Malicious
Malicious

4c20dd90c9cd3a6606b5ead7450504a2

PE Executable
|
MD5: 4c20dd90c9cd3a6606b5ead7450504a2
|
Size: 46.08 KB
|
application/x-dosexec

Print
Infection Chain
Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Low

Hash
 Hash Value
MD5
4c20dd90c9cd3a6606b5ead7450504a2
Sha1
63cd5b2e86b5adc0d7e0e76e1fc1ac187d85a1da
Sha256
3b97b802f4376288184d8e5d3dc7f7691de98ce36052047b63189541b492e2a9
Sha384
08ab927eda14119152f10cd20083c29e1d0ef3190752ec428dca591631f25b6c0ed5871badb47a805e76e7f8e0da399b
Sha512
ebf77047a9e7d6ea8823e03d563f78eca7d3236708a209f3e5cd8742e8d121adc78dcb2ecfe3c9c652eeb91dc3be2d290d2e0a0bd307acc3973d469a710fad26
SSDeep
768:xu08VTBRlc6nWUbjelmo2qjrCHyTtpPI5zjbcgX3i3JUPRIqNBDZzx:xu08VTBncr2CnQ53bzXS3JUxdzx
TLSH
A9231B003BE8813BF2BE5F78A9F25145867AF1672603D54E2CC4419B5713FC69A42AFE

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
4c20dd90c9cd3a6606b5ead7450504a2
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Malware Configuration - AsyncRAT config.
Config. Field
 Value
Key (AES_256)

YW5WVzFNcmVnY0JpSDJkcUhCSDZIRlhjb21rSzViUnI=
Pastebin

-
Certificate

MIIE8jCCAtqgAwIBAgIQAMe2RPGvgLeh2W+22L9dzTANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjYwMTA4MjEzOTIzWhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKlSPhm4sudTYozvVH+aKxeOFLhzY9G8w+SpWdIqAtfXo04IyhryAYEWgV+2SCMEyPKbStZDSYLVOxRAk2GD3e0D8upALRsM6E5mSYqx7foQA9D2MdzBKhzmPDqtyet4vL/n8n/fMdbxRnFbwr4x7LfjCgdgaTJkLZwqE9tjEaoWNCjpFmZrHm73Q8Luqv9JrYRfxMUN8gFyKEEJxtjhZSpw0/IUsLUC81jyzBwsjz4HUIlpoM8sB1uy8Fm27fKq+MGxEGDw1Z1wYiU0cLSZb1BRvvpX/79mOoqG2Gd8uWq/Lx4UTEqz07uBFe26f4GqYVJqWV9xBdGDDPjOYtsG+CAFpJCmyDfhWRRr3Oythbueyg1E7oxctZDXAeT5SF75WDfhL4qRPThbX1A+UnZGaoWK0BVrHECSS5j6D+asuhkpu03TcWPen73U4ssUMiZ5qkBg9k29llvXAyStTTz8scx/4TdTNBj8y7AbWGwC5TA8/JeBtbpV8H67MJ526GUkZ5UIpeWHJmgtnvqi4D0yRhz6ZjlZI+A8ZLIB6dZOUCzCX2SVrQXjSZHaiLGXi2sxOKC1t8XVNJAub9Cna/PSZ9pD17hUxBbM22KnzpXRp3RHzAETR6407dHmP6x1sfdcQEcJWcHnwEgJ7R9B5z5J4axzOrx6FaZq5GduHjMBLLjvAgMBAAGjMjAwMB0GA1UdDgQWBBS2hoUzaIB/mdhWbTw2ufXC5nwrljAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQCQ4Um/7RyKF6oQpWrV1HkYGLgZsC4nrAUZu2T9Svcp42hrYME0J7vqIXP/L9u3H2ywaP7MEreKIyL7rpqPV5ZHOSrST1n7AMgXlMrXDuSIrRk12VPql8KhLrhUE6SsUcY46KUr4RdrfqPn8kgOk+cj0UwjXtx/Qwdsnb+NQfffMiGEF2jKYtMP5TRQkKN1DNZMXd/h1WTL+ILDApDpO4WQAZZ69yqe2Q4dsLJHOQcV0r9XC+J+rNa34UM5rinv5QKYPmgCkRCK80Erv49M/MUfiaKRu4KTlKPZ75vPe6X7SWPl0jqy8Xeg51kzM8bXfeuTNZ4M8O9doFMdhKPoXX3g6tf0S3nmTewwX9Q3A+jAH7b9p+HeWQGc/BWjQlk3X7r7DnuNVNi7srEZnWCTBgxkVLakKK7fR7wmESSMNCR8q6nwWratsuCN9MJsbj9ljoSxL9PxnxrwuxWZ0RCuY7RJRLbNHu7SckkKT12vpbpFSfQAP1zeVs7vlB0dIPcqjcSGMbbCkm87yVdXszQfFP0zNO1GvxaokOOHCBA0Lu9b686Qcwg8pVwjNEWtQmy+raIxwYJ1Ihzngo7euL/gwShIgy8GVNPbqTeBmLtZOglp4Hmp3tyKQgmgkohyrJKsvTncCFIC2s2hCJlYPE2wz7P1U8DPo/QlxgWz+eT+ZGGXsw==
ServerSignature

BRyxC8/bfnccTL3/6jNLyLhMftTYy7BtMvVRIqnRDTy31Z5PhsDKr9jbimca9u2aavVYpmmisM/x7v+lLYK2yqGi8IMPrlkbPMSJC8phwPQYWZViKLfp1AzVSL+j1Wr2JVUnR5MaCO1MWeNID0BdHY+i67njFlpLYZlVfDdENr0dODV0Zq8ln49/CmAP+/ghY73P2F8wx31jH6WSK80kuaAkDluwyDWLXMgXpk6PMbCaJiH3gNN4sqH6DqOSuuyVpkZ78QMBqBANrrTv3VWdeO0allYw1GeRxHHgF3ct/HmuCc0Ja5bloxRpaoC2m7Le1gOMfgE26YPvePBPoct/+hrskOZFvLGuEsZFR2mbTGnTZJPuAIxR8sb3GzbhBNMSQdj/191kFvPobkI649pdJOqfDM3gRF3OuE56DaeuQziaYlG3wbVGhcxcodoU98dej2F9crfkgdUAR+AfuhDTl6sQRi4tJ0F54iklUHE57652kWCEYb85rDRUq4Uj2EymvTR/zJd7V+Y7dAiqYN1OvysC7Zt8EwjwW+fLjudFaGIAA/2j1gU7oloT8eDHlRH8vhq2soyhyui58dU3J8WtgNM6iK4yt3oRdY/QTXAe1p43xVK+iKhO4tvse+Ulff+0HZec7GrLoh9iJULGG1Uc0RVj+fFaJ9s3REvb01IAt/w=
Install

true
BDOS

true
Anti-VM

false
Install File

WINUPDATE.exe
Install-Folder

%Temp%
Hosts

127.0.0.1,duckdns2233444.duckdns.org
Ports

6606,7707,8808,55667
Mutex

LebJ7wIpPfmc
Version

0.5.8
Delay

3
Group

Default
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

stuff2.exe
Full Name

stuff2.exe
EntryPoint

System.Void Client.Program::Main()
Scope Name

stuff2.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

stuff2
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

120
Main Method

System.Void Client.Program::Main()
Main IL Instruction Count

51
Main IL

ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0043: ldsfld System.String Client.Settings::Anti ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String Client.Settings::Install call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() ldsfld System.String Client.Settings::Install call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BDOS call System.Void Client.Install.NormalStartup::Install() ldsfld System.String Client.Settings::BDOS call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.ProcessCritical::Set() call System.Void Client.Helper.Methods::PreventSleep() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Module Name

stuff2.exe
Full Name

stuff2.exe
EntryPoint

System.Void Client.Program::Main()
Scope Name

stuff2.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

stuff2
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

120
Main Method

System.Void Client.Program::Main()
Main IL Instruction Count

51
Main IL

ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0043: ldsfld System.String Client.Settings::Anti ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String Client.Settings::Install call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() ldsfld System.String Client.Settings::Install call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BDOS call System.Void Client.Install.NormalStartup::Install() ldsfld System.String Client.Settings::BDOS call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.ProcessCritical::Set() call System.Void Client.Helper.Methods::PreventSleep() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Artefacts
Name
 Value
Key (AES_256)

YW5WVzFNcmVnY0JpSDJkcUhCSDZIRlhjb21rSzViUnI=
CnC

127.0.0.1
CnC

duckdns2233444.duckdns.org
Ports

6606
Ports

7707
Ports

8808
Ports

55667
Mutex

LebJ7wIpPfmc
4c20dd90c9cd3a6606b5ead7450504a2 (46.08 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙