44b7d79f19d7df2bb5db6cece3d80330

PE Executable
|
MD5: 44b7d79f19d7df2bb5db6cece3d80330
|
Size: 1.84 MB
|
application/x-dosexec

Infection Chain

Summary by MalvaGPT

Characteristics

Hash	Hash Value
MD5	44b7d79f19d7df2bb5db6cece3d80330
Sha1	0d388a200dbc612edf36369500889aba1fe4d5dd
Sha256	3b46e6a3843acbce890fa4fb3525ad232617f65e1d758a1a54c9c38ce78ddcfb
Sha384	57645593c00a2b6d9f999b0f935d864bd256d9449cfee4289e7d973e56280bf61092661240781d1d4be6c0c37199fc60
Sha512	2f15e9a0a62c0449fcc9dd5b8aafdbac83243bf99537f2c47eaf7c5d851a97b431afa850b4618f724071da1a4f4223bdbbbfbabfd96b6c60bbaa09569706be53
SSDeep	24576:bg0iZSKxJzck+7eWBRwRR16zA0KKm77yviUSQaZaOwI55l2S62r9cGW/yFoBkkAV:bg0OTYj77wRGKKm77LrwCB6hqan0hgQ
TLSH	E5850250B7F5851BE2BF2BB9A4B308090B37FA53D93AC75F1948909C1EA73409E517A3

PeID

.NET executable

Microsoft Visual C# / Basic .NET

Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL

Microsoft Visual C# v7.0 / Basic .NET

Microsoft Visual Studio .NET

File Structure

Malware Configuration - QuasarRAT config.

Config. Field0	Value
Conf. AES-Salt	BF-EB-1E-56-FB-CD-97-3B-B2-19-02-24-30-A5-78-43-00-3D-56-44-D2-1E-62-B9-D4-F1-80-E7-E6-C3-39-41
Conf. AES-Key
Version	ObjectLength
Port	ChainingModeGCM
Host	ChainingModeGCM
ReconnectDelay	AuthTagLength
Key	ChainingMode
SubDirectory	KeyDataBlob
InstallName	AES
Install	Microsoft Primitive Provider
Startup	1
Mutex	1
StartupKey	-1073700862
HideFile	f5vZ10PgNN/y8rU1sdaZSbjeSrsW2/ajKBQSukg+KiS4mXvfTgaQo8sMdACNn40egI/2EWIWF6SGxZ71bo/gCQ==
EnableLogger	LgNtJnNwemWnQobwKusaeeMu294kaQsjh7/RFv4NTFHs4vP4tEES6ALt28QRLmn9OSV54l12JzxcidVRGsJZaJV80VRyfQ8oUddE/dYM6kk=
EncryptionKey	3000

Informations

Name0	Value
Info	PE Detect: PeReader OK (file layout)
Info	PDB Path: ?
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void gblmtxwjsstklgpxmzomzyxysog.fOfxnSnlew07T::Main()
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.7.3.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.7.2
Total Strings	1509
Main Method	System.Void gblmtxwjsstklgpxmzomzyxysog.fOfxnSnlew07T::Main()
Main IL Instruction Count	11
Main IL	ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldc.i4.2 <null> call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode) call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.Void gblmtxwjsstklgpxmzomzyxysog.fOfxnSnlew07T::JOP6eWhi8rjXqTj09HKTt36f() newobj System.Void gblmtxwjsstklgpxmzomzyxysog.RzujHtSozC8hWCEmf8TO::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void gblmtxwjsstklgpxmzomzyxysog.fOfxnSnlew07T::Main()
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.7.3.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.7.2
Total Strings	1509
Main Method	System.Void gblmtxwjsstklgpxmzomzyxysog.fOfxnSnlew07T::Main()
Main IL Instruction Count	11
Main IL	ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldc.i4.2 <null> call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode) call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.Void gblmtxwjsstklgpxmzomzyxysog.fOfxnSnlew07T::JOP6eWhi8rjXqTj09HKTt36f() newobj System.Void gblmtxwjsstklgpxmzomzyxysog.RzujHtSozC8hWCEmf8TO::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>

Artefacts

Name0	Value
CnC	ChainingModeGCM
Port	ChainingModeGCM

44b7d79f19d7df2bb5db6cece3d80330 (1.84 MB)