4bbe27ba6f62d05cc08bef87f3b808d9

PE Executable
|
MD5: 4bbe27ba6f62d05cc08bef87f3b808d9
|
Size: 48.64 KB
|
application/x-dosexec

Infection Chain

Summary by MalvaGPT

Characteristics

Hash	Hash Value
MD5	4bbe27ba6f62d05cc08bef87f3b808d9
Sha1	e5c90b3a99f09b7a97689bf9007ddcbb43619058
Sha256	057ce719d259f34687589c6a31498b1edbdb84af194e6c7c0e5681497699e24a
Sha384	3e05ec02bb7040f8de9be7f4a9d2431da4d78203fc5db01fc529ee88b202521786d05a11812e31f8e3ea74f5121646e4
Sha512	a77244cf42fd8b0360b6e665806476e4cc9f8d4935b767606654b59192faa8f4533f7a22c83c8f8aed23c75a6a23099fe27464da4767395270ad6c2652249079
SSDeep	768:ABUQgNIL4+M0+LiZtelDSN+iV08Ybyge0V7HB33VvEgK/J/ZVc6KN:AB1gjsZtKDs4zb1T3FnkJ/ZVclN
TLSH	FE236D4037D8C136E2FD47B4A9F3A2458675E2676903CA5D6CC814EA2F13BC59A036FE

PeID

.NET executable

Microsoft Visual C# / Basic .NET

Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL

Microsoft Visual C# v7.0 / Basic .NET

Microsoft Visual Studio .NET

File Structure

Malware Configuration - DcRat config.

Config. Field0	Value
Key (AES_256)	S3VwQ2ZtV1RrQ2RkSG50WHpiNHNuaFc5YWM2RGxYU2w=
Pastebin	-
Certificate	MIICMDCCAZmgAwIBAgIVALDLHGORGC35yln9m9TGO6dkKn8pMA0GCSqGSIb3DQEBDQUAMGQxFTATBgNVBAMMDERjUmF0IFNlcnZlcjETMBEGA1UECwwKcXdxZGFuY2h1bjEcMBoGA1UECgwTRGNSYXQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTI1MDIwOTAyMjMxOFoXDTM1MTExOTAyMjMxOFowEDEOMAwGA1UEAwwFRGNSYXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAIl4KYoPge9992Q0L5f2MYvuMG5TOhNwE6cvJnLoQ7+n58Nn6UdngZWC5EVFcbMGS8gpnZsBqZWvxsdAqEvUYcEFNK46fII7YkPAaLxWOjTzTK4FZJNNNaIlyGwqStXD3GXBZJwGEOLu+DdVtT0xyqKH2P0AFcNKJly3FP16F3f7AgMBAAGjMjAwMB0GA1UdDgQWBBQsdlqZeQjwk7iR4kdb/T8WwDPUKzAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4GBACkjKHkaIP9wACL0EeZmt41D3+8WKX/+r+jxRKxsC1eaLOYzud5SlnLHMbI7SHjzPVGykzhw538QVoRGNWWrEtHTXaYoPJmomXPTt48ljX4Ki+JuVaoNUpSZarYn8VfZumtfqN3jJK9lJt59McaKjoARRpfyPz37If0wntAQf1vU
ServerSignature	QMhJIajfmzLpfY6p9EiABPDAPyM2jYyxmSkgmPwRe+s7I+3IIUJWT0y/6m6fRLY97YwQr3+uhY2dTxBlxQuQ/BnYX/P15/3bU885284kVw4BgmKd+ed65aMoic3TlT4Y1CFIiXYnYx/ibAaqQVej/7WOq/JHWy8COULxb7GK87Y=
Install	false
BDOS	false
Anti-VM	false
Install File	Chrome.exe
Install-Folder	%AppData%
Hosts	u888lm.com
Ports	443
Mutex	DcRatMutex_qwqdanchun
Version	1.0.7
Delay	1
Group	Default

Informations

Name0	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void Client.Program::Main()
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.0.7.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	150
Main Method	System.Void Client.Program::Main()
Main IL Instruction Count	59
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::De_lay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> ldsfld System.String Client.Settings::An_ti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0047: call System.Boolean Client.Helper.MutexControl::CreateMutex() call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0057: ldsfld System.String Client.Settings::Anti_Process ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti_Process call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BS_OD call System.Void Client.Helper.AntiProcess::StartBlock() ldsfld System.String Client.Settings::BS_OD call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: ldsfld System.String Client.Settings::In_stall call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: ldsfld System.String Client.Settings::In_stall call System.Void Client.Helper.ProcessCritical::Set() ldsfld System.String Client.Settings::In_stall call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_009D: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Install.NormalStartup::Install() call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_00B1: call System.Void Client.Connection.Amsi::Bypass() call System.Void Client.Helper.Methods::ClearSetting() call System.Void Client.Connection.Amsi::Bypass() leave IL_00C1: nop pop <null> leave IL_00C1: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00D6: leave IL_00E1 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00E1: ldc.i4 5000 pop <null> leave IL_00E1: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_00C1: nop
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void Client.Program::Main()
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.0.7.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	150
Main Method	System.Void Client.Program::Main()
Main IL Instruction Count	59
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::De_lay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> ldsfld System.String Client.Settings::An_ti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0047: call System.Boolean Client.Helper.MutexControl::CreateMutex() call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0057: ldsfld System.String Client.Settings::Anti_Process ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti_Process call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BS_OD call System.Void Client.Helper.AntiProcess::StartBlock() ldsfld System.String Client.Settings::BS_OD call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: ldsfld System.String Client.Settings::In_stall call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: ldsfld System.String Client.Settings::In_stall call System.Void Client.Helper.ProcessCritical::Set() ldsfld System.String Client.Settings::In_stall call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_009D: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Install.NormalStartup::Install() call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_00B1: call System.Void Client.Connection.Amsi::Bypass() call System.Void Client.Helper.Methods::ClearSetting() call System.Void Client.Connection.Amsi::Bypass() leave IL_00C1: nop pop <null> leave IL_00C1: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00D6: leave IL_00E1 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00E1: ldc.i4 5000 pop <null> leave IL_00E1: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_00C1: nop

Artefacts

Name0	Value
Key (AES_256)	S3VwQ2ZtV1RrQ2RkSG50WHpiNHNuaFc5YWM2RGxYU2w=
CnC	u888lm.com
Ports	443
Mutex	DcRatMutex_qwqdanchun

4bbe27ba6f62d05cc08bef87f3b808d9 (48.64 KB)