Malicious
Malicious

2ced3f5e0955d6c2dd2501bf718ad6ee

PE Executable
|
MD5: 2ced3f5e0955d6c2dd2501bf718ad6ee
|
Size: 66.56 KB
|
application/x-dosexec

Print
Infection Chain
Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Very high

Hash
 Hash Value
MD5
2ced3f5e0955d6c2dd2501bf718ad6ee
Sha1
1f214cc92ad79485aee80c4cfb320c84c86b4ea5
Sha256
dc1b0a55ed16d4a92ec2ce20c41a8ce9619a6af17afe54b4eea55a758a7ee6b3
Sha384
bd423fb3a6bc8bba65516cf56d6305163ac99ad94c40a976008cba099765737818384953221c4b52547ac7b6c53be07f
Sha512
c77bad4a9c5b0892ac51749a83962415397e52a47fe085af29b4fb471a20f9ce72a98bafa180fee128c1f7d0ca2775769a96684ed6dff11f038ab7e15778380b
SSDeep
1536:/Ax11tuzi79PbWirMbzi7YBui/ClxSyJ5p493WMx:/Ax114zi75bWirMb27YreJj03Rx
TLSH
1C531B043BE98125F2BE9B74ADF265944AB8F5677906D50E1CC401CA0B32FC69D42BFB

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
2ced3f5e0955d6c2dd2501bf718ad6ee
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Malware Configuration - AsyncRAT config.
Config. Field
 Value
Key (AES_256)

VnFUdWdMZDlyQ0txRHRDd2lFTWdmU1RHVlNWdlBPSVk=
Pastebin

-
Certificate

MIIE8jCCAtqgAwIBAgIQAPeWQ4YJ3MvReCGwLzn7rTANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjIwNDI1MDA0MTA5WhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKT9nYYTjYTZhY+g1tekZ8/F29gsEIDgf/8odvCbCmYKGGZZi2yND9NjtBXEMANM9PAXCyMapGvapDPbWgjYkLiMw/Vwa3kZRg7kLpXMpzInLQufe7Q587viilcsGDoVXmnf51/SwsKPjSysZUpyayezUlJ1j6aXkZGnasiqJ7iKANdSneQducOn6IwaEuJBmpXKWxhhq8R9JMfiWeOXL/hXoE/wCzwzvU/CrzPXd3uMsLfFMDHZJ+OQ9OXKU/CHZNCgSPs4VSgCgM4eK0YTbu1mLsWSo5th3/ingNFaTyYmGsmLIE2Jq5AR1A+xA+FEdC8zKL1bAwYQcRgIJs7QdedtAIufepPZ9D5HiOiy3ITYVonqwTiiIm20en7UICt+J8iDb4M2Q2iLWA7Yi9PN2cr0Xrs8A4/RL29Qe5Ly2k35i74RiBTiT7Jbl2r7PcYlUGcjTCbdB9PWt3dYaTysuamoq2Zuo2HVRhhoZpwnajS9vNcjuZCYVoQvUQBUnHTeRZrtHXU5JV59ZBlu7flZneMZnbrWXTxob6Bdt8+hrGoSDMWBFcO4jRzhT3hEFUpu4lSFeb9T3Vx4KWkHJhHtMvHuYgDTXERdEcI00sOUbVxgd/62LhGXNNommQKCyiAGj0V5uLD73Fyw8vJpm3jXf3NgNt/CjnlaMc40DJ+HlXE5AgMBAAGjMjAwMB0GA1UdDgQWBBQsT2WvtxGUK29SWs4sHz1xYye0fzAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQCK5sVfnYyT5MqnCg3uHV2ojf12fIVFCY02Cc7gy3DVoE6/xZCPjr22V/xZunZ7DG1nt0kOJKDwdQYnGoMc5UPh8jbNRoc1ojLOCaluaIYQyl8AGkmUSRA3Ltk0XetDescffrWT/nKuRvIEYU4Ra+B39f8ouGMCa7VXaxnGJ0z0BkUie8KsDLgNmJ7/kVfIYuRxl+YefoCsUTCogqf0fu3DuRHBpUVaSQQOf9YCbvFWH7Nupc3UIwpH5D8kSdpKusEfbRp8nfWN/Fm+lzF3THeHU6vNJ+5UoAWHYFW8wfJCbzQ/0L8QZeOv4uy74oQP2Ed0RdrWCwUL6SSsDPZdDEOy4K4vVYkDTl1nL5tleATguELAEbbT42oLce85z4C7sKvpEfa4DPbU55xBLwvHniILFfjB7VVsrgVckUL/lEf4Y92uJVKvLGruQt/mtKSqIuJjD8T9y7RIsk6g9624egV5UtLtv+36kLKhgIJlqC7Xx/PVwMc2yw8BiQlvxQZgqSd1k7QmV1AhV/3z2wqnYmb09ibTMYaMFjtamFegeFqc4jRLABhVQFEFv8z5E6G9vgKn5mQDWS/JykARBv9o2BjL/PTADfwAtc1b4nWo0l+CI8IjjYXu/mJOuwR+kFJ19INtwbffQvT9U12t4smpcZV+OK0opk4Yr9r1tZYm92ghXA==
ServerSignature

a2LZXB7kkE0CHHpHeeqZ7/AMP1R/BrtX4xhKMaPNHbTGAMqnlE6ZCoDE9nb91P1fDmRgMIW1TGwUilTSG4g3IBZ3LdzqTZjc6ESM4NAFVAsYiYFKLpM4J3i/iNWt3vl0IDtJQOE1/KFAsR6vobkFyw2CFyxv2NdUej0Ib9ozAjFhmRUrwtUBcbKjNGLS2Y3iDfrZktwP/6Oj3b0WtsScNFP+4da1PLhpLibdLDkHsbSt2N94xATKUgtx5EuPrDjRWTu67MFjkhwF3BxHhZV1+oHXzMXndK7VpMYDyTnL19m/xfMW3sZkUGRD8FdLHs3DYgV1PWGVZHrXu5iX/F1/QXAkFDxMxg91D1/1Rtbyp0dfgdL1GhFC9t0d6t8sA8pIVj3qX2nEdecIpkkp0JAKn8db+I90XGwT3aY4i2dWpFCkNUYFdK3sh6M930us77ANCJU0TJgtAEm9Oq5pQAJk1tBSga8XeOQLazVQNFhCXGGW/f0XOE6edAXfb9aU4gnCVzuRaB0HplAYbcQ/nvozMeFoq6dorVhgFRm5XK3q4nkPH09qoHQNpBVaCQWQ9jn7Hh0t6u7bxf6KlurMKaUAcjjHhYWMna5pPAO1sIIA/ey2Y7j5ATR3ueSiVeWkODs5e3tHgNvKRCDCRS5bVsaqwiTMRE2F1Wnz
Install

false
BDOS

false
Anti-VM

true
Install-Folder

%AppData%
Hosts

proxey.publicvm
Ports

190
Mutex

AsyncMutex_6SI8O
Group

A 12
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

TQFieQTngQ
Full Name

TQFieQTngQ
EntryPoint

System.Void hcIAHOtwkmGtRUn.kucSsdgpQqDx::Main()
Scope Name

TQFieQTngQ
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

190
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

348
Main Method

System.Void hcIAHOtwkmGtRUn.kucSsdgpQqDx::Main()
Main IL Instruction Count

78
Main IL

ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String hcIAHOtwkmGtRUn.burHnDiTfKNg::qSeUiSmmRfL call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean hcIAHOtwkmGtRUn.burHnDiTfKNg::FQQDPYZKnwerZWZ() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean jGPFqUYjaJwch.lfLoJCvuJDzu::rwJTkrOJKWJH() brtrue IL_0043: ldsfld System.String hcIAHOtwkmGtRUn.burHnDiTfKNg::weZeyIQjwUsL ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String hcIAHOtwkmGtRUn.burHnDiTfKNg::weZeyIQjwUsL call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String hcIAHOtwkmGtRUn.burHnDiTfKNg::kZEPTpmFZABt call System.Void jGPFqUYjaJwch.vnCkDHUDtYFTXmMS::tzAGuhLjpoN() ldsfld System.String hcIAHOtwkmGtRUn.burHnDiTfKNg::kZEPTpmFZABt call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String hcIAHOtwkmGtRUn.burHnDiTfKNg::kgXrhnaWxbwoT call System.Void EMfWyycPkKbICb.FWoeryukNCdg::HynDXRWxhmT() ldsfld System.String hcIAHOtwkmGtRUn.burHnDiTfKNg::kgXrhnaWxbwoT call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void jGPFqUYjaJwch.WeaqEPJzsGG::XPjeXRUaAUqb() call System.Boolean jGPFqUYjaJwch.WeaqEPJzsGG::TXdaICvRghWns() brfalse IL_0089: call System.Void jGPFqUYjaJwch.WeaqEPJzsGG::XPjeXRUaAUqb() call System.Void jGPFqUYjaJwch.CSGgrEoaPnJwhin::FgiWklVzsL() call System.Void jGPFqUYjaJwch.WeaqEPJzsGG::XPjeXRUaAUqb() ldnull <null> ldftn System.Void jGPFqUYjaJwch.WeaqEPJzsGG::iydboCqEtuvX() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) callvirt System.Void System.Threading.Thread::Start() ldsfld System.String hcIAHOtwkmGtRUn.burHnDiTfKNg::eAoaXSipsT call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_00C9: ldsfld System.String hcIAHOtwkmGtRUn.burHnDiTfKNg::VACgfSclRMTnen ldnull <null> ldftn System.Void jGPFqUYjaJwch.qcXugivokOGL::JycVKlJCRH() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) callvirt System.Void System.Threading.Thread::Start() ldsfld System.String hcIAHOtwkmGtRUn.burHnDiTfKNg::VACgfSclRMTnen call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0104: leave IL_010F ldsfld System.Threading.ThreadStart hcIAHOtwkmGtRUn.kucSsdgpQqDx/olfsoxlubPU::oJTjdvMjOwv dup <null> brtrue IL_00FA: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) pop <null> ldsfld hcIAHOtwkmGtRUn.kucSsdgpQqDx/olfsoxlubPU hcIAHOtwkmGtRUn.kucSsdgpQqDx/olfsoxlubPU::BPhmvJxxLVdIMOw ldftn System.Void hcIAHOtwkmGtRUn.kucSsdgpQqDx/olfsoxlubPU::<Main>b__1_0() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Threading.ThreadStart hcIAHOtwkmGtRUn.kucSsdgpQqDx/olfsoxlubPU::oJTjdvMjOwv newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) call System.Void System.Threading.Thread::Start() leave IL_010F: nop pop <null> leave IL_010F: nop nop <null> call System.Boolean rtviWcjjCFYCQ.XKvuJFLiLvCv::get_IsConnected() brtrue IL_0124: leave IL_012F call System.Void rtviWcjjCFYCQ.XKvuJFLiLvCv::mNZcQFnLwE() call System.Void rtviWcjjCFYCQ.XKvuJFLiLvCv::ZqLkhGgglcOQkH() leave IL_012F: ldc.i4 5000 pop <null> leave IL_012F: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_010F: nop
Module Name

TQFieQTngQ
Full Name

TQFieQTngQ
EntryPoint

System.Void hcIAHOtwkmGtRUn.kucSsdgpQqDx::Main()
Scope Name

TQFieQTngQ
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

190
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

348
Main Method

System.Void hcIAHOtwkmGtRUn.kucSsdgpQqDx::Main()
Main IL Instruction Count

78
Main IL

ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String hcIAHOtwkmGtRUn.burHnDiTfKNg::qSeUiSmmRfL call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean hcIAHOtwkmGtRUn.burHnDiTfKNg::FQQDPYZKnwerZWZ() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean jGPFqUYjaJwch.lfLoJCvuJDzu::rwJTkrOJKWJH() brtrue IL_0043: ldsfld System.String hcIAHOtwkmGtRUn.burHnDiTfKNg::weZeyIQjwUsL ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String hcIAHOtwkmGtRUn.burHnDiTfKNg::weZeyIQjwUsL call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String hcIAHOtwkmGtRUn.burHnDiTfKNg::kZEPTpmFZABt call System.Void jGPFqUYjaJwch.vnCkDHUDtYFTXmMS::tzAGuhLjpoN() ldsfld System.String hcIAHOtwkmGtRUn.burHnDiTfKNg::kZEPTpmFZABt call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String hcIAHOtwkmGtRUn.burHnDiTfKNg::kgXrhnaWxbwoT call System.Void EMfWyycPkKbICb.FWoeryukNCdg::HynDXRWxhmT() ldsfld System.String hcIAHOtwkmGtRUn.burHnDiTfKNg::kgXrhnaWxbwoT call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void jGPFqUYjaJwch.WeaqEPJzsGG::XPjeXRUaAUqb() call System.Boolean jGPFqUYjaJwch.WeaqEPJzsGG::TXdaICvRghWns() brfalse IL_0089: call System.Void jGPFqUYjaJwch.WeaqEPJzsGG::XPjeXRUaAUqb() call System.Void jGPFqUYjaJwch.CSGgrEoaPnJwhin::FgiWklVzsL() call System.Void jGPFqUYjaJwch.WeaqEPJzsGG::XPjeXRUaAUqb() ldnull <null> ldftn System.Void jGPFqUYjaJwch.WeaqEPJzsGG::iydboCqEtuvX() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) callvirt System.Void System.Threading.Thread::Start() ldsfld System.String hcIAHOtwkmGtRUn.burHnDiTfKNg::eAoaXSipsT call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_00C9: ldsfld System.String hcIAHOtwkmGtRUn.burHnDiTfKNg::VACgfSclRMTnen ldnull <null> ldftn System.Void jGPFqUYjaJwch.qcXugivokOGL::JycVKlJCRH() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) callvirt System.Void System.Threading.Thread::Start() ldsfld System.String hcIAHOtwkmGtRUn.burHnDiTfKNg::VACgfSclRMTnen call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0104: leave IL_010F ldsfld System.Threading.ThreadStart hcIAHOtwkmGtRUn.kucSsdgpQqDx/olfsoxlubPU::oJTjdvMjOwv dup <null> brtrue IL_00FA: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) pop <null> ldsfld hcIAHOtwkmGtRUn.kucSsdgpQqDx/olfsoxlubPU hcIAHOtwkmGtRUn.kucSsdgpQqDx/olfsoxlubPU::BPhmvJxxLVdIMOw ldftn System.Void hcIAHOtwkmGtRUn.kucSsdgpQqDx/olfsoxlubPU::<Main>b__1_0() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Threading.ThreadStart hcIAHOtwkmGtRUn.kucSsdgpQqDx/olfsoxlubPU::oJTjdvMjOwv newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) call System.Void System.Threading.Thread::Start() leave IL_010F: nop pop <null> leave IL_010F: nop nop <null> call System.Boolean rtviWcjjCFYCQ.XKvuJFLiLvCv::get_IsConnected() brtrue IL_0124: leave IL_012F call System.Void rtviWcjjCFYCQ.XKvuJFLiLvCv::mNZcQFnLwE() call System.Void rtviWcjjCFYCQ.XKvuJFLiLvCv::ZqLkhGgglcOQkH() leave IL_012F: ldc.i4 5000 pop <null> leave IL_012F: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_010F: nop
Artefacts
Name
 Value
Key (AES_256)

VnFUdWdMZDlyQ0txRHRDd2lFTWdmU1RHVlNWdlBPSVk=
CnC

proxey.publicvm
Ports

190
Mutex

AsyncMutex_6SI8O
2ced3f5e0955d6c2dd2501bf718ad6ee (66.56 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙