Malicious
Malicious

1795bed320f6fdadb12d9f534642f9bd

Share on LinkedIn
Print
PE Executable
MD5: 1795bed320f6fdadb12d9f534642f9bd
Size: 46.59 KB
application/x-dosexec
Summary by MalvaGPT
Characteristics

Symbol Obfuscation Score

Low

Hash
 Hash Value
MD5
1795bed320f6fdadb12d9f534642f9bd
Sha1
8c4e721cef6dd6c7429cfff626b53f8a01913d75
Sha256
810a6843c287fa601b77fca5300cb501247c13afe5ea9b14834183af0b775ef2
Sha384
2e369be21bc6390365c7f1aa0cd076dab317f92045e77e96fe8d02115e64eca9155aeafcf4e0badb8cfb669e581b8360
Sha512
a03bc332dc858f0c19348c4cf72d5c595ed7d33ca5911cce83c02262732c487bea0e1cbc3ce5eb289d9fd4b4ed0fef252398000318581b7607099d53e97ba91a
SSDeep
768:TuKjXdT9IQzpWUBj2Tmo2qLOw43s+xIPPIUXjbEgX3i1aaeXANs0sbJSBKsSBDZF:TuaXdT93O2RwTMUzbLXSoXAa0+Msd1n
TLSH
1B232B003BEC812BF1BE4F74ACF261454A7AF6633602D65E1CC4519B5723FC69A426FA

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
1795bed320f6fdadb12d9f534642f9bd
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Malware Configuration - AsyncRAT config.
Config. Field
 Value
Key (AES_256)
ZVZ2dmhuhuhuhuhuhuhuhuhuhuhu
Pastebin
-huhuhuhu
Certificate
MIIE5Dhuhuhuhuhuhuhuhuhuhuhu
ServerSignature
iI3CB9huhuhuhuhuhuhuhuhuhuhu
Install
thuhuhuhu
BDOS
fhuhuhuhu
Anti-VM
fhuhuhuhu
Install File
WINWOhuhuhuhuhuhuhu
Install-Folder
%Aphuhuhuhu
Hosts
356gfbhuhuhuhuhuhuhuhuhuhuhu
Ports
80,443huhuhuhuhuhuhu
Mutex
eAnqhuhuhuhu
Version
0huhuhuhu
Delay
3huhuhuhu
Group
Dehuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

Microsoft Word.exe
Full Name

Microsoft Word.exe
EntryPoint

System.Void Client.Program::Main()
Scope Name

Microsoft Word.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Microsoft Word
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

120
Main Method

System.Void Client.Program::Main()
Main IL Instruction Count

51
Main IL

ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0043: ldsfld System.String Client.Settings::Anti ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String Client.Settings::Install call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() ldsfld System.String Client.Settings::Install call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BDOS call System.Void Client.Install.NormalStartup::Install() ldsfld System.String Client.Settings::BDOS call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.ProcessCritical::Set() call System.Void Client.Helper.Methods::PreventSleep() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Module Name

Microsoft Word.exe
Full Name

Microsoft Word.exe
EntryPoint

System.Void Client.Program::Main()
Scope Name

Microsoft Word.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Microsoft Word
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

120
Main Method

System.Void Client.Program::Main()
Main IL Instruction Count

51
Main IL

ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0043: ldsfld System.String Client.Settings::Anti ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String Client.Settings::Install call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() ldsfld System.String Client.Settings::Install call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BDOS call System.Void Client.Install.NormalStartup::Install() ldsfld System.String Client.Settings::BDOS call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.ProcessCritical::Set() call System.Void Client.Helper.Methods::PreventSleep() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Artefacts
Name
 Value
Key (AES_256)
ZVZ2dmhuhuhuhuhuhuhuhuhuhuhu
CnC
356gfhuhuhuhuhuhuhu
CnC
www.35huhuhuhuhuhuhu
CnC
www.huhuhuhuhuhuhu
CnC
elthuhuhuhu
Ports
8huhuhuhu
Ports
4huhuhuhu
Ports
5huhuhuhu
Ports
6huhuhuhu
Ports
8huhuhuhu
Mutex
eAnqhuhuhuhu
Full artefact values (URLs, paths, registry keys…) are available with Essential.
Unlock with Essential
1795bed320f6fdadb12d9f534642f9bd (46.59 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙