Malicious
Malicious

4f6a938c673e34cae29f6372ab72d9cf

PE Executable
|
MD5: 4f6a938c673e34cae29f6372ab72d9cf
|
Size: 77.82 KB
|
application/x-dosexec

Print
Infection Chain
Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

High

Hash
 Hash Value
MD5
4f6a938c673e34cae29f6372ab72d9cf
Sha1
89c5cca653e1b9d16770b4f2078c20b75c1a7133
Sha256
7bcaf39c620b923157f864ab3a85469d6f13b4525b140d26ab8ca68f50905fb9
Sha384
e58fbbc683b30cb647653eb556a14d58e1949b550c9325d56ddc25667154fd4b67f60314bd4181cd80e06c3a350f973c
Sha512
43fda6b4e3e40d6dbd8fff43180feb577f7d5605fdd01a14fd69ee227c0a08cc52e14a8d80c1d2b9c1f3956bde00ed9109d56841d3e25d2424aa35e4a662d704
SSDeep
1536:sH0k7aSaVr5gx4tAWlwigKAGXD58JUmF8JG:Wv7a/Vr+x4yigBqyJ8JG
TLSH
C5735B187BDBD536D2BD5A7A85E113040379E3563603DB5F2CC8029A0F13BC79F86A9A

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
4f6a938c673e34cae29f6372ab72d9cf
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
b0494a1f-4bd3-sFuO8sRWF2aQfulVj78LmA==
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Client.g.resources
aR3nbf8dQp2feLmk31.lSfgApatkdxsVcGcrktoFd.resources
$this.Icon
[NBF]root.IconData
progressBar1.Modifiers
$this.Language
$this.GridSize
Malware Configuration - AsyncRAT config.
Config. Field
 Value
Key (AES_256)

dnBRQm5TcWxJQzRjVlBRYmxmSWd1TUIxWnRzeXc1Y0I=
Pastebin

-
Certificate

MIIE8jCCAtqgAwIBAgIQAKxLlAkF1WRT8tAExBlQyzANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjIwOTIwMTQyNzUwWhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKrrWexesJSLqGeYC6kTxL6e4fbMdbCF6T1opNgSYFlyavRm733h8x2GXmzipr8dl/UHWmWcPmk8g2zwjmE7GxoR1aZvC706J8/1cezY8r/KN3wk63Og1nfs4IBpiAAS1FiZYe5mIVFU4np9SfOmuY/FdcCEd8OUu7UbHl28KhuwIMDKtBn2K/rCw9CIzH/KBD4ll1OszTjzf9NLX5bBhz42/lRQE3fvO2gHrewjgy99RFWXdo4YLOZiJqDSQLBMtVezMBTFgGGNeRMzAnwNFyl5/8h0T2GtcdqGhwOTYTQR+Rsj02iuogScF7rgqwrBr5uYxYrZoI36ewAdl2wN1JklGJRx11puu0hDRzCjrFE0CxXcVtdrIztzChIltYHZBKZyxRiZXGmvpZzPIzjCEO3ChXJTBdYqQP2aOQSBVEliDXuxuBNS11uRB1A/D6TQOAy0TWigbjfniDKBvzeSr3dnQxyjH6srvuGD6DFONwba7CVaKadGrmxreDm8vucoUYpaJ4cjOK+ouqQrG7btjHfDhc4MtgSSwR72/Me97QQ0Uybis0q0/im9hhKxZr6I0jhZglfZ/ouZiTjvPsT38azYeUXVo4uYmcbJ3RPTNVv9xwc3DPkFsMkRmDXCp2UWlGVSb7ZjeRz36kW7fnIiQbN2cG5levzLVAWtOjFwjr3/AgMBAAGjMjAwMB0GA1UdDgQWBBRnnpfEE8/fplVj0LmNEhbg781l4TAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQBYfqUFr9Bld91t6lqV5NrngVezAFI4ZBHTDxhyvkrPQZhVxCvGVhOl5WqtmkUrdkUQbs+BS3rm1BBi2c5F4cC5f02v4lehtsM+EXifLaAU5DCE0WQ+/5CCEBh5VZ5dWoszKSIJFZFzktODyhLHwix/SgNcQ7k4+NtAjb6LTg0rSzcDfttAHcgKTCHpIYxR4FdbEAJ0iwBK1w2oBj/aVm9/nW8mQlzTAIyeEIBcfAL95asjkTOj/MrTElXz09nulfPrVSElidHMHsMXMnn7VZKM5rzhpA/zwV/NGYV6U8f9pF+bwZ1ubJKANo0CbkxCMO6BzMwBj+5pdhVCi9Sl6wg9QyYI5RuICLN03MNGEU0G0tVLkMiE3uzx7/evyrTguZJaAOiTmcSrdoToTCpS7znuLwCRyCNMCu0iUxCxbVE27IRxtOJBtVYqUD2Na8ZjaJQPQ5T+afCaeorSXHPX+/TKaqJqPALKVjNt8D6iYPmUXGZy2ED5YxV+QxFi3kibZe3QmR8MnJJs82mz5Tj0czZoZCnEIhm3bRG2BOSXmtwEC1raIXlgYbxmYr4FGYeUBDPL+sDr38YZ3fW2kRvpxocsUrmzYEbqRr3oLFppdKQIbTFNmdtBXOtEfqj8XcERQ4VA3qtOrDFulsAp7lWtoW6Cw6iCcO/1UWkCk6yC0jqdJA==
ServerSignature

iEe5KtOIBuljaW8/9cwErzLQ0HGNtq7KV4AtESAPc/MrEczLf1U05qId7Yp12wUPzTGPZsYZfGlrD/OQ59rtGEsRRvVvgQcjoRAuGtNsaxVlSe5zrzrB9SatsxYfE5wli/c0mQaCXgyMS21TCcos2hDBkFiNUyUEcTL5Xqed42SJAvURxAJms1TR2H84u2+zSpbLN9pd1WbvaIPqCxPhH2f5RkYJOVMQyvK3heh4ECs5DYeZpITFBHSaEgpbmOqR81Z971U44s6bkhyhSKcUjPXv6UIAuGZKBEDQxpaDXr8MQ1SccRk53z54iRKRyVo4KgNtKMMc9dCzYgaXm7gefcdExpaYeGD41tWGest1vb8E1O7iP74bv5StIertn1QMIVYTvDjbSL8zFwbmV2wPjj38NZFBa3KOvdVvaiIbZZk2XKWbAXp5Mx1aBbsm4D/ZaJifnPolq64qC/dHsZCr5syEc+27jJkWmO/Xryu9f3OIo4cF385x4nZ21UO8ur3YOVYsRv7fDfOFoVwb2beR+hYlWF/I6alWBi6iknZ1RHnvDj/5L4X+T6tLE5naqzOuevLZUwSX4kU6QkD9fWBi6EqeUqWsfytu6BpeNUWLEnvj0I8OFQkwHondOs/zEVohpT9vKPcs+KtCI/LA3s9n5ed7z2LUbFbI
Install

false
BDOS

false
Anti-VM

false
Install-Folder

%AppData%
Version

0.5.7B
Hosts

andresperez9010302222.duckdns.or
Ports

8050
Mutex

AsyncMutex_6SI8O
Delay

3
Group

ANDRESPEREZ22222
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

SERVERANDRESPEREZ222.exe
Full Name

SERVERANDRESPEREZ222.exe
EntryPoint

System.Void <PrivateImplementationDetails>{C9D51624-7BE3-4530-BBD7-5A7744545664}::Main()
Scope Name

SERVERANDRESPEREZ222.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

SERVERANDRESPEREZ222
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0
Total Strings

135
Main Method

System.Void <PrivateImplementationDetails>{C9D51624-7BE3-4530-BBD7-5A7744545664}::Main()
Main IL Instruction Count

3
Main IL

call System.Void hyBi4B7CHOZ0PcM2da.BrEOWILUFmZ9AtRTw7::lLHifFIsCLsZtjvFfN0i() call System.Void Client.Program::Main() ret <null>
Module Name

SERVERANDRESPEREZ222.exe
Full Name

SERVERANDRESPEREZ222.exe
EntryPoint

System.Void <PrivateImplementationDetails>{C9D51624-7BE3-4530-BBD7-5A7744545664}::Main()
Scope Name

SERVERANDRESPEREZ222.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

SERVERANDRESPEREZ222
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0
Total Strings

135
Main Method

System.Void <PrivateImplementationDetails>{C9D51624-7BE3-4530-BBD7-5A7744545664}::Main()
Main IL Instruction Count

3
Main IL

call System.Void hyBi4B7CHOZ0PcM2da.BrEOWILUFmZ9AtRTw7::lLHifFIsCLsZtjvFfN0i() call System.Void Client.Program::Main() ret <null>
Artefacts
Name
 Value
Key (AES_256)

dnBRQm5TcWxJQzRjVlBRYmxmSWd1TUIxWnRzeXc1Y0I=
CnC

andresperez9010302222.duckdns.or
Ports

8050
Mutex

AsyncMutex_6SI8O
4f6a938c673e34cae29f6372ab72d9cf (77.82 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙