422796464af80a10f2a1294c03393f0f

PE Executable
|
MD5: 422796464af80a10f2a1294c03393f0f
|
Size: 307.71 KB
|
application/x-dosexec

Infection Chain

Summary by MalvaGPT

Characteristics

Hash	Hash Value
MD5	422796464af80a10f2a1294c03393f0f
Sha1	4e5ae1e1c6a6dd04242d73d25eadb640edf0756d
Sha256	eb8a106d3e3fd3fb4f092aa1f700a6e351de59ef1ab2a96fdd973f7f45eb1901
Sha384	15110c7ced0272061d3338a8c72bd1819f7c73edca376108eae59942547dcd2de22b1b8099e0d30ce2768de39dac6008
Sha512	0dbc86b8702516fd8126dc6d160f01c3cd5d04e11d0892ab334e8787691e0ba4f33d0eba1a706c5cc5b99d540759df2ff554e756321b4f63fbb2948d966dc7dd
SSDeep	3072:WcZqf7D34Op/0+mACkyI+EQEjgWvB1fA0PuTVAtkxzt3RIeqiOL2bBOA:WcZqf7DI2nGfEtB1fA0GTV8kXIL
TLSH	1A645A5833E8C910DA7F4775D861D67093B0BCA3A556E70B4FC4ACAB3D32740EA50AB6

PeID

.NET executable

Microsoft Visual C# / Basic .NET

Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL

Microsoft Visual C# v7.0 / Basic .NET

Microsoft Visual Studio .NET

File Structure

Malware Configuration - RedLine Encoded Config.

Config. Field0	Value
[Configuration Module Name]	Arguments
[Configuration Module Full Name]	Arguments
IP	Jj4LXyUCIlkmK18SJy8OHSY8DBAkAC1eJDwiVQ==
ID	CC0uWgspVlU=
Message
Key	kjhkihkhkh
Version	0

Malware Configuration - RedLine Decoded Config.

Config. Field0	Value
[Configuration Module Name]	Arguments
[Configuration Module Full Name]	Arguments
IP (C2)	178.250.188.181:1912
ID	paul
Key	kjhkihkhkh
Version	0

Informations

Name0	Value
Module Name	Steanings.exe
Full Name	Steanings.exe
EntryPoint	System.Void Program::Main()
Scope Name	Steanings.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Steanings
Assembly Version	1.1.21.1
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	301
Main Method	System.Void Program::Main()
Main IL Instruction Count	17
Main IL	nop <null> nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) nop <null> newobj System.Void Form1::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) nop <null> nop <null> leave.s IL_0022: ret stloc.0 <null> nop <null> nop <null> leave.s IL_0022: ret ret <null>
Module Name	Steanings.exe
Full Name	Steanings.exe
EntryPoint	System.Void Program::Main()
Scope Name	Steanings.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Steanings
Assembly Version	1.1.21.1
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	301
Main Method	System.Void Program::Main()
Main IL Instruction Count	17
Main IL	nop <null> nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) nop <null> newobj System.Void Form1::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) nop <null> nop <null> leave.s IL_0022: ret stloc.0 <null> nop <null> nop <null> leave.s IL_0022: ret ret <null>

422796464af80a10f2a1294c03393f0f (307.71 KB)