Malicious
Malicious

420933fabb4eef2301ea124f340ae00a

PE Executable
|
MD5: 420933fabb4eef2301ea124f340ae00a
|
Size: 47.62 KB
|
application/x-dosexec

Infection Chain
Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Low

Hash
 Hash Value
MD5
420933fabb4eef2301ea124f340ae00a
Sha1
4f9b6a022b6a0a16138ffce071db7f132cee07ac
Sha256
9eb860092c1118646f715bf5bacbf38c3053450fd601cc1f8a03e54b21b1d001
Sha384
4bc048dca9869aae2260f3c05be4c6a8d8bd75ebfe7fb923738884932644d995bbaf97fcd744d4010ac88fa1abbb60a2
Sha512
f3a39ae2924ec1dce0f4b027a29651b744391446c9ee709bf6a0980d7b53397f2840ae943ce14cd3752b6d9abe3e92b75591d658d8cf9d65a05154461dbedcfc
SSDeep
768:EulxJTHscwgWUKcCGmo2q9O10G4hBYapPIqzjbmgX3U65tjWOMNwQSTBDZOu:EulxJTHvZ2n0zWaGq3b5XkoWw/dOu
TLSH
7E232B003BE8C12BF2BE5F7898F26145867AF5677603DA4D1CC4419B1623BC69A427FE

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
420933fabb4eef2301ea124f340ae00a
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Malware Configuration - AsyncRAT config.
Config. Field
 Value
Key (AES_256)

QUpqTzhGd2N0d0Mxb2Y3STA3NldIN3F1SXV0WkdqVGc=
Pastebin

-
Certificate

MIIE8jCCAtqgAwIBAgIQALhpP6c/lzBhRfZpd/rs2zANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjYwMTMwMDQzODAzWhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKIXD0Dv5Bsd/QexWDu0KiHP9ZuMblxtyUrTYALFekyu8Besq6HKRKss35Eqn05SaYRBJNVJK7SD0Aw1WUCZNtc+RUdOaRx32SgkErBVhtDs0VBKkxnLnQECgtRB6Gd5kfuOtFUwjyabj5YW0ExLyVvUWP52brx4VOM07VJnDmlX4fqFWD4MsGZeAGMfjrcZXcWC7libLGWOzacclrx5QCpS25uh5aMi7d+9KYFuPB9orrOWtbMgZ5WJJTQipj0fUi3EMEm49mmPt45B0MJFvSXG+PDxznx/bGZ2r4Keiq22oNv+8X/jKm6azhWzx3h9ppYD46eY9f2ySdgrN4VvU7DWmLPK+Clr2CQhS3usdy9WnNCikho5DM9kpOp3UgDGmibp7z3UvlPuyGJkUI81zSkX/z4QNT81q9SnlxqDGRbTK+sRwkceUO6zB7+n8M3hfw5FNuTMHOjnX9/nvBCu6fA84hxebGTneBIvXHc+eK1EE3Zyv0FcbaO1JBHHUMMUp/ufOw73fGW4lK919MQefppnOuQuXTTG49t5Axmvr3Jw7QIQ4qzNEH/De84q/lbM8y3c+ZLb06UjHdODU6DEv+emhKaQUfACMQivyUrmiiXNOjNP+P+crtptNbZceEeaGH6YDe6RfyDdKqoDsF/YKeMD7AyA68m6CuicrAnZWDYvAgMBAAGjMjAwMB0GA1UdDgQWBBSyND31q3J7dL9g3kls6PzKaTC+ojAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQBzPb5yU6MyIpsnhT4wFupaxc5crhgLCtIyhKynGXxwD/V1YLKAneV+zaVtRyas8O81av6f+MDLl43ly8c0OOxtFoHe/AHpcf5jeRlL0VTW5seOz7OT71e2J7kaUPCSommUeOpV6oEdrw5NTHTQPBRtG54oa8YzYH2+FHgu8r0SCJnPQmhV+3x7dra1ko/0fI36uTzKhd5dGGTl/Td90IweP75H2FtYMJtif6ag8b1TzUPKmxOjDMVf/8IoOG4xQ/wUKwDcd1daweaLQIn6N2B0Sl3aP81GdcihoDCgcqSr57e6plyZnM38rUlF6ip7WdvWhnlGGr27OEbya2k6p+Fg+ljjnXA80q/8wro4kSKCz3K7j/aeEt4EBg+c6lzokUkxfxKR8ejUvibu9Gpp+55aWcmBGxWxPEA0Wok4SJ4sGxGuaIqIStvspaARUSvNoQN19ARyVMddOzgZSuFRx8RweVWK3MgMGHC7zdWZKEOCBpDC4lgZSy7hbCNEjnurfMabQ5s+8LSrOP8e3OBXXApwVxnR8oVfgvg0/dW4SrjijlfOvVZzorp5AfpGRjerPwbrwgMtrdjgNHJOboVyKoyr9NtBLSFzblkRt4zHGB2Ci8uo0fAezfG9C4BR8KceW2oxn7RxhaTV4Bqi72F/EwW+UxC8ToaZ8mGb9forU64L8w==
ServerSignature

ckDMYcyJOj57LyVl9hu+LDFPN7DWXttBDQVgK7yPiZ54yMIXqqSYG3iLXvPBFL9krm3U6ctMAjeU0MCrN8Z861ZpfcmcpiizocIdAHChzcqsSUaDFuNhTTizyxYpqTVBGjaZliF2QL/siQ7VSlBcRfXEa54AUk9GBRriKybSrftt3o2myGGOWctFVwJGcAMRJ6/lWtyU/I3yJSgSahHlO98GIvluTR3Pzix880KMzDhWTrW6+8aEm1ybRl2VGZq7A0TSecDJyb/ISEvoxQMYMC5FyrkGymS7ymcFKkCMuC79Bq/tDx6/iLtBYakGUydMJ7WPQM8pfQURAO+EkYc4WDDKNi5n11WEeVJyLn+vH54ih/zOrp49CAvfr8hAYH6s+cD2STct++ATeZp5XybiPdAzst0qoLw90Wk6Mx9tRsYnl1VJSUyFS7p0RZL3F48uLR2bvtHSgVIs7czHtoh3q45YbsG0P1sh0ar0IBxbK+iNm+c8/KA4kj3II934GivQxYK4dUdofHGA6FPmepzumlAp508g2ucMzzuI1GWPlTpWwn721xqVfKm5p1B07p4W6bn1uBVcsMzbk1cxBPcLcx7xZZHj4lGQBtTLASiqh6yIt5azkXqIl3zfIQMD/Onhz6HjzZRZh62QLPBN/zVnDx5Le4umSjv6Mk/OgLsZeXo=
Install

true
BDOS

false
Anti-VM

false
Install File

LumoraNetworkProtector.exe
Install-Folder

%AppData%
Hosts

artabnewszamanpaper47.ru.com,lmn.uk.com,28bet.games,tg88vn.bio,uydeg.ru.com,bxr.uk.com
Ports

80,443,4782,8080,8848,8888
Mutex

LCT_LumoraNetwork_ProtectorLock_6i7j8k9l
Version

0.5.8
Delay

3
Group

LCT
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

LumoraNetworkProtector.exe
Full Name

LumoraNetworkProtector.exe
EntryPoint

System.Void Client.Program::Main()
Scope Name

LumoraNetworkProtector.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

LumoraNetworkProtector
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

120
Main Method

System.Void Client.Program::Main()
Main IL Instruction Count

51
Main IL

ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0043: ldsfld System.String Client.Settings::Anti ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String Client.Settings::Install call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() ldsfld System.String Client.Settings::Install call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BDOS call System.Void Client.Install.NormalStartup::Install() ldsfld System.String Client.Settings::BDOS call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.ProcessCritical::Set() call System.Void Client.Helper.Methods::PreventSleep() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Module Name

LumoraNetworkProtector.exe
Full Name

LumoraNetworkProtector.exe
EntryPoint

System.Void Client.Program::Main()
Scope Name

LumoraNetworkProtector.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

LumoraNetworkProtector
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

120
Main Method

System.Void Client.Program::Main()
Main IL Instruction Count

51
Main IL

ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0043: ldsfld System.String Client.Settings::Anti ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String Client.Settings::Install call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() ldsfld System.String Client.Settings::Install call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BDOS call System.Void Client.Install.NormalStartup::Install() ldsfld System.String Client.Settings::BDOS call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.ProcessCritical::Set() call System.Void Client.Helper.Methods::PreventSleep() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Artefacts
Name
 Value
Key (AES_256)

QUpqTzhGd2N0d0Mxb2Y3STA3NldIN3F1SXV0WkdqVGc=
CnC

artabnewszamanpaper47.ru.com
CnC

lmn.uk.com
CnC

28bet.games
CnC

tg88vn.bio
CnC

uydeg.ru.com
CnC

bxr.uk.com
Ports

80
Ports

443
Ports

4782
Ports

8080
Ports

8848
Ports

8888
Mutex

LCT_LumoraNetwork_ProtectorLock_6i7j8k9l
420933fabb4eef2301ea124f340ae00a (47.62 KB)
File Structure
420933fabb4eef2301ea124f340ae00a
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Characteristics
Malware Configuration - AsyncRAT config.
Config. Field
 Value
Key (AES_256)

QUpqTzhGd2N0d0Mxb2Y3STA3NldIN3F1SXV0WkdqVGc=
Pastebin

-
Certificate

MIIE8jCCAtqgAwIBAgIQALhpP6c/lzBhRfZpd/rs2zANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjYwMTMwMDQzODAzWhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKIXD0Dv5Bsd/QexWDu0KiHP9ZuMblxtyUrTYALFekyu8Besq6HKRKss35Eqn05SaYRBJNVJK7SD0Aw1WUCZNtc+RUdOaRx32SgkErBVhtDs0VBKkxnLnQECgtRB6Gd5kfuOtFUwjyabj5YW0ExLyVvUWP52brx4VOM07VJnDmlX4fqFWD4MsGZeAGMfjrcZXcWC7libLGWOzacclrx5QCpS25uh5aMi7d+9KYFuPB9orrOWtbMgZ5WJJTQipj0fUi3EMEm49mmPt45B0MJFvSXG+PDxznx/bGZ2r4Keiq22oNv+8X/jKm6azhWzx3h9ppYD46eY9f2ySdgrN4VvU7DWmLPK+Clr2CQhS3usdy9WnNCikho5DM9kpOp3UgDGmibp7z3UvlPuyGJkUI81zSkX/z4QNT81q9SnlxqDGRbTK+sRwkceUO6zB7+n8M3hfw5FNuTMHOjnX9/nvBCu6fA84hxebGTneBIvXHc+eK1EE3Zyv0FcbaO1JBHHUMMUp/ufOw73fGW4lK919MQefppnOuQuXTTG49t5Axmvr3Jw7QIQ4qzNEH/De84q/lbM8y3c+ZLb06UjHdODU6DEv+emhKaQUfACMQivyUrmiiXNOjNP+P+crtptNbZceEeaGH6YDe6RfyDdKqoDsF/YKeMD7AyA68m6CuicrAnZWDYvAgMBAAGjMjAwMB0GA1UdDgQWBBSyND31q3J7dL9g3kls6PzKaTC+ojAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQBzPb5yU6MyIpsnhT4wFupaxc5crhgLCtIyhKynGXxwD/V1YLKAneV+zaVtRyas8O81av6f+MDLl43ly8c0OOxtFoHe/AHpcf5jeRlL0VTW5seOz7OT71e2J7kaUPCSommUeOpV6oEdrw5NTHTQPBRtG54oa8YzYH2+FHgu8r0SCJnPQmhV+3x7dra1ko/0fI36uTzKhd5dGGTl/Td90IweP75H2FtYMJtif6ag8b1TzUPKmxOjDMVf/8IoOG4xQ/wUKwDcd1daweaLQIn6N2B0Sl3aP81GdcihoDCgcqSr57e6plyZnM38rUlF6ip7WdvWhnlGGr27OEbya2k6p+Fg+ljjnXA80q/8wro4kSKCz3K7j/aeEt4EBg+c6lzokUkxfxKR8ejUvibu9Gpp+55aWcmBGxWxPEA0Wok4SJ4sGxGuaIqIStvspaARUSvNoQN19ARyVMddOzgZSuFRx8RweVWK3MgMGHC7zdWZKEOCBpDC4lgZSy7hbCNEjnurfMabQ5s+8LSrOP8e3OBXXApwVxnR8oVfgvg0/dW4SrjijlfOvVZzorp5AfpGRjerPwbrwgMtrdjgNHJOboVyKoyr9NtBLSFzblkRt4zHGB2Ci8uo0fAezfG9C4BR8KceW2oxn7RxhaTV4Bqi72F/EwW+UxC8ToaZ8mGb9forU64L8w==
ServerSignature

ckDMYcyJOj57LyVl9hu+LDFPN7DWXttBDQVgK7yPiZ54yMIXqqSYG3iLXvPBFL9krm3U6ctMAjeU0MCrN8Z861ZpfcmcpiizocIdAHChzcqsSUaDFuNhTTizyxYpqTVBGjaZliF2QL/siQ7VSlBcRfXEa54AUk9GBRriKybSrftt3o2myGGOWctFVwJGcAMRJ6/lWtyU/I3yJSgSahHlO98GIvluTR3Pzix880KMzDhWTrW6+8aEm1ybRl2VGZq7A0TSecDJyb/ISEvoxQMYMC5FyrkGymS7ymcFKkCMuC79Bq/tDx6/iLtBYakGUydMJ7WPQM8pfQURAO+EkYc4WDDKNi5n11WEeVJyLn+vH54ih/zOrp49CAvfr8hAYH6s+cD2STct++ATeZp5XybiPdAzst0qoLw90Wk6Mx9tRsYnl1VJSUyFS7p0RZL3F48uLR2bvtHSgVIs7czHtoh3q45YbsG0P1sh0ar0IBxbK+iNm+c8/KA4kj3II934GivQxYK4dUdofHGA6FPmepzumlAp508g2ucMzzuI1GWPlTpWwn721xqVfKm5p1B07p4W6bn1uBVcsMzbk1cxBPcLcx7xZZHj4lGQBtTLASiqh6yIt5azkXqIl3zfIQMD/Onhz6HjzZRZh62QLPBN/zVnDx5Le4umSjv6Mk/OgLsZeXo=
Install

true
BDOS

false
Anti-VM

false
Install File

LumoraNetworkProtector.exe
Install-Folder

%AppData%
Hosts

artabnewszamanpaper47.ru.com,lmn.uk.com,28bet.games,tg88vn.bio,uydeg.ru.com,bxr.uk.com
Ports

80,443,4782,8080,8848,8888
Mutex

LCT_LumoraNetwork_ProtectorLock_6i7j8k9l
Version

0.5.8
Delay

3
Group

LCT
Artefacts
Name
 Value Location
Key (AES_256)

QUpqTzhGd2N0d0Mxb2Y3STA3NldIN3F1SXV0WkdqVGc=

Malicious

420933fabb4eef2301ea124f340ae00a
CnC

artabnewszamanpaper47.ru.com

Malicious

420933fabb4eef2301ea124f340ae00a
CnC

lmn.uk.com

Malicious

420933fabb4eef2301ea124f340ae00a
CnC

28bet.games

Malicious

420933fabb4eef2301ea124f340ae00a
CnC

tg88vn.bio

Malicious

420933fabb4eef2301ea124f340ae00a
CnC

uydeg.ru.com

Malicious

420933fabb4eef2301ea124f340ae00a
CnC

bxr.uk.com

Malicious

420933fabb4eef2301ea124f340ae00a
Ports

80

Malicious

420933fabb4eef2301ea124f340ae00a
Ports

443

Malicious

420933fabb4eef2301ea124f340ae00a
Ports

4782

Malicious

420933fabb4eef2301ea124f340ae00a
Ports

8080

Malicious

420933fabb4eef2301ea124f340ae00a
Ports

8848

Malicious

420933fabb4eef2301ea124f340ae00a
Ports

8888

Malicious

420933fabb4eef2301ea124f340ae00a
Mutex

LCT_LumoraNetwork_ProtectorLock_6i7j8k9l

Malicious

420933fabb4eef2301ea124f340ae00a
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙