Malicious
Malicious

46727cbc255133532210441f03729590

PE Executable
|
MD5: 46727cbc255133532210441f03729590
|
Size: 48.64 KB
|
application/x-dosexec

Print
Infection Chain
Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Low

Hash
 Hash Value
MD5
46727cbc255133532210441f03729590
Sha1
0d24a68a767b9b9e15cecc8d78825edeb447f097
Sha256
0cfa3d1a5a9e9d690c0148510644037d671d81b8f946f6eb84227be5da8e547f
Sha384
00ae6a0413752d0533150bbea5eca5629b2b1bc45bca02cdde8325c839aa3fd9f15a9a99e807cc4400788adb92b09488
Sha512
32d8e3437c0c064ea8585bf64dd6531616875233fc698aab0e36b293a8bb6b9844f9ad755f1038039afc7d7f480899a38609cac7329484268db3dd56eda7ddad
SSDeep
768:dOEuILWCKi+DiBtelDSN+iV08Ybyge5n/KcvEgK/J9lZVc6KN:dOtmBtKDs4zb1+nScnkJ3ZVclN
TLSH
BB235D4037A88136F2BD87B5ACF2D6058675E2676903C65D6CC814EA2F13BC59A036FE

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
46727cbc255133532210441f03729590
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Malware Configuration - DcRat config.
Config. Field
 Value
Key (AES_256)

VEZHSHcxRlBYeVFmTVFxMWJ5U2lHQ05MSnJvZUpmcHc=
Pastebin

-
Certificate

MIICMDCCAZmgAwIBAgIVAI1RTyLTnGsP3MnOuhOB7vCi4sd3MA0GCSqGSIb3DQEBDQUAMGQxFTATBgNVBAMMDERjUmF0IFNlcnZlcjETMBEGA1UECwwKcXdxZGFuY2h1bjEcMBoGA1UECgwTRGNSYXQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTI1MDQyMzE0MzUxNVoXDTM2MDEzMTE0MzUxNVowEDEOMAwGA1UEAwwFRGNSYXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAIruLtM9nCkSDSDp3Zevw3u5Zexgk1uReVPi8itA6JQFOteJNTHmDhNSQgm6j/ErDEl9c7lbhI+k+Ub4aHLEWxFMPgIcPUm6Q7eWG4cmJ8Q5f5VMu0x828Bv5zXDAIwfjXrHzPS41YXFxJnml54gCK70rTD059qK72QEA6QnMkPzAgMBAAGjMjAwMB0GA1UdDgQWBBRu8e5BFFmM0vsmSwDv2DeMJ+RNXTAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4GBABzX/4oC+uCHHnBgQGlwiVpOjGbn90yhyQnFeqQY/etKHwM5BMONOFnS1oOI79iyKfYI0nyVMOQSzIwzU1G+IBMuMahz8DlHoQxEemaZJZQlnHXWEmsB8EYDL6nsFAW5q45hIssb8+PtTEqzuahe4Je8xYFEEbGh+rSmBj+RuQrO
ServerSignature

Pnk7PMWQVwgAgOQUi5Gp9a8VhGp5MmbHrCUgzgiV/fi9w/C0eGIZnGhRBsdayik60J+Mc3Sn8t/MRdsLL6gRCjDOw0jdSTxQRggkX5iHPJ/U9n16fDDYGk6SSMwWTdlzUtqKqul4M6UTL8i8CooX03VIBBMbv9V/dgSz0S53MHU=
Install

false
BDOS

false
Anti-VM

false
Install-Folder

%AppData%
Hosts

172.86.116.191
Ports

8848
Mutex

DcRatMutex_qwqdanchun
Version

1.0.7
Delay

1
Group

Default
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

Client.exe
Full Name

Client.exe
EntryPoint

System.Void Client.Program::Main()
Scope Name

Client.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Client
Assembly Version

1.0.7.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0
Total Strings

150
Main Method

System.Void Client.Program::Main()
Main IL Instruction Count

59
Main IL

ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::De_lay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> ldsfld System.String Client.Settings::An_ti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0047: call System.Boolean Client.Helper.MutexControl::CreateMutex() call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0057: ldsfld System.String Client.Settings::Anti_Process ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti_Process call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BS_OD call System.Void Client.Helper.AntiProcess::StartBlock() ldsfld System.String Client.Settings::BS_OD call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: ldsfld System.String Client.Settings::In_stall call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: ldsfld System.String Client.Settings::In_stall call System.Void Client.Helper.ProcessCritical::Set() ldsfld System.String Client.Settings::In_stall call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_009D: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Install.NormalStartup::Install() call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_00B1: call System.Void Client.Connection.Amsi::Bypass() call System.Void Client.Helper.Methods::ClearSetting() call System.Void Client.Connection.Amsi::Bypass() leave IL_00C1: nop pop <null> leave IL_00C1: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00D6: leave IL_00E1 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00E1: ldc.i4 5000 pop <null> leave IL_00E1: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_00C1: nop
Module Name

Client.exe
Full Name

Client.exe
EntryPoint

System.Void Client.Program::Main()
Scope Name

Client.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Client
Assembly Version

1.0.7.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0
Total Strings

150
Main Method

System.Void Client.Program::Main()
Main IL Instruction Count

59
Main IL

ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::De_lay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> ldsfld System.String Client.Settings::An_ti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0047: call System.Boolean Client.Helper.MutexControl::CreateMutex() call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0057: ldsfld System.String Client.Settings::Anti_Process ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti_Process call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BS_OD call System.Void Client.Helper.AntiProcess::StartBlock() ldsfld System.String Client.Settings::BS_OD call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: ldsfld System.String Client.Settings::In_stall call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: ldsfld System.String Client.Settings::In_stall call System.Void Client.Helper.ProcessCritical::Set() ldsfld System.String Client.Settings::In_stall call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_009D: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Install.NormalStartup::Install() call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_00B1: call System.Void Client.Connection.Amsi::Bypass() call System.Void Client.Helper.Methods::ClearSetting() call System.Void Client.Connection.Amsi::Bypass() leave IL_00C1: nop pop <null> leave IL_00C1: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00D6: leave IL_00E1 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00E1: ldc.i4 5000 pop <null> leave IL_00E1: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_00C1: nop
Artefacts
Name
 Value
Key (AES_256)

VEZHSHcxRlBYeVFmTVFxMWJ5U2lHQ05MSnJvZUpmcHc=
CnC

172.86.116.191
Ports

8848
Mutex

DcRatMutex_qwqdanchun
46727cbc255133532210441f03729590 (48.64 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙