Symbol Ofbuscation Score
|
Hash | Hash Value |
|---|---|
| MD5 | 575cd6a9c08cc71abf27eaa866c53a38
|
| Sha1 | 20c96e19c80b7edd6ef06b659b44234ae209dac7
|
| Sha256 | e992c9f8a6d6d9ac87b76709808abe18c5111d25c504fef2bf0bcf83b1503fa6
|
| Sha384 | 25dc08a598a5f4686be4cad666b97daf7c83855bbfd1b61d9057b3d5304c43326e443f30d8bc000ce966727fce4ca85e
|
| Sha512 | b4770c55421e335183431f7c2123b5da94f879a499d3310980292a09f37d496e3ef0dd33cca4c759b6f96a5e0847ec401b67f0e6edd30a205bdfa422874d889b
|
| SSDeep | 1536:QXnQve6zwzKCh5k4lYeSMU0mzDFQTeK5vTnqhSLe9d:nzkzKmlYeSZ0mzDFQR5vTBwd
|
| TLSH | 63633B1137CB8266D2FE4BB448F253444679F3273A03DB5A2DC451999E23BC62F416E6
|
PeID
|
Config. Field0 | Value |
|---|---|
| Key (AES_256) | a2N5SmRNRUVTMDdPTnY2aHRNck5Sc3NvSWhpU2Uza1E= |
| Pastebin | - |
| Certificate | MIIE8jCCAtqgAwIBAgIQAK/dpmqrEcSxUlWOMa/7WzANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjUxMTIxMTI1NjQxWhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAJxwPDavGugjyFFf3pMTedr3CliyYdIC/d8n3b9CKrYK1kYpRovPWzQma5BVyRfYU4icx/FFZMX9FySVWnwyhhxIihwEo3n/bsujLu3Mf4Xq+8juUlg5eqZSgeVyqQj4GxE8gYYpAAcghsvdg8tzTxe7yY4W3S93nwc5F47vVh+XiWBGU0zdjVoorS3dK2i5yXCC1ZFzFetPTotnsBZ4Mu1OWsl6xz4AqfOsuiiXlQn3w0B3wy93vvShGOyNKta/fZfHO2uP50Km9JcjB/70ZZGoDCcLFNX302Au3vNkevJ2x4Iq5CGd0RkyLMB94SmCAFlBcBHv3+DIbgmetJF3kxJ4MeX85+LnESmgkgmbwzB1Z/S9u12DwSojieK5cCzwSX8eMy13YR4ShZn9ZgG6KZ+fQwf1FONV7uFd6POL5D9K1yLK+D/8rCHlkHcU6ROvME8t66x21ZNzdre1TZGBT7oBbQYby9DjpYkZz0YSSZGwGQBpF7KsBN/G4Dm974Lt790ySAylk0LcFBtS1s4/L1pdIbFH6eBE9NEiJjC4p6AKsLviIJyubyncgZdHDONsytflr76p3rs/yp7EDBeEqi+rdJGDchMmqeHhPdGq/nbXByVTyZifgLvrFM7yV4bQfvi7YewWPrrmVhkLFF5gqUmt0ZObit9QoSpFyjMzuLiBAgMBAAGjMjAwMB0GA1UdDgQWBBTycu7azxrq+9kI7symi+9TgVCMijAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQB6gLrnO/8dA3QW3f1d4D8fnH+25rfAiXet1FwbkIZMTgoCTxYtjPpB0jB4Uk2T/AZ6FXkyxz12aOhMGnd5kKCEF1h0QsdgL+5g8TIVGGlJLO1aibVLa8+Mtwhdbf8mUwA7SUpW7/Hqo9XSIl3eVy3A6qHi5J+TDqDivnOYUjuiscT6CGpCzP/6Zdz6/sNAnkZ9HkYqX9dZv5rVpkiIO8V2mN20gof3KoLvfiu0yyAAk3jLBE8O9CDPArDrY03je5+bYdobRi7/VlubwryeW3cqYroI4+SVpQB3WJcMzwbIsvH4Z/evl9Ir9R5BZKVEH1w3m+wnTYpXXBqQKhTbm0GAIhnUSgy0wiofH9ZQiboOQKtPpEqUhXt8FGuBIAlKEmvZpZQmzseRvy1XzI6Fe6+eBGBLigUQEPrvv6z7N+V2L+EMLsMrUXnvt0HGIxjhZ+aTk7vyqoLFUZuu4LGg33vwoVIjmTP/rg1UT2JrPM1tqM4WkZJKVJChKDBlxAiapJVO5yn8bMDAWNTjUe5kmUzCkB39ZheG0lCRWfQtLv+iRACrt6cwSyaHnph+s5rAydxqpCdelSizXUMHXSArn3H9HDhAk1sgjoxlUOP7jedBEw+8SgX/6Ch3G6l7OnOtWV8gWgPOQxI1nrGHvLO5suQEjdty2RDwMGyTFYN4dVxbiQ== |
| ServerSignature | bcGDOiSxHqfv5+ja/LjB7QadbrFi636ZrVBdpzbZgKgKF0mdboM+uWMddp4gYjgIAz+KYmV0qlgmkZcKKvGXkDgzuCXfUd9D/s/JrOpCWp30SBd+hAFnhFvSi5ZP+I63PBMkuD6I6LObbvlE7hKL90mG92OPL8eG+dZiWgb8NBg2oO29YpyhQk1283TuLS32hK/QJSNv/RH8gGDVUWPvjlg5XcmieeSSIPx+2/k8UCe7lFRJam4hoqohaa2ZcYAmg2J8yLlCwMuUSLCFFJzo8FS3VEhtuJtOHPha85Z83JWOwfzrW75ouF7En1N2InBSVvCgNR3YTBB/TkKCqLs3EsYhBKk4e/FKCXv+aAE0yFHqR5CeAyviWYKsQQRdc6+ThGe8Vl/ScZ4mh2FvLQTV+MzI+lPotNTQyaJ2HMho+wofjRka5szWVQ859i90RB9mPj6/art4eDOTU2PkGe2GthVTvqqEepbciR1EIZdneKgLe2e2tkmbqTxSosXvtdyBazDfKelJ91T5nsHeuRCkta9pVTywBy6FjEw6If9D4g865PCJdunTZb0AO4ZYrq50jQGjjyop/smSrhcVFRamlSAea0CvzKBThCkxcc80wWnLzRCOkGX83e6LxX5BqZfw2EE+qxInEgWxf31Wy9rY4PEoeqITxCt6 |
| Install | false |
| BDOS | false |
| Anti-VM | false |
| Hosts | shawwerma.ddns.n |
| Ports | 7000 |
| Mutex | 0.5.9 A |
| Delay | 5 |
| Group | 4ij9dvtCGI6a |
|
Name0 | Value |
|---|---|
| Info | PE Detect: PeReader OK (file layout) |
| Module Name | AsyncClient.exe |
| Full Name | AsyncClient.exe |
| EntryPoint | System.Void Client.Program::Main() |
| Scope Name | AsyncClient.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v4.0.30319 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | AsyncClient |
| Assembly Version | 1.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | .NETFramework,Version=v4.6 |
| Total Strings | 136 |
| Main Method | System.Void Client.Program::Main() |
| Main IL Instruction Count | 37 |
| Main IL | ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0035: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0046: call System.Void Client.Helper.Methods::PreventSleep() ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Client.Helper.Methods::PreventSleep() leave IL_0056: nop pop <null> leave IL_0056: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_006B: leave IL_0076 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_0076: ldc.i4 5000 pop <null> leave IL_0076: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br IL_0056: nop |
| Module Name | AsyncClient.exe |
| Full Name | AsyncClient.exe |
| EntryPoint | System.Void Client.Program::Main() |
| Scope Name | AsyncClient.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v4.0.30319 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | AsyncClient |
| Assembly Version | 1.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | .NETFramework,Version=v4.6 |
| Total Strings | 136 |
| Main Method | System.Void Client.Program::Main() |
| Main IL Instruction Count | 37 |
| Main IL | ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0035: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0046: call System.Void Client.Helper.Methods::PreventSleep() ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Client.Helper.Methods::PreventSleep() leave IL_0056: nop pop <null> leave IL_0056: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_006B: leave IL_0076 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_0076: ldc.i4 5000 pop <null> leave IL_0076: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br IL_0056: nop |
|
Name0 | Value |
|---|---|
| Key (AES_256) | a2N5SmRNRUVTMDdPTnY2aHRNck5Sc3NvSWhpU2Uza1E= |
| CnC | shawwerma.ddns.n |
| Ports | 7000 |
| Mutex | 0.5.9 A |
|
Config. Field0 | Value |
|---|---|
| Key (AES_256) | a2N5SmRNRUVTMDdPTnY2aHRNck5Sc3NvSWhpU2Uza1E= |
| Pastebin | - |
| Certificate | MIIE8jCCAtqgAwIBAgIQAK/dpmqrEcSxUlWOMa/7WzANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjUxMTIxMTI1NjQxWhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAJxwPDavGugjyFFf3pMTedr3CliyYdIC/d8n3b9CKrYK1kYpRovPWzQma5BVyRfYU4icx/FFZMX9FySVWnwyhhxIihwEo3n/bsujLu3Mf4Xq+8juUlg5eqZSgeVyqQj4GxE8gYYpAAcghsvdg8tzTxe7yY4W3S93nwc5F47vVh+XiWBGU0zdjVoorS3dK2i5yXCC1ZFzFetPTotnsBZ4Mu1OWsl6xz4AqfOsuiiXlQn3w0B3wy93vvShGOyNKta/fZfHO2uP50Km9JcjB/70ZZGoDCcLFNX302Au3vNkevJ2x4Iq5CGd0RkyLMB94SmCAFlBcBHv3+DIbgmetJF3kxJ4MeX85+LnESmgkgmbwzB1Z/S9u12DwSojieK5cCzwSX8eMy13YR4ShZn9ZgG6KZ+fQwf1FONV7uFd6POL5D9K1yLK+D/8rCHlkHcU6ROvME8t66x21ZNzdre1TZGBT7oBbQYby9DjpYkZz0YSSZGwGQBpF7KsBN/G4Dm974Lt790ySAylk0LcFBtS1s4/L1pdIbFH6eBE9NEiJjC4p6AKsLviIJyubyncgZdHDONsytflr76p3rs/yp7EDBeEqi+rdJGDchMmqeHhPdGq/nbXByVTyZifgLvrFM7yV4bQfvi7YewWPrrmVhkLFF5gqUmt0ZObit9QoSpFyjMzuLiBAgMBAAGjMjAwMB0GA1UdDgQWBBTycu7azxrq+9kI7symi+9TgVCMijAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQB6gLrnO/8dA3QW3f1d4D8fnH+25rfAiXet1FwbkIZMTgoCTxYtjPpB0jB4Uk2T/AZ6FXkyxz12aOhMGnd5kKCEF1h0QsdgL+5g8TIVGGlJLO1aibVLa8+Mtwhdbf8mUwA7SUpW7/Hqo9XSIl3eVy3A6qHi5J+TDqDivnOYUjuiscT6CGpCzP/6Zdz6/sNAnkZ9HkYqX9dZv5rVpkiIO8V2mN20gof3KoLvfiu0yyAAk3jLBE8O9CDPArDrY03je5+bYdobRi7/VlubwryeW3cqYroI4+SVpQB3WJcMzwbIsvH4Z/evl9Ir9R5BZKVEH1w3m+wnTYpXXBqQKhTbm0GAIhnUSgy0wiofH9ZQiboOQKtPpEqUhXt8FGuBIAlKEmvZpZQmzseRvy1XzI6Fe6+eBGBLigUQEPrvv6z7N+V2L+EMLsMrUXnvt0HGIxjhZ+aTk7vyqoLFUZuu4LGg33vwoVIjmTP/rg1UT2JrPM1tqM4WkZJKVJChKDBlxAiapJVO5yn8bMDAWNTjUe5kmUzCkB39ZheG0lCRWfQtLv+iRACrt6cwSyaHnph+s5rAydxqpCdelSizXUMHXSArn3H9HDhAk1sgjoxlUOP7jedBEw+8SgX/6Ch3G6l7OnOtWV8gWgPOQxI1nrGHvLO5suQEjdty2RDwMGyTFYN4dVxbiQ== |
| ServerSignature | bcGDOiSxHqfv5+ja/LjB7QadbrFi636ZrVBdpzbZgKgKF0mdboM+uWMddp4gYjgIAz+KYmV0qlgmkZcKKvGXkDgzuCXfUd9D/s/JrOpCWp30SBd+hAFnhFvSi5ZP+I63PBMkuD6I6LObbvlE7hKL90mG92OPL8eG+dZiWgb8NBg2oO29YpyhQk1283TuLS32hK/QJSNv/RH8gGDVUWPvjlg5XcmieeSSIPx+2/k8UCe7lFRJam4hoqohaa2ZcYAmg2J8yLlCwMuUSLCFFJzo8FS3VEhtuJtOHPha85Z83JWOwfzrW75ouF7En1N2InBSVvCgNR3YTBB/TkKCqLs3EsYhBKk4e/FKCXv+aAE0yFHqR5CeAyviWYKsQQRdc6+ThGe8Vl/ScZ4mh2FvLQTV+MzI+lPotNTQyaJ2HMho+wofjRka5szWVQ859i90RB9mPj6/art4eDOTU2PkGe2GthVTvqqEepbciR1EIZdneKgLe2e2tkmbqTxSosXvtdyBazDfKelJ91T5nsHeuRCkta9pVTywBy6FjEw6If9D4g865PCJdunTZb0AO4ZYrq50jQGjjyop/smSrhcVFRamlSAea0CvzKBThCkxcc80wWnLzRCOkGX83e6LxX5BqZfw2EE+qxInEgWxf31Wy9rY4PEoeqITxCt6 |
| Install | false |
| BDOS | false |
| Anti-VM | false |
| Hosts | shawwerma.ddns.n |
| Ports | 7000 |
| Mutex | 0.5.9 A |
| Delay | 5 |
| Group | 4ij9dvtCGI6a |
|
Name0 | Value | Location |
|---|---|---|
| Key (AES_256) | a2N5SmRNRUVTMDdPTnY2aHRNck5Sc3NvSWhpU2Uza1E= Malicious |
575cd6a9c08cc71abf27eaa866c53a38 |
| CnC | shawwerma.ddns.n Malicious |
575cd6a9c08cc71abf27eaa866c53a38 |
| Ports | 7000 Malicious |
575cd6a9c08cc71abf27eaa866c53a38 |
| Mutex | 0.5.9 A Malicious |
575cd6a9c08cc71abf27eaa866c53a38 |