Malicious
Malicious

3ca6f28a065b40611f4816b903cf4068

PE Executable
|
MD5: 3ca6f28a065b40611f4816b903cf4068
|
Size: 52.74 KB
|
application/x-dosexec

Print
Infection Chain
Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Low

Hash
 Hash Value
MD5
3ca6f28a065b40611f4816b903cf4068
Sha1
bef251a4f3ff73cdd5e0395449693af7db083b34
Sha256
8b86d2f55c16f1d885f99daf36ee1aa91f9a07dd0881eadaea451f9036d411d6
Sha384
f06a6404b8153887a3cbd2a0861efdabae940087e1696959627c9c301848ec588004cb6c84a8f78cd0c1fae528e58dc1
Sha512
bf757953395e480bccea39f77362f60d8888d58e5bff0b5af7e0d33004529479836f4f6dc83479da6b6f2e95db4ec0f2c2d173aece19fb037ab47fdea66060db
SSDeep
1536:Qu/ptTvP42CmCgDX3btXQHzZEOBljdiHox3:Qu/XTvP42C1gDX3btmzZRgA3
TLSH
CB333B103BE8C12BF2BE4F7498F26245867AF1637603D64D5CC4419B5A13FC69A42AFE

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
3ca6f28a065b40611f4816b903cf4068
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0-preview.png
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Malware Configuration - AsyncRAT config.
Config. Field
 Value
Key (AES_256)

VlFSeHFkZWRpWFVPZ0tvMGVCYkZOYjh5NGJ1WmhLbVA=
Pastebin

-
Certificate

MIIE5DCCAsygAwIBAgIQAOc250/jBXH7PusRfV4KKzANBgkqhkiG9w0BAQ0FADATMREwDwYDVQQDDAhBc3luY1JBVDAgFw0yNTEyMTQxNTM0MjFaGA85OTk5MTIzMTIzNTk1OVowEzERMA8GA1UEAwwIQXN5bmNSQVQwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC3hbrOJGE/Ncxr2hD4zwR5WwrlT40PQHZSYRdpnqR2/7/cw8e4m6IS/kPj2TSnF3yYhOkR08loqxZDE8g9vaF8pLg+pyFwXjs8+Tjb6rGW2uRjpX92Pyhjh8LBpkQ8ZVWmHgnrg6rG0F60rBKz4ew8WXbKcUo3Q+oz/td4gqFQDlhw1kKoLeUmr+9QKyInnm/2UOlpU4DY3Vpgw9RKXcNYyUemiFybYORXhX5itphsOy7VNGbmDGcokwXemsR8Dxtx/fxqxdTSIJt2+bnMbPPCL05l7xkOyVQMnLIGcsDBoQXotDfeKlpluqyut2YjHGluh/uIUb/c37ZW17RCI+CtrNRGQjB8ErSBSWGtlxKh6a7DtgUD3Ixy87tueEKyeiHIjKNGM2DeeYpPp94vQ1L9omOqV6XBPRIlE8dZG2wIEh9U7nAbyILI5CsDNK3ZKIo9rFYVDCqRpjSpDW6EE3X+megquYTgBmYwz0wc3Nm7DyXpYWw9M6ubgwJOY4IuNEV3JNHsxHdX457CHJ1B3pvyDSRoD4GGQWzFrod/rSdbc6h0Znk520NtZ7qkP+AA3KumXQoREuIENMqFyEeb4jAL/o+NLZJ2s25y37AhIULalSXUWRpFFN4afCogVBX2Lq5fTnARunBy+iM0cTCITKg1PzdagOzpIYZ1301QYewT1wIDAQABozIwMDAdBgNVHQ4EFgQUwIO7jdsbGYhuyUURLCnL8u8aCiswDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQ0FAAOCAgEAPXoIXK5CvTxz3g1MuFheFwcA6CSzDoKFPW4zVdDtZTjVtAd9wnPaH7HpQXLwpPUb3WM8iEX/zgdze8q36+IWIv7LOpMKCDr3+dyeR5dyuSF0HNggANxw64nb8ggfquNYXofQDR8B2fp/c1iXT3NQcZ4CsM37nMLyvKC7n2hWWArrhshFMKZ/AnT+3r996JaT0BopXowQsSIzBNFez3KrBQ2fKj8HuJPZ3VJKnAH+sUBvTup/5qk5+aijalDJU/APvTFLKBom0ifAqZoYgwI/B9H0mEO7qYXokEVtEPX9LS41ALFQl/naWldHpnhmMgpN3Y30HgI+CJIyUxR9k7f0AIYXdGHdXeqc+MhZa25H+ESwSwI7N7FMyxkdzkikWAXIYoKK3o1mdb9+0s1/CstbjWs8QAzUYmZTb1vUAg9tUMhL2LqaWlpnzOOXdQUhRqk1JuYoBAvlesZ5qsgrZxzaQtDZ7hq6oWsqdDScXGUt7SrPvtXFjFXHjdCrfVHISH0RcEsmaSSV6+cjvcSZe3gb/t5lfjmaDMgWvlIHtKONjneUbCKzoYY2OHU/gy4DkWdt4q8SX1a0jLYXkYr7KPKFaDR/oc85PRUsCKg/vhCtRIbTAJ1CCf0RCk61CuONfs18uIvo08JwHJgWVwN/1lq94mdsEzo1SPA5mE4FFr/APuY=
ServerSignature

ak7gUcGf2VDI5yJ+XHJjQgiK2TdpuqO/nATMsjBipRhdwaz34kOQTqxiI+3VM5pF74rHDzixsAwKxvomFR8/kyMKnEymgxGoemDSBrbQAYM46g42OT9Q2vazs0QUHwM/oN4RM5m/zaBefYW/Ti9i6hZr4vS6WW0iyFU+KttrX/MX3827/nLfOPIYQLB53FkoqfpnRqL4NHO9NWCNiHIoFIkV5CN/RR7UxW9jQoPjLdFVHIRKhRVzeGk8LbXf/j1U2kGPvFZz1DX7ZPOw2YHP5Nlm2eecU1oepZZ86OF8DYWAnzUEmUHJ6PZsS6PpH+Uh8yE2qbbxh1rA08gHq9qCPvhuD5E2ZWVKnkDK9oI9vRO5KJ1mlgbxZu0Dkh2XSUJDRsZGNHsLK9N8oRrDGEUM4Rk6wjerqODKgWRPRI8qOXdD58wiezXbad5KDX7cjQvS4OJI/4WlRd40ruYntxdVJu2ZGZJEUj7OBTTM0IjcdVXtu7xDW3gvtAbnenT9EoOfqpJyAU7GRDjaG4qbqzngZS716b7mTpucYOctwo4uBeZasCfBk8gSGbyocZi3QuplmF1AP2UviSPfXypS+wBztuAu/rz3ITxuBirdapJckjHoN80VTyfqsIrnX7AJRQv5QzIvWuPhMM3wdW30+IlwHnN9oza8mb464UIytnZinbo=
Install

true
BDOS

false
Anti-VM

false
Install File

GoogleMeet.exe
Install-Folder

%AppData%
Hosts

jdzvdi.sa.com,www.jdzvdi.sa.com,titth.za.com,www.titth.za.com,granitfliesen.de.com,www.granitfliesen.de.com,2co7rrv.uk.com,www.2co7rrv.uk.com,2c48hup.uk.com,www.2c48hup.uk.com,mb66znet.com,www.mb66znet.com,shbet-casino.co,www.shbet-casino.co,sc88top1.com,www.sc88top1.com,78win.ru.com,www.78win.ru.com,78win.it.com,www.78win.it.com,zqqhyp.sa.com,www.zqqhyp.sa.com
Ports

80,443,1337,1604,4444,5555,6606,7707,8080,8808
Mutex

OLC6dNMHfgH3
Version

0.5.8
Delay

3
Group

Meet
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

Google Meet.exe
Full Name

Google Meet.exe
EntryPoint

System.Void Client.Program::Main()
Scope Name

Google Meet.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Google Meet
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

120
Main Method

System.Void Client.Program::Main()
Main IL Instruction Count

51
Main IL

ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0043: ldsfld System.String Client.Settings::Anti ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String Client.Settings::Install call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() ldsfld System.String Client.Settings::Install call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BDOS call System.Void Client.Install.NormalStartup::Install() ldsfld System.String Client.Settings::BDOS call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.ProcessCritical::Set() call System.Void Client.Helper.Methods::PreventSleep() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Module Name

Google Meet.exe
Full Name

Google Meet.exe
EntryPoint

System.Void Client.Program::Main()
Scope Name

Google Meet.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Google Meet
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

120
Main Method

System.Void Client.Program::Main()
Main IL Instruction Count

51
Main IL

ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0043: ldsfld System.String Client.Settings::Anti ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String Client.Settings::Install call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() ldsfld System.String Client.Settings::Install call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BDOS call System.Void Client.Install.NormalStartup::Install() ldsfld System.String Client.Settings::BDOS call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.ProcessCritical::Set() call System.Void Client.Helper.Methods::PreventSleep() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Artefacts
Name
 Value
Key (AES_256)

VlFSeHFkZWRpWFVPZ0tvMGVCYkZOYjh5NGJ1WmhLbVA=
CnC

jdzvdi.sa.com
CnC

www.jdzvdi.sa.com
CnC

titth.za.com
CnC

www.titth.za.com
CnC

granitfliesen.de.com
CnC

www.granitfliesen.de.com
CnC

2co7rrv.uk.com
CnC

www.2co7rrv.uk.com
CnC

2c48hup.uk.com
CnC

www.2c48hup.uk.com
CnC

mb66znet.com
CnC

www.mb66znet.com
CnC

shbet-casino.co
CnC

www.shbet-casino.co
CnC

sc88top1.com
CnC

www.sc88top1.com
CnC

78win.ru.com
CnC

www.78win.ru.com
CnC

78win.it.com
CnC

www.78win.it.com
CnC

zqqhyp.sa.com
CnC

www.zqqhyp.sa.com
Ports

80
Ports

443
Ports

1337
Ports

1604
Ports

4444
Ports

5555
Ports

6606
Ports

7707
Ports

8080
Ports

8808
Mutex

OLC6dNMHfgH3
3ca6f28a065b40611f4816b903cf4068 (52.74 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙