Malicious
Malicious

4898b4159d8db22f29734386332d6a66

PE Executable
|
MD5: 4898b4159d8db22f29734386332d6a66
|
Size: 47.62 KB
|
application/x-dosexec

Infection Chain
Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Low

Hash
 Hash Value
MD5
4898b4159d8db22f29734386332d6a66
Sha1
c9c6fe847b11fbd8ff7dd6a4f0d7189a9a324487
Sha256
afd828865444f858a18f309c0b1cd7b1018cd5a1fdcdb7477153018c2886f208
Sha384
59bb3faa2f29d4218b5cf65542ec51f6eac3bda61ce7733d3709bbb59ba56ea4a264d9b93a94dd2552e49297140e8544
Sha512
6263f9a27ecf688b5d4ededc195185aa01dfd532ea0b7169278e54b8222815f57f67ad5793a8b7bde9f80fad30cf0b259f016dd54fd7018987637709e619ede3
SSDeep
768:Iub35T0AoeiWUIwOsmo2qFdYoXyAAAA3PiPInzjb0gX3ixnxRN5MllozwBDZ4Yi:Iub35T0TV2kbWrn3bbXSf3Sd4Yi
TLSH
90232A0037E8812BF2BE8FB8ADF26145457AB5673603D54E1CC4419B5623FC69A427FE

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
4898b4159d8db22f29734386332d6a66
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Malware Configuration - AsyncRAT config.
Config. Field
 Value
Key (AES_256)

OWUxT2t6TEVYNk5xeGFSSGVkdkVRalpLNEE0ZEhsYmQ=
Pastebin

-
Certificate

MIIE8jCCAtqgAwIBAgIQAN2xrdVOwvtSIepKvvmsVzANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjUxMjE4MTMyNDI0WhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAJjaRa5Hs6nxH+3cdTupHksR+Q48WsyeiUrxZVa/QMltY+1EhSC3nQoTXDwwx5L2OFiDI2dptS9QbjQHOSbQ9Dpfe3NkzdYCJNo9h5sjzrXNHa+sC3S79TnmMoGug9tI4mtEX7/xMKtbXleSTV0Y/C2DYw/sYHEXOpjBHuGQTUibAlCP9RwdoxVr202scd0HaTErk9Bf2tw0kX62iOs5Xt0egd0Mc/Tzli3bSSpG0MNWc58rYdWYZSqBODiWRDSi9bJBSDdac+NNosa2L6KmDrlA1bpEY6dR/EnIn+bNgm8q3nCqoF8Hl5HxssdeB2cl2Aec3KgUaVfwItJH7as07gbW1n7peG3r8DeWucVODHOOK2LUPmNvrrs2KBbMX6qeU70Zswtom8H++7cmlHE1wi5mpgAfBhqgtnuP/NbROPIg3VEcZAAOWAAPe+7XAhESXEgxnKXLMoIOXSX7l+37OtcJB3tJcnSWI/QLYltK1iV8YltRwpNMPC4rdAT2UmOKkpZiuLZcGL+Z6b2KR6Iyar6YGOKh8z+xR08DXxEs0MJ9VktnoP0A5dMnwTUfs18c3kVvozfId86fwdsgMMqRTYvXdsOLyi6NGrYPwRb5pPu33fp+VKwh9n6azfh216ZbRFNY1OBUJOZm4GQks+ygzOCjHkqZLqpecJcSXYI8u9ztAgMBAAGjMjAwMB0GA1UdDgQWBBQpiOlMEUzlCotVDcCWs4U/jF6TbDAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQAkcW9KcZUqILeoRYgWg6OzvZHSmDtp17uH9+TI4EJpozASN53gwcBcASX15k3s3IaELck93KX/R+B1l6XlFYzfd5POToC8oapL5R+Yb2a5edlyWm22qsc3TI6IoI4yf+0KqY4eYfDplt6/PfW6QWLYEuC13L3teF6jbiApsJB1aUq+vLgN+N3YbpzNKJkPopQTtVvwskLeO6xNeADF3EL5RE7tpKT7AGA4dxEpMB9uRY0Ty+hQwNh8fTaOcdqicNs9c2YP4X6RYE+35iSoIkqPtLb251tAoM/zPkqJwt3GJvJpTDeFcpbpUseEKWh1KSdhD5aYbJC9wgRv8VKmbCocKpUhCgNEJwLqXT2gVxKmkoi/OCmRYKniheku691eUwxJl7/3GjskOiOCIWO+ujT9Ma7OzGhzVcS0u4mxeTnHqi2b1lTIVosqFMcOdSa7csdfeedzx8tJqceHGXC4UTYnZwjdd5Z0cYUPj/y9nc6i67oIezxcqazGnSD/sSaguvSq9f1ej6EE+MQJ+5QLJEguu0YM+SDnSf5Kjm6Htz2nnWtVs8TQGrHz+f/eIrurdYvlY8za1KV1qSjRGLGwbXW1jQdnf3r2ZhF/zHl+/i9munZbX8FNFvu7KgmzrYo5Lz+f7KBk5W4LFMRUQ3eF9zlTxKHVJjIQuCcLw5rfhSnA6A==
ServerSignature

wepay.in.net,www.wepay.in.net,slotmachinesno.sa.com,www.slotmachinesno.sa.com,digitalhari.in.net,www.digitalhari
Install

true
BDOS

false
Anti-VM

false
Install File

cfservice.exe
Install-Folder

%AppData%
Ports

80,443,8080,8848
Mutex

gb8Arf95yD6I
Version

0.5.8
Delay

3
Group

Default
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

CFArea1HorizonElite.exe
Full Name

CFArea1HorizonElite.exe
EntryPoint

System.Void Client.Program::Main()
Scope Name

CFArea1HorizonElite.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

CFArea1HorizonElite
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

120
Main Method

System.Void Client.Program::Main()
Main IL Instruction Count

51
Main IL

ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0043: ldsfld System.String Client.Settings::Anti ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String Client.Settings::Install call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() ldsfld System.String Client.Settings::Install call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BDOS call System.Void Client.Install.NormalStartup::Install() ldsfld System.String Client.Settings::BDOS call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.ProcessCritical::Set() call System.Void Client.Helper.Methods::PreventSleep() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Module Name

CFArea1HorizonElite.exe
Full Name

CFArea1HorizonElite.exe
EntryPoint

System.Void Client.Program::Main()
Scope Name

CFArea1HorizonElite.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

CFArea1HorizonElite
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

120
Main Method

System.Void Client.Program::Main()
Main IL Instruction Count

51
Main IL

ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0043: ldsfld System.String Client.Settings::Anti ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String Client.Settings::Install call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() ldsfld System.String Client.Settings::Install call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BDOS call System.Void Client.Install.NormalStartup::Install() ldsfld System.String Client.Settings::BDOS call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.ProcessCritical::Set() call System.Void Client.Helper.Methods::PreventSleep() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Artefacts
Name
 Value
Key (AES_256)

OWUxT2t6TEVYNk5xeGFSSGVkdkVRalpLNEE0ZEhsYmQ=
Ports

80
Ports

443
Ports

8080
Ports

8848
Mutex

gb8Arf95yD6I
4898b4159d8db22f29734386332d6a66 (47.62 KB)
File Structure
4898b4159d8db22f29734386332d6a66
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Characteristics
Malware Configuration - AsyncRAT config.
Config. Field
 Value
Key (AES_256)

OWUxT2t6TEVYNk5xeGFSSGVkdkVRalpLNEE0ZEhsYmQ=
Pastebin

-
Certificate

MIIE8jCCAtqgAwIBAgIQAN2xrdVOwvtSIepKvvmsVzANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjUxMjE4MTMyNDI0WhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAJjaRa5Hs6nxH+3cdTupHksR+Q48WsyeiUrxZVa/QMltY+1EhSC3nQoTXDwwx5L2OFiDI2dptS9QbjQHOSbQ9Dpfe3NkzdYCJNo9h5sjzrXNHa+sC3S79TnmMoGug9tI4mtEX7/xMKtbXleSTV0Y/C2DYw/sYHEXOpjBHuGQTUibAlCP9RwdoxVr202scd0HaTErk9Bf2tw0kX62iOs5Xt0egd0Mc/Tzli3bSSpG0MNWc58rYdWYZSqBODiWRDSi9bJBSDdac+NNosa2L6KmDrlA1bpEY6dR/EnIn+bNgm8q3nCqoF8Hl5HxssdeB2cl2Aec3KgUaVfwItJH7as07gbW1n7peG3r8DeWucVODHOOK2LUPmNvrrs2KBbMX6qeU70Zswtom8H++7cmlHE1wi5mpgAfBhqgtnuP/NbROPIg3VEcZAAOWAAPe+7XAhESXEgxnKXLMoIOXSX7l+37OtcJB3tJcnSWI/QLYltK1iV8YltRwpNMPC4rdAT2UmOKkpZiuLZcGL+Z6b2KR6Iyar6YGOKh8z+xR08DXxEs0MJ9VktnoP0A5dMnwTUfs18c3kVvozfId86fwdsgMMqRTYvXdsOLyi6NGrYPwRb5pPu33fp+VKwh9n6azfh216ZbRFNY1OBUJOZm4GQks+ygzOCjHkqZLqpecJcSXYI8u9ztAgMBAAGjMjAwMB0GA1UdDgQWBBQpiOlMEUzlCotVDcCWs4U/jF6TbDAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQAkcW9KcZUqILeoRYgWg6OzvZHSmDtp17uH9+TI4EJpozASN53gwcBcASX15k3s3IaELck93KX/R+B1l6XlFYzfd5POToC8oapL5R+Yb2a5edlyWm22qsc3TI6IoI4yf+0KqY4eYfDplt6/PfW6QWLYEuC13L3teF6jbiApsJB1aUq+vLgN+N3YbpzNKJkPopQTtVvwskLeO6xNeADF3EL5RE7tpKT7AGA4dxEpMB9uRY0Ty+hQwNh8fTaOcdqicNs9c2YP4X6RYE+35iSoIkqPtLb251tAoM/zPkqJwt3GJvJpTDeFcpbpUseEKWh1KSdhD5aYbJC9wgRv8VKmbCocKpUhCgNEJwLqXT2gVxKmkoi/OCmRYKniheku691eUwxJl7/3GjskOiOCIWO+ujT9Ma7OzGhzVcS0u4mxeTnHqi2b1lTIVosqFMcOdSa7csdfeedzx8tJqceHGXC4UTYnZwjdd5Z0cYUPj/y9nc6i67oIezxcqazGnSD/sSaguvSq9f1ej6EE+MQJ+5QLJEguu0YM+SDnSf5Kjm6Htz2nnWtVs8TQGrHz+f/eIrurdYvlY8za1KV1qSjRGLGwbXW1jQdnf3r2ZhF/zHl+/i9munZbX8FNFvu7KgmzrYo5Lz+f7KBk5W4LFMRUQ3eF9zlTxKHVJjIQuCcLw5rfhSnA6A==
ServerSignature

wepay.in.net,www.wepay.in.net,slotmachinesno.sa.com,www.slotmachinesno.sa.com,digitalhari.in.net,www.digitalhari
Install

true
BDOS

false
Anti-VM

false
Install File

cfservice.exe
Install-Folder

%AppData%
Ports

80,443,8080,8848
Mutex

gb8Arf95yD6I
Version

0.5.8
Delay

3
Group

Default
Artefacts
Name
 Value Location
Key (AES_256)

OWUxT2t6TEVYNk5xeGFSSGVkdkVRalpLNEE0ZEhsYmQ=

Malicious

4898b4159d8db22f29734386332d6a66
Ports

80

Malicious

4898b4159d8db22f29734386332d6a66
Ports

443

Malicious

4898b4159d8db22f29734386332d6a66
Ports

8080

Malicious

4898b4159d8db22f29734386332d6a66
Ports

8848

Malicious

4898b4159d8db22f29734386332d6a66
Mutex

gb8Arf95yD6I

Malicious

4898b4159d8db22f29734386332d6a66
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙