Malicious
Malicious

420933fabb4eef2301ea124f340ae00a

PE Executable
|
MD5: 420933fabb4eef2301ea124f340ae00a
|
Size: 47.62 KB
|
application/x-dosexec

Print
Infection Chain
Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Low

Hash
 Hash Value
MD5
420933fabb4eef2301ea124f340ae00a
Sha1
4f9b6a022b6a0a16138ffce071db7f132cee07ac
Sha256
9eb860092c1118646f715bf5bacbf38c3053450fd601cc1f8a03e54b21b1d001
Sha384
4bc048dca9869aae2260f3c05be4c6a8d8bd75ebfe7fb923738884932644d995bbaf97fcd744d4010ac88fa1abbb60a2
Sha512
f3a39ae2924ec1dce0f4b027a29651b744391446c9ee709bf6a0980d7b53397f2840ae943ce14cd3752b6d9abe3e92b75591d658d8cf9d65a05154461dbedcfc
SSDeep
768:EulxJTHscwgWUKcCGmo2q9O10G4hBYapPIqzjbmgX3U65tjWOMNwQSTBDZOu:EulxJTHvZ2n0zWaGq3b5XkoWw/dOu
TLSH
7E232B003BE8C12BF2BE5F7898F26145867AF5677603DA4D1CC4419B1623BC69A427FE

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
420933fabb4eef2301ea124f340ae00a
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Malware Configuration - AsyncRAT config.
Config. Field
 Value
Key (AES_256)

QUpqTzhGd2N0d0Mxb2Y3STA3NldIN3F1SXV0WkdqVGc=
Pastebin

-
Certificate

MIIE8jCCAtqgAwIBAgIQALhpP6c/lzBhRfZpd/rs2zANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjYwMTMwMDQzODAzWhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKIXD0Dv5Bsd/QexWDu0KiHP9ZuMblxtyUrTYALFekyu8Besq6HKRKss35Eqn05SaYRBJNVJK7SD0Aw1WUCZNtc+RUdOaRx32SgkErBVhtDs0VBKkxnLnQECgtRB6Gd5kfuOtFUwjyabj5YW0ExLyVvUWP52brx4VOM07VJnDmlX4fqFWD4MsGZeAGMfjrcZXcWC7libLGWOzacclrx5QCpS25uh5aMi7d+9KYFuPB9orrOWtbMgZ5WJJTQipj0fUi3EMEm49mmPt45B0MJFvSXG+PDxznx/bGZ2r4Keiq22oNv+8X/jKm6azhWzx3h9ppYD46eY9f2ySdgrN4VvU7DWmLPK+Clr2CQhS3usdy9WnNCikho5DM9kpOp3UgDGmibp7z3UvlPuyGJkUI81zSkX/z4QNT81q9SnlxqDGRbTK+sRwkceUO6zB7+n8M3hfw5FNuTMHOjnX9/nvBCu6fA84hxebGTneBIvXHc+eK1EE3Zyv0FcbaO1JBHHUMMUp/ufOw73fGW4lK919MQefppnOuQuXTTG49t5Axmvr3Jw7QIQ4qzNEH/De84q/lbM8y3c+ZLb06UjHdODU6DEv+emhKaQUfACMQivyUrmiiXNOjNP+P+crtptNbZceEeaGH6YDe6RfyDdKqoDsF/YKeMD7AyA68m6CuicrAnZWDYvAgMBAAGjMjAwMB0GA1UdDgQWBBSyND31q3J7dL9g3kls6PzKaTC+ojAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQBzPb5yU6MyIpsnhT4wFupaxc5crhgLCtIyhKynGXxwD/V1YLKAneV+zaVtRyas8O81av6f+MDLl43ly8c0OOxtFoHe/AHpcf5jeRlL0VTW5seOz7OT71e2J7kaUPCSommUeOpV6oEdrw5NTHTQPBRtG54oa8YzYH2+FHgu8r0SCJnPQmhV+3x7dra1ko/0fI36uTzKhd5dGGTl/Td90IweP75H2FtYMJtif6ag8b1TzUPKmxOjDMVf/8IoOG4xQ/wUKwDcd1daweaLQIn6N2B0Sl3aP81GdcihoDCgcqSr57e6plyZnM38rUlF6ip7WdvWhnlGGr27OEbya2k6p+Fg+ljjnXA80q/8wro4kSKCz3K7j/aeEt4EBg+c6lzokUkxfxKR8ejUvibu9Gpp+55aWcmBGxWxPEA0Wok4SJ4sGxGuaIqIStvspaARUSvNoQN19ARyVMddOzgZSuFRx8RweVWK3MgMGHC7zdWZKEOCBpDC4lgZSy7hbCNEjnurfMabQ5s+8LSrOP8e3OBXXApwVxnR8oVfgvg0/dW4SrjijlfOvVZzorp5AfpGRjerPwbrwgMtrdjgNHJOboVyKoyr9NtBLSFzblkRt4zHGB2Ci8uo0fAezfG9C4BR8KceW2oxn7RxhaTV4Bqi72F/EwW+UxC8ToaZ8mGb9forU64L8w==
ServerSignature

ckDMYcyJOj57LyVl9hu+LDFPN7DWXttBDQVgK7yPiZ54yMIXqqSYG3iLXvPBFL9krm3U6ctMAjeU0MCrN8Z861ZpfcmcpiizocIdAHChzcqsSUaDFuNhTTizyxYpqTVBGjaZliF2QL/siQ7VSlBcRfXEa54AUk9GBRriKybSrftt3o2myGGOWctFVwJGcAMRJ6/lWtyU/I3yJSgSahHlO98GIvluTR3Pzix880KMzDhWTrW6+8aEm1ybRl2VGZq7A0TSecDJyb/ISEvoxQMYMC5FyrkGymS7ymcFKkCMuC79Bq/tDx6/iLtBYakGUydMJ7WPQM8pfQURAO+EkYc4WDDKNi5n11WEeVJyLn+vH54ih/zOrp49CAvfr8hAYH6s+cD2STct++ATeZp5XybiPdAzst0qoLw90Wk6Mx9tRsYnl1VJSUyFS7p0RZL3F48uLR2bvtHSgVIs7czHtoh3q45YbsG0P1sh0ar0IBxbK+iNm+c8/KA4kj3II934GivQxYK4dUdofHGA6FPmepzumlAp508g2ucMzzuI1GWPlTpWwn721xqVfKm5p1B07p4W6bn1uBVcsMzbk1cxBPcLcx7xZZHj4lGQBtTLASiqh6yIt5azkXqIl3zfIQMD/Onhz6HjzZRZh62QLPBN/zVnDx5Le4umSjv6Mk/OgLsZeXo=
Install

true
BDOS

false
Anti-VM

false
Install File

LumoraNetworkProtector.exe
Install-Folder

%AppData%
Hosts

artabnewszamanpaper47.ru.com,lmn.uk.com,28bet.games,tg88vn.bio,uydeg.ru.com,bxr.uk.com
Ports

80,443,4782,8080,8848,8888
Mutex

LCT_LumoraNetwork_ProtectorLock_6i7j8k9l
Version

0.5.8
Delay

3
Group

LCT
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

LumoraNetworkProtector.exe
Full Name

LumoraNetworkProtector.exe
EntryPoint

System.Void Client.Program::Main()
Scope Name

LumoraNetworkProtector.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

LumoraNetworkProtector
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

120
Main Method

System.Void Client.Program::Main()
Main IL Instruction Count

51
Main IL

ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0043: ldsfld System.String Client.Settings::Anti ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String Client.Settings::Install call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() ldsfld System.String Client.Settings::Install call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BDOS call System.Void Client.Install.NormalStartup::Install() ldsfld System.String Client.Settings::BDOS call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.ProcessCritical::Set() call System.Void Client.Helper.Methods::PreventSleep() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Module Name

LumoraNetworkProtector.exe
Full Name

LumoraNetworkProtector.exe
EntryPoint

System.Void Client.Program::Main()
Scope Name

LumoraNetworkProtector.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

LumoraNetworkProtector
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

120
Main Method

System.Void Client.Program::Main()
Main IL Instruction Count

51
Main IL

ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0043: ldsfld System.String Client.Settings::Anti ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String Client.Settings::Install call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() ldsfld System.String Client.Settings::Install call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BDOS call System.Void Client.Install.NormalStartup::Install() ldsfld System.String Client.Settings::BDOS call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.ProcessCritical::Set() call System.Void Client.Helper.Methods::PreventSleep() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Artefacts
Name
 Value
Key (AES_256)

QUpqTzhGd2N0d0Mxb2Y3STA3NldIN3F1SXV0WkdqVGc=
CnC

artabnewszamanpaper47.ru.com
CnC

lmn.uk.com
CnC

28bet.games
CnC

tg88vn.bio
CnC

uydeg.ru.com
CnC

bxr.uk.com
Ports

80
Ports

443
Ports

4782
Ports

8080
Ports

8848
Ports

8888
Mutex

LCT_LumoraNetwork_ProtectorLock_6i7j8k9l
420933fabb4eef2301ea124f340ae00a (47.62 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙