Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Detection
PeID
.NET executableHQR data fileMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium
1 malicious · 3 files
EXE2a58d36747b57fa2e55ab971a0adbd19AsyncRAT
Structure
Config. Field Value
Key (AES_256) ZHRnVHhuhuhuhuhuhuhuhuhuhuhu
Pastebin -huhuhuhu
Certificate MIIE6jhuhuhuhuhuhuhuhuhuhuhu
ServerSignature Fzkxdkhuhuhuhuhuhuhuhuhuhuhu
Install fhuhuhuhu
BDOS fhuhuhuhu
Anti-VM thuhuhuhu
Install-Folder %Aphuhuhuhu
Hosts 199.huhuhuhuhuhuhu
Ports 9huhuhuhu
Mutex Asynchuhuhuhuhuhuhu
Delay 3huhuhuhu
Group Mahuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
AsyncClient.exe
Full Name
AsyncClient.exe
EntryPoint
System.Void Client.Program::Main()
Scope Name
AsyncClient.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
AsyncClient
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
412
Main Method
System.Void Client.Program::Main()
Main IL Instruction Count
138
Main IL 
br IL_015A: ldc.i4.0
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
br IL_014A: ldloc.s V_0
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldc.i4 1
ldsfld <Module>{263e2194-14bb-430b-b444-bad77bc6a8d4} <Module>{263e2194-14bb-430b-b444-bad77bc6a8d4}::m_afb6c6de882943db841e6dabb2e0be1f
ldfld System.Int32 <Module>{263e2194-14bb-430b-b444-bad77bc6a8d4}::m_264e45a4059d487694a581ad0f05b22f
brfalse IL_0009: switch(IL_014A,IL_0081,IL_0171,IL_0058,IL_0033,IL_0187,IL_0096,IL_013B)
pop <null>
ldc.i4 0
br IL_0009: switch(IL_014A,IL_0081,IL_0171,IL_0058,IL_0033,IL_0187,IL_0096,IL_013B)
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldc.i4 0
ldsfld <Module>{263e2194-14bb-430b-b444-bad77bc6a8d4} <Module>{263e2194-14bb-430b-b444-bad77bc6a8d4}::m_afb6c6de882943db841e6dabb2e0be1f
ldfld System.Int32 <Module>{263e2194-14bb-430b-b444-bad77bc6a8d4}::m_4ec540ae02354d01b83b7902f971aee2
brfalse IL_0009: switch(IL_014A,IL_0081,IL_0171,IL_0058,IL_0033,IL_0187,IL_0096,IL_013B)
pop <null>
ldc.i4 0
br IL_0009: switch(IL_014A,IL_0081,IL_0171,IL_0058,IL_0033,IL_0187,IL_0096,IL_013B)
nop <null>
br IL_0192: nop
br IL_0081: nop
ldc.i4 4
br IL_0009: switch(IL_014A,IL_0081,IL_0171,IL_0058,IL_0033,IL_0187,IL_0096,IL_013B)
nop <null>
call System.Boolean Client.Connection.ClientSocket::get_IsConnected()
brfalse IL_00BC: call System.Void Client.Connection.ClientSocket::Reconnect()
br IL_00EA: br IL_010E
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
br IL_00E0: call System.Void Client.Connection.ClientSocket::InitializeClient()
call System.Void Client.Connection.ClientSocket::Reconnect()
ldc.i4 0
ldsfld <Module>{263e2194-14bb-430b-b444-bad77bc6a8d4} <Module>{263e2194-14bb-430b-b444-bad77bc6a8d4}::m_afb6c6de882943db841e6dabb2e0be1f
ldfld System.Int32 <Module>{263e2194-14bb-430b-b444-bad77bc6a8d4}::m_fb8444e8613d4b65a62366f2f0fc4816
brfalse IL_00AA: switch(IL_00E0,IL_00BC)
pop <null>
ldc.i4 0
br IL_00AA: switch(IL_00E0,IL_00BC)
call System.Void Client.Connection.ClientSocket::InitializeClient()
br IL_010E: leave IL_013B
br IL_010E: leave IL_013B
ldc.i4 0
ldsfld <Module>{263e2194-14bb-430b-b444-bad77bc6a8d4} <Module>{263e2194-14bb-430b-b444-bad77bc6a8d4}::m_afb6c6de882943db841e6dabb2e0be1f
ldfld System.Int32 <Module>{263e2194-14bb-430b-b444-bad77bc6a8d4}::m_db7ac94507fa448cbb34cf8e66def476
brtrue IL_00AA: switch(IL_00E0,IL_00BC)
pop <null>
ldc.i4 1
br IL_00AA: switch(IL_00E0,IL_00BC)
leave IL_013B: ldc.i4 6000
pop <null>
br IL_0119: leave IL_013B
leave IL_013B: ldc.i4 6000
ldc.i4 7
stloc V_2
br IL_0005: ldloc V_2
br IL_0171: ldloc.s V_0
ldc.i4 3
br IL_0009: switch(IL_014A,IL_0081,IL_0171,IL_0058,IL_0033,IL_0187,IL_0096,IL_013B)
ldc.i4 6000
call System.Void System.Threading.Thread::Sleep(System.Int32)
br IL_0285: br IL_0187
ldloc.s V_0
ldc.i4.1 <null>
add <null>
stloc.s V_0
ldc.i4 2
br IL_0009: switch(IL_014A,IL_0081,IL_0171,IL_0058,IL_0033,IL_0187,IL_0096,IL_013B)
ldc.i4.0 <null>
stloc.s V_0
br IL_012C: br IL_0171
call System.Boolean Client.Settings::InitializeSettings()
brfalse IL_0033: ldc.i4.0
br IL_0087: br IL_0081
ldloc.s V_0
ldsfld System.String Client.Settings::Delay
call System.Int32 System.Convert::ToInt32(System.String)
blt IL_0058: ldc.i4 1000
br IL_0162: call System.Boolean Client.Settings::InitializeSettings()
nop <null>
ldc.i4 6
br IL_0009: switch(IL_014A,IL_0081,IL_0171,IL_0058,IL_0033,IL_0187,IL_0096,IL_013B)
nop <null>
call System.Boolean Client.Helper.MutexControl::CreateMutex()
brfalse IL_0257: ldc.i4.0
ldc.i4 0
ldsfld <Module>{263e2194-14bb-430b-b444-bad77bc6a8d4} <Module>{263e2194-14bb-430b-b444-bad77bc6a8d4}::m_afb6c6de882943db841e6dabb2e0be1f
ldfld System.Int32 <Module>{263e2194-14bb-430b-b444-bad77bc6a8d4}::m_4c0b0a2ae20349a9831179708c7193c5
brtrue IL_01C0: switch(IL_0212,IL_023C,IL_01DA,IL_0267)
pop <null>
ldc.i4 0
br IL_01C0: switch(IL_0212,IL_023C,IL_01DA,IL_0267)
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
br IL_0212: br IL_01DA
call System.Void Client.Helper.Methods::PreventSleep()
ldc.i4 1
ldsfld <Module>{263e2194-14bb-430b-b444-bad77bc6a8d4} <Module>{263e2194-14bb-430b-b444-bad77bc6a8d4}::m_afb6c6de882943db841e6dabb2e0be1f
ldfld System.Int32 <Module>{263e2194-14bb-430b-b444-bad77bc6a8d4}::m_8748b7c90ad04046ac3729a983c5ef1c
brtrue IL_01C0: switch(IL_0212,IL_023C,IL_01DA,IL_0267)
pop <null>
ldc.i4 1
br IL_01C0: switch(IL_0212,IL_023C,IL_01DA,IL_0267)
ldsfld System.String Client.Settings::offlineKL
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_0267: leave IL_0187
br IL_021C: ldnull
br IL_01DA: call System.Void Client.Helper.Methods::PreventSleep()
br IL_0257: ldc.i4.0
ldnull <null>
ldftn System.Void Client.Helper.LimeLogger::callk()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
callvirt System.Void System.Threading.Thread::Start()
ldc.i4 3
br IL_01C0: switch(IL_0212,IL_023C,IL_01DA,IL_0267)
ldnull <null>
ldftn System.Void Client.Helper.Methods::LastAct()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
callvirt System.Void System.Threading.Thread::Start()
br IL_01FE: ldsfld System.String Client.Settings::offlineKL
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldc.i4 2
br IL_01C0: switch(IL_0212,IL_023C,IL_01DA,IL_0267)
leave IL_0187: nop
pop <null>
br IL_0272: leave IL_0187
leave IL_0187: nop
ldc.i4 5
stloc V_2
br IL_0005: ldloc V_2
br IL_0187: nop
ret <null>
Module Name
AsyncClient.exe
Full Name
AsyncClient.exe
EntryPoint
System.Void Client.Program::Main()
Scope Name
AsyncClient.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
AsyncClient
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
412
Main Method
System.Void Client.Program::Main()
Main IL Instruction Count
138
Main IL 
br IL_015A: ldc.i4.0
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
br IL_014A: ldloc.s V_0
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldc.i4 1
ldsfld <Module>{263e2194-14bb-430b-b444-bad77bc6a8d4} <Module>{263e2194-14bb-430b-b444-bad77bc6a8d4}::m_afb6c6de882943db841e6dabb2e0be1f
ldfld System.Int32 <Module>{263e2194-14bb-430b-b444-bad77bc6a8d4}::m_264e45a4059d487694a581ad0f05b22f
brfalse IL_0009: switch(IL_014A,IL_0081,IL_0171,IL_0058,IL_0033,IL_0187,IL_0096,IL_013B)
pop <null>
ldc.i4 0
br IL_0009: switch(IL_014A,IL_0081,IL_0171,IL_0058,IL_0033,IL_0187,IL_0096,IL_013B)
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldc.i4 0
ldsfld <Module>{263e2194-14bb-430b-b444-bad77bc6a8d4} <Module>{263e2194-14bb-430b-b444-bad77bc6a8d4}::m_afb6c6de882943db841e6dabb2e0be1f
ldfld System.Int32 <Module>{263e2194-14bb-430b-b444-bad77bc6a8d4}::m_4ec540ae02354d01b83b7902f971aee2
brfalse IL_0009: switch(IL_014A,IL_0081,IL_0171,IL_0058,IL_0033,IL_0187,IL_0096,IL_013B)
pop <null>
ldc.i4 0
br IL_0009: switch(IL_014A,IL_0081,IL_0171,IL_0058,IL_0033,IL_0187,IL_0096,IL_013B)
nop <null>
br IL_0192: nop
br IL_0081: nop
ldc.i4 4
br IL_0009: switch(IL_014A,IL_0081,IL_0171,IL_0058,IL_0033,IL_0187,IL_0096,IL_013B)
nop <null>
call System.Boolean Client.Connection.ClientSocket::get_IsConnected()
brfalse IL_00BC: call System.Void Client.Connection.ClientSocket::Reconnect()
br IL_00EA: br IL_010E
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
br IL_00E0: call System.Void Client.Connection.ClientSocket::InitializeClient()
call System.Void Client.Connection.ClientSocket::Reconnect()
ldc.i4 0
ldsfld <Module>{263e2194-14bb-430b-b444-bad77bc6a8d4} <Module>{263e2194-14bb-430b-b444-bad77bc6a8d4}::m_afb6c6de882943db841e6dabb2e0be1f
ldfld System.Int32 <Module>{263e2194-14bb-430b-b444-bad77bc6a8d4}::m_fb8444e8613d4b65a62366f2f0fc4816
brfalse IL_00AA: switch(IL_00E0,IL_00BC)
pop <null>
ldc.i4 0
br IL_00AA: switch(IL_00E0,IL_00BC)
call System.Void Client.Connection.ClientSocket::InitializeClient()
br IL_010E: leave IL_013B
br IL_010E: leave IL_013B
ldc.i4 0
ldsfld <Module>{263e2194-14bb-430b-b444-bad77bc6a8d4} <Module>{263e2194-14bb-430b-b444-bad77bc6a8d4}::m_afb6c6de882943db841e6dabb2e0be1f
ldfld System.Int32 <Module>{263e2194-14bb-430b-b444-bad77bc6a8d4}::m_db7ac94507fa448cbb34cf8e66def476
brtrue IL_00AA: switch(IL_00E0,IL_00BC)
pop <null>
ldc.i4 1
br IL_00AA: switch(IL_00E0,IL_00BC)
leave IL_013B: ldc.i4 6000
pop <null>
br IL_0119: leave IL_013B
leave IL_013B: ldc.i4 6000
ldc.i4 7
stloc V_2
br IL_0005: ldloc V_2
br IL_0171: ldloc.s V_0
ldc.i4 3
br IL_0009: switch(IL_014A,IL_0081,IL_0171,IL_0058,IL_0033,IL_0187,IL_0096,IL_013B)
ldc.i4 6000
call System.Void System.Threading.Thread::Sleep(System.Int32)
br IL_0285: br IL_0187
ldloc.s V_0
ldc.i4.1 <null>
add <null>
stloc.s V_0
ldc.i4 2
br IL_0009: switch(IL_014A,IL_0081,IL_0171,IL_0058,IL_0033,IL_0187,IL_0096,IL_013B)
ldc.i4.0 <null>
stloc.s V_0
br IL_012C: br IL_0171
call System.Boolean Client.Settings::InitializeSettings()
brfalse IL_0033: ldc.i4.0
br IL_0087: br IL_0081
ldloc.s V_0
ldsfld System.String Client.Settings::Delay
call System.Int32 System.Convert::ToInt32(System.String)
blt IL_0058: ldc.i4 1000
br IL_0162: call System.Boolean Client.Settings::InitializeSettings()
nop <null>
ldc.i4 6
br IL_0009: switch(IL_014A,IL_0081,IL_0171,IL_0058,IL_0033,IL_0187,IL_0096,IL_013B)
nop <null>
call System.Boolean Client.Helper.MutexControl::CreateMutex()
brfalse IL_0257: ldc.i4.0
ldc.i4 0
ldsfld <Module>{263e2194-14bb-430b-b444-bad77bc6a8d4} <Module>{263e2194-14bb-430b-b444-bad77bc6a8d4}::m_afb6c6de882943db841e6dabb2e0be1f
ldfld System.Int32 <Module>{263e2194-14bb-430b-b444-bad77bc6a8d4}::m_4c0b0a2ae20349a9831179708c7193c5
brtrue IL_01C0: switch(IL_0212,IL_023C,IL_01DA,IL_0267)
pop <null>
ldc.i4 0
br IL_01C0: switch(IL_0212,IL_023C,IL_01DA,IL_0267)
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
br IL_0212: br IL_01DA
call System.Void Client.Helper.Methods::PreventSleep()
ldc.i4 1
ldsfld <Module>{263e2194-14bb-430b-b444-bad77bc6a8d4} <Module>{263e2194-14bb-430b-b444-bad77bc6a8d4}::m_afb6c6de882943db841e6dabb2e0be1f
ldfld System.Int32 <Module>{263e2194-14bb-430b-b444-bad77bc6a8d4}::m_8748b7c90ad04046ac3729a983c5ef1c
brtrue IL_01C0: switch(IL_0212,IL_023C,IL_01DA,IL_0267)
pop <null>
ldc.i4 1
br IL_01C0: switch(IL_0212,IL_023C,IL_01DA,IL_0267)
ldsfld System.String Client.Settings::offlineKL
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_0267: leave IL_0187
br IL_021C: ldnull
br IL_01DA: call System.Void Client.Helper.Methods::PreventSleep()
br IL_0257: ldc.i4.0
ldnull <null>
ldftn System.Void Client.Helper.LimeLogger::callk()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
callvirt System.Void System.Threading.Thread::Start()
ldc.i4 3
br IL_01C0: switch(IL_0212,IL_023C,IL_01DA,IL_0267)
ldnull <null>
ldftn System.Void Client.Helper.Methods::LastAct()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
callvirt System.Void System.Threading.Thread::Start()
br IL_01FE: ldsfld System.String Client.Settings::offlineKL
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldc.i4 2
br IL_01C0: switch(IL_0212,IL_023C,IL_01DA,IL_0267)
leave IL_0187: nop
pop <null>
br IL_0272: leave IL_0187
leave IL_0187: nop
ldc.i4 5
stloc V_2
br IL_0005: ldloc V_2
br IL_0187: nop
ret <null>
Key (AES_256) MUTEXmalicious
ZHRnVHhuhuhuhuhuhuhuhuhuhuhu
CnC CNCmalicious
199.huhuhuhuhuhuhu
Ports PORTmalicious
9huhuhuhu
Mutex MUTEXmalicious
Asynchuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙