDo9I7hwA7+tlcQ+tuqWkPIyUwyoMMJcNfXwfmwK2VCNdKo0QRvIF813b7MJ6+G0tUWA7r7A4NqqiNwwOdQbO4kNkiWSom85UEy66g5A6Gw0XcbJAcKfcbbZgteicd9s6ZuHscCSeJkHniMuJXlNgJ1Ggt7sWNMCWBTyfbC1/MxVnV+bNyXnqM35bjatxX9NAgMBAAGjMjAwMB0GA1UdDgQWBBTSaz2CiPHtQBwLMmOQstTOM4HXqzAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQCIaPHun/YjvxRNIhgJZ12eKXGrpfqfPSE24DNXnPSLwfzwRYno4mD1TgUKi6wIALIxBJsxik+UM7AE+iUrYORX5qinjWWTUggiwTclAnKGclKdlqNAc9WWUtrhtfFRDnsrnoRpRnmYzWKLPucscBEKL15IEJijlegb5ZbpMnr5aiQCWYqlLDYy57UysMRg8b1sKUKfoDAiqTQN7+KEazG49DDC6d1DWfecCNQD3m0TSHdLRgJIlYDpMCZYrY1f9an4ORa0gDRYHt5Y+UI9bJM/SNihiLzvhKhEPbWGCjm+sbeHS8KS+ws41ywM74AuOoEZ/IaxE1ypo9AAoy5DeBmEOkniL+1HQhI7T4VvPwHOedeLLX7P5c8vd9xGs7p5Jky78YO+4JSI358+Z7gY78R/X+GMytoTYbv6HCgJaIl9mNynPwmG4RNxw5eOmxKjyrL9R3F3rLeLB3qqR//QIFA2sZTb4/Ip0kP19KKCvaexp7ZLZ471sEJFw/nE3+TN3ocCcWli3PCFmXZ0nSKtPNMP4GzCmq93TtCrcyiWotUqqIKmNI9YwIOg/EUIHaC8KBp7OcOFfo05BbPJgHj3yM4tobw1x8NNP7fL4VDnwWpjDUGmJfRquO/hjNH+A8kVbnth+Yfl8LgPxDn3cfYgmLw5EAziFrtXv27KvsHkq2b5ZA==
ServerSignature

ERMLvTer8Bu0X8ir9i5g8A0x5vTuaNpv3OTrIjRQCC5Q51RKMIrnJgFQv4Q/K64DkGbafEQ6tTZAvMTcYKgH+Rguo4h5RfR+bQ4zIlUPenIYEdxgxFB8ZfvpWTHrPx/vCkbzq0v3NmkpkE6q8C7rN6E4jgkj9TyA3Z0EH5ZBEFAkNkoJRExnMJ/V8K+nFP/lScQSOMBDwTAtDKww52cAuCvYd/d2F2XitojqX+0NVaEETWAJHqJxP3fRy9d8kfVFC8Yp/BlKuWMu96Xo1IQP3kVE5SMCUOod3yeTHjaEyZcX55nvYgegZBKwlYcyDFfWctHu6xHXnDgnn4t+lqZfluolbNL24jxtnBm5k8fa8+UfVgCFQXL5zztMQAR8bn0f0ujjkGgTcpykIralR83vAiFMrCzLoOu8h52NtiU+W9wQpAUWCmTGPHJANYTemsLhuAfRfR4j8sQrj4P71uldACblfff2j5yA89JgweWzlO/BbY+I5UVMUmLwSvrJ4FY/rnPGd7zvzM4NT6klCB8M3z2uc0q7Ca27Nla/YdnYAUzl2h7UXG/iSoPJrG3Gk6Ni1wcUouPT5M9CQTOlu4eyewPn9B8OdoBgvYMmXSgRPlN1d34wP+Ah3Op9/c1EU5MgyVCL0L2S7NXJSbKnTbi0i6JGqbPPMsOT41QXORwVtKA=
Install

true
BDOS

true
Anti-VM

true
Install File

Edge.exe
Install-Folder

%AppData%
Hosts

bk7pwxz9yt.localto.net
Ports

4444,6606,7707,8610,8808
Mutex

AerMSz0iM6hD
Version

0.5.8
Delay

3
Group

Default
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

AhJAyyqSSQOB
Full Name

AhJAyyqSSQOB
EntryPoint

System.Void APkfRfAJDKKLxqglJ.AlSdDYEfsbVH::Main()
Scope Name

AhJAyyqSSQOB
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

AsynaaaasdsadsadsadddddcClient
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

120
Main Method

System.Void APkfRfAJDKKLxqglJ.AlSdDYEfsbVH::Main()
Main IL Instruction Count

51
Main IL

ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String APkfRfAJDKKLxqglJ.FEvCEJggFnX::lamavxEiafwGk call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean APkfRfAJDKKLxqglJ.FEvCEJggFnX::dvQSYcTJcjnxr() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean bmUdgsEvccD.toqBnjfcfCWnZ::PXDypWOOUOOsW() brtrue IL_0043: ldsfld System.String APkfRfAJDKKLxqglJ.FEvCEJggFnX::XVqyByDnYTRC ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String APkfRfAJDKKLxqglJ.FEvCEJggFnX::XVqyByDnYTRC call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String APkfRfAJDKKLxqglJ.FEvCEJggFnX::OwnnGzqFhC call System.Void bmUdgsEvccD.JZQNDyvbvAbiemlEz::ujrJbhKtZYbkYg() ldsfld System.String APkfRfAJDKKLxqglJ.FEvCEJggFnX::OwnnGzqFhC call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String APkfRfAJDKKLxqglJ.FEvCEJggFnX::TIJPMhQnIDBEYn call System.Void QjfVaOizKYWPm.pwJjaQKXbwGjlCepM::gsTbmEhAIysEZ() ldsfld System.String APkfRfAJDKKLxqglJ.FEvCEJggFnX::TIJPMhQnIDBEYn call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void bmUdgsEvccD.WUbVtRjvGRhgW::tThFvSTnisjmasm() call System.Boolean bmUdgsEvccD.WUbVtRjvGRhgW::lNXNRTtPeNB() brfalse IL_0089: call System.Void bmUdgsEvccD.WUbVtRjvGRhgW::tThFvSTnisjmasm() call System.Void bmUdgsEvccD.AHShWJYfPCOQ::rcLBTKKWDmNQxKb() call System.Void bmUdgsEvccD.WUbVtRjvGRhgW::tThFvSTnisjmasm() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean LZqLumJBGmbyU.Tgtlflbxxhho::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void LZqLumJBGmbyU.Tgtlflbxxhho::wbeMWiBdAoHRDh() call System.Void LZqLumJBGmbyU.Tgtlflbxxhho::UvrCcQbokTNv() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Module Name

AhJAyyqSSQOB
Full Name

AhJAyyqSSQOB
EntryPoint

System.Void APkfRfAJDKKLxqglJ.AlSdDYEfsbVH::Main()
Scope Name

AhJAyyqSSQOB
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

AsynaaaasdsadsadsadddddcClient
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

120
Main Method

System.Void APkfRfAJDKKLxqglJ.AlSdDYEfsbVH::Main()
Main IL Instruction Count

51
Main IL

ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String APkfRfAJDKKLxqglJ.FEvCEJggFnX::lamavxEiafwGk call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean APkfRfAJDKKLxqglJ.FEvCEJggFnX::dvQSYcTJcjnxr() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean bmUdgsEvccD.toqBnjfcfCWnZ::PXDypWOOUOOsW() brtrue IL_0043: ldsfld System.String APkfRfAJDKKLxqglJ.FEvCEJggFnX::XVqyByDnYTRC ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String APkfRfAJDKKLxqglJ.FEvCEJggFnX::XVqyByDnYTRC call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String APkfRfAJDKKLxqglJ.FEvCEJggFnX::OwnnGzqFhC call System.Void bmUdgsEvccD.JZQNDyvbvAbiemlEz::ujrJbhKtZYbkYg() ldsfld System.String APkfRfAJDKKLxqglJ.FEvCEJggFnX::OwnnGzqFhC call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String APkfRfAJDKKLxqglJ.FEvCEJggFnX::TIJPMhQnIDBEYn call System.Void QjfVaOizKYWPm.pwJjaQKXbwGjlCepM::gsTbmEhAIysEZ() ldsfld System.String APkfRfAJDKKLxqglJ.FEvCEJggFnX::TIJPMhQnIDBEYn call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void bmUdgsEvccD.WUbVtRjvGRhgW::tThFvSTnisjmasm() call System.Boolean bmUdgsEvccD.WUbVtRjvGRhgW::lNXNRTtPeNB() brfalse IL_0089: call System.Void bmUdgsEvccD.WUbVtRjvGRhgW::tThFvSTnisjmasm() call System.Void bmUdgsEvccD.AHShWJYfPCOQ::rcLBTKKWDmNQxKb() call System.Void bmUdgsEvccD.WUbVtRjvGRhgW::tThFvSTnisjmasm() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean LZqLumJBGmbyU.Tgtlflbxxhho::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void LZqLumJBGmbyU.Tgtlflbxxhho::wbeMWiBdAoHRDh() call System.Void LZqLumJBGmbyU.Tgtlflbxxhho::UvrCcQbokTNv() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Artefacts
Name
 Value
Key (AES_256)

emd4akdmQ2Y2TVYxVXVia1ZwNUFoQ0NnaGdPbTNpYnk=
CnC

bk7pwxz9yt.localto.net
Ports

4444
Ports

6606
Ports

7707
Ports

8610
Ports

8808
Mutex

AerMSz0iM6hD
06cc24d1e0c1f80160c791c5969cc44a (49.15 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙