46727cbc255133532210441f03729590

PE Executable
|
MD5: 46727cbc255133532210441f03729590
|
Size: 48.64 KB
|
application/x-dosexec

Infection Chain

Summary by MalvaGPT

Characteristics

Hash	Hash Value
MD5	46727cbc255133532210441f03729590
Sha1	0d24a68a767b9b9e15cecc8d78825edeb447f097
Sha256	0cfa3d1a5a9e9d690c0148510644037d671d81b8f946f6eb84227be5da8e547f
Sha384	00ae6a0413752d0533150bbea5eca5629b2b1bc45bca02cdde8325c839aa3fd9f15a9a99e807cc4400788adb92b09488
Sha512	32d8e3437c0c064ea8585bf64dd6531616875233fc698aab0e36b293a8bb6b9844f9ad755f1038039afc7d7f480899a38609cac7329484268db3dd56eda7ddad
SSDeep	768:dOEuILWCKi+DiBtelDSN+iV08Ybyge5n/KcvEgK/J9lZVc6KN:dOtmBtKDs4zb1+nScnkJ3ZVclN
TLSH	BB235D4037A88136F2BD87B5ACF2D6058675E2676903C65D6CC814EA2F13BC59A036FE

PeID

.NET executable

Microsoft Visual C# / Basic .NET

Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL

Microsoft Visual C# v7.0 / Basic .NET

Microsoft Visual Studio .NET

File Structure

Malware Configuration - DcRat config.

Config. Field0	Value
Key (AES_256)	VEZHSHcxRlBYeVFmTVFxMWJ5U2lHQ05MSnJvZUpmcHc=
Pastebin	-
Certificate	MIICMDCCAZmgAwIBAgIVAI1RTyLTnGsP3MnOuhOB7vCi4sd3MA0GCSqGSIb3DQEBDQUAMGQxFTATBgNVBAMMDERjUmF0IFNlcnZlcjETMBEGA1UECwwKcXdxZGFuY2h1bjEcMBoGA1UECgwTRGNSYXQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTI1MDQyMzE0MzUxNVoXDTM2MDEzMTE0MzUxNVowEDEOMAwGA1UEAwwFRGNSYXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAIruLtM9nCkSDSDp3Zevw3u5Zexgk1uReVPi8itA6JQFOteJNTHmDhNSQgm6j/ErDEl9c7lbhI+k+Ub4aHLEWxFMPgIcPUm6Q7eWG4cmJ8Q5f5VMu0x828Bv5zXDAIwfjXrHzPS41YXFxJnml54gCK70rTD059qK72QEA6QnMkPzAgMBAAGjMjAwMB0GA1UdDgQWBBRu8e5BFFmM0vsmSwDv2DeMJ+RNXTAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4GBABzX/4oC+uCHHnBgQGlwiVpOjGbn90yhyQnFeqQY/etKHwM5BMONOFnS1oOI79iyKfYI0nyVMOQSzIwzU1G+IBMuMahz8DlHoQxEemaZJZQlnHXWEmsB8EYDL6nsFAW5q45hIssb8+PtTEqzuahe4Je8xYFEEbGh+rSmBj+RuQrO
ServerSignature	Pnk7PMWQVwgAgOQUi5Gp9a8VhGp5MmbHrCUgzgiV/fi9w/C0eGIZnGhRBsdayik60J+Mc3Sn8t/MRdsLL6gRCjDOw0jdSTxQRggkX5iHPJ/U9n16fDDYGk6SSMwWTdlzUtqKqul4M6UTL8i8CooX03VIBBMbv9V/dgSz0S53MHU=
Install	false
BDOS	false
Anti-VM	false
Install-Folder	%AppData%
Hosts	172.86.116.191
Ports	8848
Mutex	DcRatMutex_qwqdanchun
Version	1.0.7
Delay	1
Group	Default

Informations

Name0	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void Client.Program::Main()
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.0.7.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	150
Main Method	System.Void Client.Program::Main()
Main IL Instruction Count	59
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::De_lay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> ldsfld System.String Client.Settings::An_ti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0047: call System.Boolean Client.Helper.MutexControl::CreateMutex() call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0057: ldsfld System.String Client.Settings::Anti_Process ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti_Process call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BS_OD call System.Void Client.Helper.AntiProcess::StartBlock() ldsfld System.String Client.Settings::BS_OD call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: ldsfld System.String Client.Settings::In_stall call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: ldsfld System.String Client.Settings::In_stall call System.Void Client.Helper.ProcessCritical::Set() ldsfld System.String Client.Settings::In_stall call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_009D: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Install.NormalStartup::Install() call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_00B1: call System.Void Client.Connection.Amsi::Bypass() call System.Void Client.Helper.Methods::ClearSetting() call System.Void Client.Connection.Amsi::Bypass() leave IL_00C1: nop pop <null> leave IL_00C1: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00D6: leave IL_00E1 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00E1: ldc.i4 5000 pop <null> leave IL_00E1: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_00C1: nop
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void Client.Program::Main()
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.0.7.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	150
Main Method	System.Void Client.Program::Main()
Main IL Instruction Count	59
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::De_lay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> ldsfld System.String Client.Settings::An_ti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0047: call System.Boolean Client.Helper.MutexControl::CreateMutex() call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0057: ldsfld System.String Client.Settings::Anti_Process ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti_Process call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BS_OD call System.Void Client.Helper.AntiProcess::StartBlock() ldsfld System.String Client.Settings::BS_OD call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: ldsfld System.String Client.Settings::In_stall call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: ldsfld System.String Client.Settings::In_stall call System.Void Client.Helper.ProcessCritical::Set() ldsfld System.String Client.Settings::In_stall call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_009D: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Install.NormalStartup::Install() call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_00B1: call System.Void Client.Connection.Amsi::Bypass() call System.Void Client.Helper.Methods::ClearSetting() call System.Void Client.Connection.Amsi::Bypass() leave IL_00C1: nop pop <null> leave IL_00C1: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00D6: leave IL_00E1 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00E1: ldc.i4 5000 pop <null> leave IL_00E1: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_00C1: nop

Artefacts

Name0	Value
Key (AES_256)	VEZHSHcxRlBYeVFmTVFxMWJ5U2lHQ05MSnJvZUpmcHc=
CnC	172.86.116.191
Ports	8848
Mutex	DcRatMutex_qwqdanchun

46727cbc255133532210441f03729590 (48.64 KB)