17f16ce3c2dc504192c7a4947ecdb2cf

PE Executable
|
MD5: 17f16ce3c2dc504192c7a4947ecdb2cf
|
Size: 111.62 KB
|
application/x-dosexec

Infection Chain

Summary by MalvaGPT

Characteristics

Hash	Hash Value
MD5	17f16ce3c2dc504192c7a4947ecdb2cf
Sha1	0442d69ecab27bd7a3f0ef439a7b94e811e80c0b
Sha256	efe6be91b98100385c58e2b22d264c755c677e99be70e578f496e248235b8ad8
Sha384	73efd7c730ecb81ba3b48c4237c69d4b5129d8aa0a41589f244898341c7a904344a9275409fd18c1472667349d821e5b
Sha512	b51907e258bd55ce78858412abe27920be158f4c653036966859de702f27a6091e3b1ede600e01795ef4d757cbd02ec5db201858e22970d1517ff8bd2a296419
SSDeep	3072:Rx8iQ82w4KYPeqKSwIPQkrYwbAQLtMlNpMfVS58mrx:/Q82w4KYPeqKqQ2YwbLGlw0J
TLSH	2EB3C8143EEB4029F17BAF7069D075F689FEB3633603F55A18A542860A13AC1ED83D79

PeID

.NET executable

Microsoft Visual C# / Basic .NET

Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL

Microsoft Visual C# v7.0 / Basic .NET

Microsoft Visual Studio .NET

File Structure

Malware Configuration - AsyncRAT config.

Config. Field0	Value
Key (AES_256)	N2dnZnZueVNQQnJIckdKNlVOT1QyakpnTDlJRWRQbmQ=
Pastebin	-
Certificate	MIIE8jCCAtqgAwIBAgIQAPeWQ4YJ3MvReCGwLzn7rTANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjIwNDI1MDA0MTA5WhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKT9nYYTjYTZhY+g1tekZ8/F29gsEIDgf/8odvCbCmYKGGZZi2yND9NjtBXEMANM9PAXCyMapGvapDPbWgjYkLiMw/Vwa3kZRg7kLpXMpzInLQufe7Q587viilcsGDoVXmnf51/SwsKPjSysZUpyayezUlJ1j6aXkZGnasiqJ7iKANdSneQducOn6IwaEuJBmpXKWxhhq8R9JMfiWeOXL/hXoE/wCzwzvU/CrzPXd3uMsLfFMDHZJ+OQ9OXKU/CHZNCgSPs4VSgCgM4eK0YTbu1mLsWSo5th3/ingNFaTyYmGsmLIE2Jq5AR1A+xA+FEdC8zKL1bAwYQcRgIJs7QdedtAIufepPZ9D5HiOiy3ITYVonqwTiiIm20en7UICt+J8iDb4M2Q2iLWA7Yi9PN2cr0Xrs8A4/RL29Qe5Ly2k35i74RiBTiT7Jbl2r7PcYlUGcjTCbdB9PWt3dYaTysuamoq2Zuo2HVRhhoZpwnajS9vNcjuZCYVoQvUQBUnHTeRZrtHXU5JV59ZBlu7flZneMZnbrWXTxob6Bdt8+hrGoSDMWBFcO4jRzhT3hEFUpu4lSFeb9T3Vx4KWkHJhHtMvHuYgDTXERdEcI00sOUbVxgd/62LhGXNNommQKCyiAGj0V5uLD73Fyw8vJpm3jXf3NgNt/CjnlaMc40DJ+HlXE5AgMBAAGjMjAwMB0GA1UdDgQWBBQsT2WvtxGUK29SWs4sHz1xYye0fzAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQCK5sVfnYyT5MqnCg3uHV2ojf12fIVFCY02Cc7gy3DVoE6/xZCPjr22V/xZunZ7DG1nt0kOJKDwdQYnGoMc5UPh8jbNRoc1ojLOCaluaIYQyl8AGkmUSRA3Ltk0XetDescffrWT/nKuRvIEYU4Ra+B39f8ouGMCa7VXaxnGJ0z0BkUie8KsDLgNmJ7/kVfIYuRxl+YefoCsUTCogqf0fu3DuRHBpUVaSQQOf9YCbvFWH7Nupc3UIwpH5D8kSdpKusEfbRp8nfWN/Fm+lzF3THeHU6vNJ+5UoAWHYFW8wfJCbzQ/0L8QZeOv4uy74oQP2Ed0RdrWCwUL6SSsDPZdDEOy4K4vVYkDTl1nL5tleATguELAEbbT42oLce85z4C7sKvpEfa4DPbU55xBLwvHniILFfjB7VVsrgVckUL/lEf4Y92uJVKvLGruQt/mtKSqIuJjD8T9y7RIsk6g9624egV5UtLtv+36kLKhgIJlqC7Xx/PVwMc2yw8BiQlvxQZgqSd1k7QmV1AhV/3z2wqnYmb09ibTMYaMFjtamFegeFqc4jRLABhVQFEFv8z5E6G9vgKn5mQDWS/JykARBv9o2BjL/PTADfwAtc1b4nWo0l+CI8IjjYXu/mJOuwR+kFJ19INtwbffQvT9U12t4smpcZV+OK0opk4Yr9r1tZYm92ghXA==
ServerSignature	nTkRwl4nbctVhv0tWClZeWjGhkg5xb0V6Rlu71KEGISMLWAU1Tk+YTeT67Ltg72coYKg+StdaiW2btjkqCY2yau5M+MCyUfIScsHMfhEBF9/MZaR5JZimJ3O/lMsgLpIElOx67CuwI7BK2Fk/udNY92dfJq2bmEIMaJ18+4bXP2MLxU1tIs4xgYRMOygabf5tMHfZ2JeJPunzaitU0CDPASbS+s2o+Kr2jiJmISgdkQCDaQA1acuLESYRGURehtfwG952IDlXbRgq3w8XgPvKp3jfYZ9vtXSbNGioIeRLbeM0GGVk76diDkdeLSwILQFYRq62h2NyFBdbuEAfa4uGbsVRD2vE0yKmTvBXPFxl09DiKZW72ebUBCylcDxWIYZY6ZWEc1wQMu9MAeIjPZJrY1aRIDuEMVaIWhuxvjg2DcTLgaUCukZ3d6+fPYpxLdbwEFOcdrnv/D8OpQDiO7Gi0biKq4lBPcexhf7C8hzRKj2J7HfyVzRig8HCj2h7CTeuDJdmpm1eXRfBNOakDrL88Vwqss41rc1LjC+XyQ//aA6iUGuLd8MaFekac7SB+U72uHxL+kvP7+rRoccvqiYPJQPxoUTUPS2BzC+Hiz7Y5b2qZysmIBAozfG0KeobAd6SucgIv4VjHN5SF6QlLrL3ZNOFKdSZqpa
Install	false
BDOS	false
Anti-VM	true
Install-Folder	%AppData%
Ports	3608
Mutex	lipper_
Group	FlowProxy Monito

Informations

Name0	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	JyDBBKycLkbj
Full Name	JyDBBKycLkbj
EntryPoint	System.Void EcmDBsQPVak.BjCQyTmfVJT::Main()
Scope Name	JyDBBKycLkbj
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	3608
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	625
Main Method	System.Void EcmDBsQPVak.BjCQyTmfVJT::Main()
Main IL Instruction Count	81
Main IL	ldc.i4.0 <null> stloc.0 <null> br.s IL_0012: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String EcmDBsQPVak.lQdbJxQZIv::eHYRzJXqfLGp call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0004: ldc.i4 1000 call System.Boolean EcmDBsQPVak.lQdbJxQZIv::HweQLhgamezJ() brtrue.s IL_002C: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean jdGfLGPSpCq.MCBXdPhqrPqkQ::EIygeLIeeGB() brtrue.s IL_003A: ldsfld System.String EcmDBsQPVak.lQdbJxQZIv::LlsReXDMmBbv ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String EcmDBsQPVak.lQdbJxQZIv::LlsReXDMmBbv call System.Boolean System.Convert::ToBoolean(System.String) brfalse.s IL_004B: ldsfld System.String EcmDBsQPVak.lQdbJxQZIv::ByaKZndKQoNyNI call System.Void jdGfLGPSpCq.kBDhHPSDho::bmPPHKTFgVWe() ldsfld System.String EcmDBsQPVak.lQdbJxQZIv::ByaKZndKQoNyNI call System.Boolean System.Convert::ToBoolean(System.String) brfalse.s IL_005C: ldsfld System.String EcmDBsQPVak.lQdbJxQZIv::lnepGRLWLtcd call System.Void EmXdwCblgpIrJT.KvOaSbLdplmG::ICySvsSLHypo() ldsfld System.String EcmDBsQPVak.lQdbJxQZIv::lnepGRLWLtcd call System.Boolean System.Convert::ToBoolean(System.String) brfalse.s IL_0074: call System.Void jdGfLGPSpCq.TpwWgnnCSIwT::NUUuSwyKAP() call System.Boolean jdGfLGPSpCq.TpwWgnnCSIwT::DPsYbBCDNCR() brfalse.s IL_0074: call System.Void jdGfLGPSpCq.TpwWgnnCSIwT::NUUuSwyKAP() call System.Void jdGfLGPSpCq.cBOsNAUSnZu::OnQHlhzpKTXHsA() call System.Void jdGfLGPSpCq.TpwWgnnCSIwT::NUUuSwyKAP() ldnull <null> ldftn System.Void jdGfLGPSpCq.TpwWgnnCSIwT::OkhcqrwKzw() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) callvirt System.Void System.Threading.Thread::Start() ldsfld System.String EcmDBsQPVak.lQdbJxQZIv::lPCZQaLhOdYi call System.Boolean System.Convert::ToBoolean(System.String) brfalse.s IL_00B1: ldsfld System.String EcmDBsQPVak.lQdbJxQZIv::XLXHeCCYfphPQr ldnull <null> ldftn System.Void jdGfLGPSpCq.QLHZuLvpasBAJ::rtDxNzrWHEeTVkt() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) callvirt System.Void System.Threading.Thread::Start() ldsfld System.String EcmDBsQPVak.lQdbJxQZIv::XLXHeCCYfphPQr call System.Boolean System.Convert::ToBoolean(System.String) brfalse.s IL_00ED: leave.s IL_00F2 ldsfld System.Threading.ThreadStart EcmDBsQPVak.BjCQyTmfVJT/lJPVjYCChR::XrpoZXmeLMhrqdV dup <null> brtrue.s IL_00DC: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) pop <null> ldsfld EcmDBsQPVak.BjCQyTmfVJT/lJPVjYCChR EcmDBsQPVak.BjCQyTmfVJT/lJPVjYCChR::pqTosrlgGuWcg ldftn System.Void EcmDBsQPVak.BjCQyTmfVJT/lJPVjYCChR::<Main>b__1_0() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Threading.ThreadStart EcmDBsQPVak.BjCQyTmfVJT/lJPVjYCChR::XrpoZXmeLMhrqdV newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) dup <null> ldc.i4.1 <null> callvirt System.Void System.Threading.Thread::set_IsBackground(System.Boolean) callvirt System.Void System.Threading.Thread::Start() leave.s IL_00F2: nop pop <null> leave.s IL_00F2: nop nop <null> call System.Boolean BKdsccubhyY.RdnLyMGKQqnHoMA::get_IsConnected() brtrue.s IL_0104: leave.s IL_0109 call System.Void BKdsccubhyY.RdnLyMGKQqnHoMA::LwZDVFMtYQMHGZ() call System.Void BKdsccubhyY.RdnLyMGKQqnHoMA::LZfNwuUfpG() leave.s IL_0109: ldc.i4 5000 pop <null> leave.s IL_0109: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_00F2: nop
Module Name	JyDBBKycLkbj
Full Name	JyDBBKycLkbj
EntryPoint	System.Void EcmDBsQPVak.BjCQyTmfVJT::Main()
Scope Name	JyDBBKycLkbj
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	3608
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	625
Main Method	System.Void EcmDBsQPVak.BjCQyTmfVJT::Main()
Main IL Instruction Count	81
Main IL	ldc.i4.0 <null> stloc.0 <null> br.s IL_0012: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String EcmDBsQPVak.lQdbJxQZIv::eHYRzJXqfLGp call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0004: ldc.i4 1000 call System.Boolean EcmDBsQPVak.lQdbJxQZIv::HweQLhgamezJ() brtrue.s IL_002C: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean jdGfLGPSpCq.MCBXdPhqrPqkQ::EIygeLIeeGB() brtrue.s IL_003A: ldsfld System.String EcmDBsQPVak.lQdbJxQZIv::LlsReXDMmBbv ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String EcmDBsQPVak.lQdbJxQZIv::LlsReXDMmBbv call System.Boolean System.Convert::ToBoolean(System.String) brfalse.s IL_004B: ldsfld System.String EcmDBsQPVak.lQdbJxQZIv::ByaKZndKQoNyNI call System.Void jdGfLGPSpCq.kBDhHPSDho::bmPPHKTFgVWe() ldsfld System.String EcmDBsQPVak.lQdbJxQZIv::ByaKZndKQoNyNI call System.Boolean System.Convert::ToBoolean(System.String) brfalse.s IL_005C: ldsfld System.String EcmDBsQPVak.lQdbJxQZIv::lnepGRLWLtcd call System.Void EmXdwCblgpIrJT.KvOaSbLdplmG::ICySvsSLHypo() ldsfld System.String EcmDBsQPVak.lQdbJxQZIv::lnepGRLWLtcd call System.Boolean System.Convert::ToBoolean(System.String) brfalse.s IL_0074: call System.Void jdGfLGPSpCq.TpwWgnnCSIwT::NUUuSwyKAP() call System.Boolean jdGfLGPSpCq.TpwWgnnCSIwT::DPsYbBCDNCR() brfalse.s IL_0074: call System.Void jdGfLGPSpCq.TpwWgnnCSIwT::NUUuSwyKAP() call System.Void jdGfLGPSpCq.cBOsNAUSnZu::OnQHlhzpKTXHsA() call System.Void jdGfLGPSpCq.TpwWgnnCSIwT::NUUuSwyKAP() ldnull <null> ldftn System.Void jdGfLGPSpCq.TpwWgnnCSIwT::OkhcqrwKzw() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) callvirt System.Void System.Threading.Thread::Start() ldsfld System.String EcmDBsQPVak.lQdbJxQZIv::lPCZQaLhOdYi call System.Boolean System.Convert::ToBoolean(System.String) brfalse.s IL_00B1: ldsfld System.String EcmDBsQPVak.lQdbJxQZIv::XLXHeCCYfphPQr ldnull <null> ldftn System.Void jdGfLGPSpCq.QLHZuLvpasBAJ::rtDxNzrWHEeTVkt() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) callvirt System.Void System.Threading.Thread::Start() ldsfld System.String EcmDBsQPVak.lQdbJxQZIv::XLXHeCCYfphPQr call System.Boolean System.Convert::ToBoolean(System.String) brfalse.s IL_00ED: leave.s IL_00F2 ldsfld System.Threading.ThreadStart EcmDBsQPVak.BjCQyTmfVJT/lJPVjYCChR::XrpoZXmeLMhrqdV dup <null> brtrue.s IL_00DC: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) pop <null> ldsfld EcmDBsQPVak.BjCQyTmfVJT/lJPVjYCChR EcmDBsQPVak.BjCQyTmfVJT/lJPVjYCChR::pqTosrlgGuWcg ldftn System.Void EcmDBsQPVak.BjCQyTmfVJT/lJPVjYCChR::<Main>b__1_0() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Threading.ThreadStart EcmDBsQPVak.BjCQyTmfVJT/lJPVjYCChR::XrpoZXmeLMhrqdV newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) dup <null> ldc.i4.1 <null> callvirt System.Void System.Threading.Thread::set_IsBackground(System.Boolean) callvirt System.Void System.Threading.Thread::Start() leave.s IL_00F2: nop pop <null> leave.s IL_00F2: nop nop <null> call System.Boolean BKdsccubhyY.RdnLyMGKQqnHoMA::get_IsConnected() brtrue.s IL_0104: leave.s IL_0109 call System.Void BKdsccubhyY.RdnLyMGKQqnHoMA::LwZDVFMtYQMHGZ() call System.Void BKdsccubhyY.RdnLyMGKQqnHoMA::LZfNwuUfpG() leave.s IL_0109: ldc.i4 5000 pop <null> leave.s IL_0109: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_00F2: nop

Artefacts

Name0	Value
Key (AES_256)	N2dnZnZueVNQQnJIckdKNlVOT1QyakpnTDlJRWRQbmQ=
Ports	3608
Mutex	lipper_

17f16ce3c2dc504192c7a4947ecdb2cf (111.62 KB)