Malicious
Malicious

4c46fd77e3f55e21d9f0f7cd6a764090

PE Executable
|
MD5: 4c46fd77e3f55e21d9f0f7cd6a764090
|
Size: 50.18 KB
|
application/x-dosexec

Print
Infection Chain
Summary by MalvaGPT
Characteristics

Symbol Obfuscation Score

Very high

Hash
 Hash Value
MD5
4c46fd77e3f55e21d9f0f7cd6a764090
Sha1
4d1b69fb2ca6c62bd404597529a0abf90c314922
Sha256
7ae1e894c951be1d610fa3914360463914b3477c99a943d679d3c69b1e052212
Sha384
4220a21e70b6556f137a1d7a831db77cc51fc6e8bd24bb6459225ab6b0eef8e915981deb1c4ad0366997aee18ff93b6d
Sha512
dc7d7ca48a6c1d961775f492168a5ddbc6216ee23aaa9e375213c30d4233d938ef2c5d0f5efd0c52ebc82df6721182849ba443971fafa96f7b6f3961a964901e
SSDeep
1536:Gu9iRTVC22w7Gn60Hlz4bZNuiLxM/yk1d2x:Gu9STVC22w660FUbZNPKRcx
TLSH
1B331B003BE9C12BF6BE5F7858F22145857BF5633603D65E1CC4429B5A13BC29A42AFE

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
4c46fd77e3f55e21d9f0f7cd6a764090
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Malware Configuration - AsyncRAT config.
Config. Field
 Value
Key (AES_256)

dFVZN3RSSWM3VTVvQmhkRUV2M3N4QWIwbE1MTXNnS3Y=
Pastebin

-
Certificate

MIIE8jCCAtqgAwIBAgIQAIZMhXFGE5Y3RoSyBbvf0TANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjYwNDI4MTExNjI4WhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKrwVkcnBgXUyhAooY6q+UJsCi27nP0i2MlJG3HDEhuhS0ISzD0XBuuSXhTlGdvJqomv4I/pFxdEkstobKM7z852Vd01sx19HDSLilbGAke9yRbZp/TqKe60+RK8QQcnPUeJ4kiQijuDXKTrbkCdeytGVkMskvJQCWU2C8u+5LrXSDY2baID7kz4umKqU8PQl4imOQF+ewuxKmL5JC/ns9E11WfYE2KgD04145WLXwBkYRttXyaqTV704yTI6bZ2UpZ+naTLmyGgRVkYNYQqBLdTJ75sFgvkWcE5jECqVHowDv252RT4/qTTod7uYvWo0FG2AO7JjU3mLLxI+paxUA7GuYP+NrdAOVHGajgnWUL2JFv+XtEtQjWtuMRlQs1TDz0IUUwHQktrjYQC0yyUEUf4zMz/Qgb2NvVLziwST+6r38D7i8ckP0oxwO41HH+OQYqJ1Ecsaek5Ukxt/ZyyWSJSOy89jmAepBoogd5lzh+8g5CHB0tQrxl6rk0CdvKMtuspw+em9UT/mv3kWL/cqc5d3JLEYsFNGHPZbdMsoftCS+xWJVGQWObzs8iLabOTuNLmMHnffZUXcTfzSIriphoGejFy6Q9B9HI7WyWpzZLDD/fjb/4RVccUpo+ti8mnLP6owl4/IEkv2db5Lg8yxZgd0bCh+t61PbheRgv3a5vrAgMBAAGjMjAwMB0GA1UdDgQWBBQz9hwirkKpHBfj+59FVOjJgNy05DAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQBJXhJGeFKO0O7/1NF2Qzke7rx8Qif9n58/QLGfaVuGqKqVS0PQzVHOJPgiggWcGHaUBKmpKSzffOMGKlRcHAJUegd8j6amZeorYAliD0BpwXu2HsxEWKq/nzEF37pFEL/VTFjPSeYNtgEDgIjRZOHq9sNjr5bnjjZ9Ze4x2GrpSKi69bw+px9/V9XcSMZySRN65Ky7N2m+/SQdt5LLVm+2dsBLuPt/oCawYo3Ja82cKk9frrUPJUASl5Betxmh3WkVf5gvCvNKwY+KWCRDNGIA2rNr1B1RlthRcxIrBrUs8zF7BoliT7A/goaIyVHoiDlthCYKBRFwq7OEvWkh80rrszDFVKcubutcTDdngwYAXYBPQH2JY5RmK9f4efHyuXy3oP5/OfNVmb4j56QXa6fKr3xT+IFApKPrmwLbeKS5dunuW1ULqv7Ph7LGgVJxpZhT16GEtBrONczZDWfSMesvrVUQL42QVNrNLObQNJZtBT0dhXBXI+ErqV7ECcozjL6uaQfDkri8z8cs2l22xK9XEQIbYPEQESaXkyQl5i9IocwuykP9emdj8qERLYTffImvgVCY7XXztrgS+vLTkV12IEYS9qDMs/AtbYwsD3wbiIaIcguymj/Tleus05CcMKhOSCI01QmWaBk5qs4lyOMdc1uFVu9LHmrtfwvBAPTpug==
ServerSignature

m7rsB/ytZqYW3hfHjXEe+23xeeSnF4QgKewWRz47kF2mUvDv69Pt47RhBQhCeFWGc0HXLWDEXUQjgj4zcnRHprm1zJbzNgo7SmHi5K6E68MOOTPkscV7KiZzc6Dg1IHkSX/sHvrNzzilgCMzsQTKBDl8ylSg1VegBFttmNi1ujbsKdvXo0NiUDyNuxn6Ny7TXDObGFwdOayh5s/Psb/gz0CKlFQH0DeuGd235W4b2ByygHDVK99kvjqo38+zzecXDA7AnsXq5HlwrS9Fe41hYr8f1PWWcXeOBRN3cBKcLhbvjMQY4uoNRrngy4osY3PDM4eVB4lNPUabLIMYho+3eF+YaHygBfPbcQJAzMiknbp3mNAP3mVJcd5TZOz6YXm+K97dA7B8PUefywXcCQc87tP5BTzMMHC0mFkNDu39XNjzxuWFLzFKNG6yOfKDkaV1H/fhiNRxuBDUkMfg7qbUbkjXucX6/JTFf3UC1M4W2RbVpDPHBjeSBwDzrCAn6l2Q5XN/nU59+v9wStM8KyN/0GA2LNmP2mBrqJH+BFnZusH/cOR4i6JKpBJT9iRTuG8VmbYWKgSn/nWh78lha+9Mj2QMwyu83k2zOFfQQL/j1UV4+TAdjNhtYchwuXI/YTqmkvnQy5AUojMB64VaWc9MMVBjotc5BAiTPSHPUw1YHnk=
Install

false
BDOS

false
Anti-VM

false
Install-Folder

%AppData%
Hosts

www.xoilacca.tv,xoilacca.tv,malware-drop.xoilacca.tv,ddos-controller.xoilacca.tv,exploit-chain.xoilacca.tv,document-share.xoilacca.tv,command-node.xoilacca.tv,prod-assets.xoilacca.tv,collector-backup.xoilacca.tv,node-01.xoilacca.tv,node-02.xoilacca.tv,node-03.xoilacca.tv,watchtower-ui.xoilacca.tv,scanner-feed.xoilacca.tv,signal-bridge.xoilacca.tv,app-shell.xoilacca.tv,db-mirror.xoilacca.tv,snapshot-node.xoilacca.tv,mail-relay.xoilacca.tv,botnet-panel.xoilacca.tv
Ports

443,6606,7707,8000,8080,8808,49152,50001,54321,57001,59999,60123,61000,62000,65000,65001,65002,65533,65534,65535
Mutex

t3G5mw659Dxg
Version

0.5.8
Delay

3
Group

Default
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

QYLbBqPItNxpt
Full Name

QYLbBqPItNxpt
EntryPoint

System.Void ZgYWuJGqwFud.JyKcLWJvlS::Main()
Scope Name

QYLbBqPItNxpt
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Bonus_Deposit
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

120
Main Method

System.Void ZgYWuJGqwFud.JyKcLWJvlS::Main()
Main IL Instruction Count

51
Main IL

ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String ZgYWuJGqwFud.PuNlPbfgriWzd::wokMhTetbY call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean ZgYWuJGqwFud.PuNlPbfgriWzd::NJzHolXexIb() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean gLxSjmcuyG.jqCbxAFrJhITdx::LqIXHHzflBORMHv() brtrue IL_0043: ldsfld System.String ZgYWuJGqwFud.PuNlPbfgriWzd::XiDGtLbsiQjbl ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String ZgYWuJGqwFud.PuNlPbfgriWzd::XiDGtLbsiQjbl call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String ZgYWuJGqwFud.PuNlPbfgriWzd::OhofjMfmFDEDm call System.Void gLxSjmcuyG.gVIRWIUNulMU::asTOZUqvapcb() ldsfld System.String ZgYWuJGqwFud.PuNlPbfgriWzd::OhofjMfmFDEDm call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String ZgYWuJGqwFud.PuNlPbfgriWzd::LkBgncQlnuhjDf call System.Void RaMxNPqOZLBp.xsAirqhvmdEb::kokvyofwldBk() ldsfld System.String ZgYWuJGqwFud.PuNlPbfgriWzd::LkBgncQlnuhjDf call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void gLxSjmcuyG.dPMspMLDrn::DTgMNVyjHLogt() call System.Boolean gLxSjmcuyG.dPMspMLDrn::JPxOkwlMjQltRc() brfalse IL_0089: call System.Void gLxSjmcuyG.dPMspMLDrn::DTgMNVyjHLogt() call System.Void gLxSjmcuyG.SWuQDjgQybft::uaYXvxppfRgcK() call System.Void gLxSjmcuyG.dPMspMLDrn::DTgMNVyjHLogt() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean ttTVpyDngLW.mMTHLmndcqOjwuw::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void ttTVpyDngLW.mMTHLmndcqOjwuw::AwGFMRufgbTtDh() call System.Void ttTVpyDngLW.mMTHLmndcqOjwuw::vmqluBkYwXnjxvSYW() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Module Name

QYLbBqPItNxpt
Full Name

QYLbBqPItNxpt
EntryPoint

System.Void ZgYWuJGqwFud.JyKcLWJvlS::Main()
Scope Name

QYLbBqPItNxpt
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Bonus_Deposit
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

120
Main Method

System.Void ZgYWuJGqwFud.JyKcLWJvlS::Main()
Main IL Instruction Count

51
Main IL

ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String ZgYWuJGqwFud.PuNlPbfgriWzd::wokMhTetbY call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean ZgYWuJGqwFud.PuNlPbfgriWzd::NJzHolXexIb() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean gLxSjmcuyG.jqCbxAFrJhITdx::LqIXHHzflBORMHv() brtrue IL_0043: ldsfld System.String ZgYWuJGqwFud.PuNlPbfgriWzd::XiDGtLbsiQjbl ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String ZgYWuJGqwFud.PuNlPbfgriWzd::XiDGtLbsiQjbl call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String ZgYWuJGqwFud.PuNlPbfgriWzd::OhofjMfmFDEDm call System.Void gLxSjmcuyG.gVIRWIUNulMU::asTOZUqvapcb() ldsfld System.String ZgYWuJGqwFud.PuNlPbfgriWzd::OhofjMfmFDEDm call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String ZgYWuJGqwFud.PuNlPbfgriWzd::LkBgncQlnuhjDf call System.Void RaMxNPqOZLBp.xsAirqhvmdEb::kokvyofwldBk() ldsfld System.String ZgYWuJGqwFud.PuNlPbfgriWzd::LkBgncQlnuhjDf call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void gLxSjmcuyG.dPMspMLDrn::DTgMNVyjHLogt() call System.Boolean gLxSjmcuyG.dPMspMLDrn::JPxOkwlMjQltRc() brfalse IL_0089: call System.Void gLxSjmcuyG.dPMspMLDrn::DTgMNVyjHLogt() call System.Void gLxSjmcuyG.SWuQDjgQybft::uaYXvxppfRgcK() call System.Void gLxSjmcuyG.dPMspMLDrn::DTgMNVyjHLogt() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean ttTVpyDngLW.mMTHLmndcqOjwuw::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void ttTVpyDngLW.mMTHLmndcqOjwuw::AwGFMRufgbTtDh() call System.Void ttTVpyDngLW.mMTHLmndcqOjwuw::vmqluBkYwXnjxvSYW() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Artefacts
Name
 Value
Key (AES_256)

dFVZN3RSSWM3VTVvQmhkRUV2M3N4QWIwbE1MTXNnS3Y=
CnC

www.xoilacca.tv
CnC

xoilacca.tv
CnC

malware-drop.xoilacca.tv
CnC

ddos-controller.xoilacca.tv
CnC

exploit-chain.xoilacca.tv
CnC

document-share.xoilacca.tv
CnC

command-node.xoilacca.tv
CnC

prod-assets.xoilacca.tv
CnC

collector-backup.xoilacca.tv
CnC

node-01.xoilacca.tv
CnC

node-02.xoilacca.tv
CnC

node-03.xoilacca.tv
CnC

watchtower-ui.xoilacca.tv
CnC

scanner-feed.xoilacca.tv
CnC

signal-bridge.xoilacca.tv
CnC

app-shell.xoilacca.tv
CnC

db-mirror.xoilacca.tv
CnC

snapshot-node.xoilacca.tv
CnC

mail-relay.xoilacca.tv
CnC

botnet-panel.xoilacca.tv
Ports

443
Ports

6606
Ports

7707
Ports

8000
Ports

8080
Ports

8808
Ports

49152
Ports

50001
Ports

54321
Ports

57001
Ports

59999
Ports

60123
Ports

61000
Ports

62000
Ports

65000
Ports

65001
Ports

65002
Ports

65533
Ports

65534
Ports

65535
Mutex

t3G5mw659Dxg
4c46fd77e3f55e21d9f0f7cd6a764090 (50.18 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙