Malicious
Malicious

5d01c404254dd5d15f8828b79888871b

PE Executable
|
MD5: 5d01c404254dd5d15f8828b79888871b
|
Size: 66.56 KB
|
application/x-dosexec

Infection Chain
Summary by MalvaGPT
Characteristics

Symbol Obfuscation Score

Low

Hash
 Hash Value
MD5
5d01c404254dd5d15f8828b79888871b
Sha1
60e5610de4e47dfc0bf17d3d4400a421dbb5dade
Sha256
44e7805af68d6e43a8fbb325f7d73cf3a586f4406c0d0c0c9f6b0cb4af8e818e
Sha384
dd3e856c994fb5c1954a6ba4c4ffcf1cb13e0a9ffebbc7c097d970ef829b34c15a454697e6ee514054fa76cdb1b690d5
Sha512
c986a31c8c798c82880846b05b3672ed8ed5bdeb463a9b63719af8686311880c26ab6931e1d17951d186b848f0b8d838dc29c7327185517addd111bfae0b58c5
SSDeep
768:q7kGU6pMiPtZaid9JGecXveeObMbNCl1+6SCv7mqb2nIpwH1o+fgSg8GFwW03+VS:qZpnjreeiMl8GbbXwX9GFk+VclN
TLSH
43535C002788C926E1BD4AF8ACF2554046B5D9732102DB5EBCC814DF6B9EFC64A527FE

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
5d01c404254dd5d15f8828b79888871b
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Malware Configuration - DcRat config.
Config. Field
 Value
Key (AES_256)

WHpua0xidFYxQlVBQ1pEZjBKdDdmMWdmNWVmOTI5cVI=
Pastebin

-
Certificate

MIICMDCCAZmgAwIBAgIVAP0QIY2D27v91GD/9sTosjXLTrJdMA0GCSqGSIb3DQEBDQUAMGQxFTATBgNVBAMMDERjUmF0IFNlcnZlcjETMBEGA1UECwwKcXdxZGFuY2h1bjEcMBoGA1UECgwTRGNSYXQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTI1MDMzMDE3MjMwOFoXDTM2MDEwNzE3MjMwOFowEDEOMAwGA1UEAwwFRGNSYXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAIjplJRTZ715id+ji+ZR2yooLmAV+LU3dU16Iz8E/3oPJoWnXhe0Y77WZvfoZuRHIY0i23PApzS9xfUB270M+vYeuJvb8XcViRJOZc81/7Gg9ytwQU5ig+EXaibCHzTfdijdyW4plr3zmz8QLsTVKOKHs0XdD1kjYqRhrRi2iNpzAgMBAAGjMjAwMB0GA1UdDgQWBBQEoo+pVjS8K5IvG0uqgWnMR0cnXTAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4GBAAEGMvSJtVDTo18hK5laZrriX04rGMnPEvW14eSJHOYe7iXsIpcCVD2t5UAJcr6SU/PXUrC7m09qfLYBSFY/Exxcrxg/PibtoB2o5LjS41etlANjNfLHTVaH5hFNhdj1gUDv/KC1LYM5/y31e1pGq95UkjnX4ier+6VMB0YsCdHM
ServerSignature

Sxw0jKB9dkk9+NEK6RQgkQi42+8Y6AVZMs1DoGY0qtgW9y2UMjHGbkH8uSdENgLfZp2gv5F3TJ4SAAsCvZcKAgK+zB38WJK0eBjvQhAHE7p297/AomzeoC1AeLSKUGNufg6aDN4qQ9WssDl2Uyk0nNuU4ynJdG9J492DdejHW+4=
Install

true
BDOS

false
Anti-VM

false
Install File

TitanStrategicImperium.exe
Install-Folder

%AppData%
Hosts

fnlipr.ru.com,www.fnlipr.ru.com
Ports

80,443,2053,2083,2087,2096,4782,8080,8848,8888
Mutex

TSCC_ImperiumStrategic_TitanLock_1j2k3l4m
Version

1.0.7
Delay

1
Group

Horizon
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

Client.exe
Full Name

Client.exe
EntryPoint

System.Void Client.Program::Main()
Scope Name

Client.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Client
Assembly Version

1.0.7.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0
Total Strings

157
Main Method

System.Void Client.Program::Main()
Main IL Instruction Count

77
Main IL

ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::De_lay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> ldsfld System.String Client.Settings::An_ti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0047: leave IL_0052 call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() leave IL_0052: call System.Void Client.Helper.A::B() pop <null> leave IL_0052: call System.Void Client.Helper.A::B() call System.Void Client.Helper.A::B() call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0067: leave IL_0072 ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) leave IL_0072: nop pop <null> leave IL_0072: nop nop <null> ldsfld System.String Client.Settings::Anti_Process call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0087: leave IL_0092 call System.Void Client.Helper.AntiProcess::StartBlock() leave IL_0092: nop pop <null> leave IL_0092: nop nop <null> ldsfld System.String Client.Settings::BS_OD call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_00B1: leave IL_00BC call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_00B1: leave IL_00BC call System.Void Client.Helper.ProcessCritical::Set() leave IL_00BC: nop pop <null> leave IL_00BC: nop nop <null> ldsfld System.String Client.Settings::In_stall call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_00D1: leave IL_00DC call System.Void Client.Install.NormalStartup::Install() leave IL_00DC: call System.Void Client.Helper.Methods::PreventSleep() pop <null> leave IL_00DC: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_00F0: leave IL_00FB call System.Void Client.Helper.Methods::ClearSetting() leave IL_00FB: nop pop <null> leave IL_00FB: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_0110: leave IL_011B call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_011B: ldc.i4 5000 pop <null> leave IL_011B: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_00FB: nop
Module Name

Client.exe
Full Name

Client.exe
EntryPoint

System.Void Client.Program::Main()
Scope Name

Client.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Client
Assembly Version

1.0.7.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0
Total Strings

157
Main Method

System.Void Client.Program::Main()
Main IL Instruction Count

77
Main IL

ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::De_lay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> ldsfld System.String Client.Settings::An_ti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0047: leave IL_0052 call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() leave IL_0052: call System.Void Client.Helper.A::B() pop <null> leave IL_0052: call System.Void Client.Helper.A::B() call System.Void Client.Helper.A::B() call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0067: leave IL_0072 ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) leave IL_0072: nop pop <null> leave IL_0072: nop nop <null> ldsfld System.String Client.Settings::Anti_Process call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0087: leave IL_0092 call System.Void Client.Helper.AntiProcess::StartBlock() leave IL_0092: nop pop <null> leave IL_0092: nop nop <null> ldsfld System.String Client.Settings::BS_OD call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_00B1: leave IL_00BC call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_00B1: leave IL_00BC call System.Void Client.Helper.ProcessCritical::Set() leave IL_00BC: nop pop <null> leave IL_00BC: nop nop <null> ldsfld System.String Client.Settings::In_stall call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_00D1: leave IL_00DC call System.Void Client.Install.NormalStartup::Install() leave IL_00DC: call System.Void Client.Helper.Methods::PreventSleep() pop <null> leave IL_00DC: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_00F0: leave IL_00FB call System.Void Client.Helper.Methods::ClearSetting() leave IL_00FB: nop pop <null> leave IL_00FB: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_0110: leave IL_011B call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_011B: ldc.i4 5000 pop <null> leave IL_011B: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_00FB: nop
Artefacts
Name
 Value
Key (AES_256)

WHpua0xidFYxQlVBQ1pEZjBKdDdmMWdmNWVmOTI5cVI=
CnC

fnlipr.ru.com
CnC

www.fnlipr.ru.com
Ports

80
Ports

443
Ports

2053
Ports

2083
Ports

2087
Ports

2096
Ports

4782
Ports

8080
Ports

8848
Ports

8888
Mutex

TSCC_ImperiumStrategic_TitanLock_1j2k3l4m
5d01c404254dd5d15f8828b79888871b (66.56 KB)
File Structure
5d01c404254dd5d15f8828b79888871b
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Characteristics
Malware Configuration - DcRat config.
Config. Field
 Value
Key (AES_256)

WHpua0xidFYxQlVBQ1pEZjBKdDdmMWdmNWVmOTI5cVI=
Pastebin

-
Certificate

MIICMDCCAZmgAwIBAgIVAP0QIY2D27v91GD/9sTosjXLTrJdMA0GCSqGSIb3DQEBDQUAMGQxFTATBgNVBAMMDERjUmF0IFNlcnZlcjETMBEGA1UECwwKcXdxZGFuY2h1bjEcMBoGA1UECgwTRGNSYXQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTI1MDMzMDE3MjMwOFoXDTM2MDEwNzE3MjMwOFowEDEOMAwGA1UEAwwFRGNSYXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAIjplJRTZ715id+ji+ZR2yooLmAV+LU3dU16Iz8E/3oPJoWnXhe0Y77WZvfoZuRHIY0i23PApzS9xfUB270M+vYeuJvb8XcViRJOZc81/7Gg9ytwQU5ig+EXaibCHzTfdijdyW4plr3zmz8QLsTVKOKHs0XdD1kjYqRhrRi2iNpzAgMBAAGjMjAwMB0GA1UdDgQWBBQEoo+pVjS8K5IvG0uqgWnMR0cnXTAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4GBAAEGMvSJtVDTo18hK5laZrriX04rGMnPEvW14eSJHOYe7iXsIpcCVD2t5UAJcr6SU/PXUrC7m09qfLYBSFY/Exxcrxg/PibtoB2o5LjS41etlANjNfLHTVaH5hFNhdj1gUDv/KC1LYM5/y31e1pGq95UkjnX4ier+6VMB0YsCdHM
ServerSignature

Sxw0jKB9dkk9+NEK6RQgkQi42+8Y6AVZMs1DoGY0qtgW9y2UMjHGbkH8uSdENgLfZp2gv5F3TJ4SAAsCvZcKAgK+zB38WJK0eBjvQhAHE7p297/AomzeoC1AeLSKUGNufg6aDN4qQ9WssDl2Uyk0nNuU4ynJdG9J492DdejHW+4=
Install

true
BDOS

false
Anti-VM

false
Install File

TitanStrategicImperium.exe
Install-Folder

%AppData%
Hosts

fnlipr.ru.com,www.fnlipr.ru.com
Ports

80,443,2053,2083,2087,2096,4782,8080,8848,8888
Mutex

TSCC_ImperiumStrategic_TitanLock_1j2k3l4m
Version

1.0.7
Delay

1
Group

Horizon
Artefacts
Name
 Value Location
Key (AES_256)

WHpua0xidFYxQlVBQ1pEZjBKdDdmMWdmNWVmOTI5cVI=

Malicious

5d01c404254dd5d15f8828b79888871b
CnC

fnlipr.ru.com

Malicious

5d01c404254dd5d15f8828b79888871b
CnC

www.fnlipr.ru.com

Malicious

5d01c404254dd5d15f8828b79888871b
Ports

80

Malicious

5d01c404254dd5d15f8828b79888871b
Ports

443

Malicious

5d01c404254dd5d15f8828b79888871b
Ports

2053

Malicious

5d01c404254dd5d15f8828b79888871b
Ports

2083

Malicious

5d01c404254dd5d15f8828b79888871b
Ports

2087

Malicious

5d01c404254dd5d15f8828b79888871b
Ports

2096

Malicious

5d01c404254dd5d15f8828b79888871b
Ports

4782

Malicious

5d01c404254dd5d15f8828b79888871b
Ports

8080

Malicious

5d01c404254dd5d15f8828b79888871b
Ports

8848

Malicious

5d01c404254dd5d15f8828b79888871b
Ports

8888

Malicious

5d01c404254dd5d15f8828b79888871b
Mutex

TSCC_ImperiumStrategic_TitanLock_1j2k3l4m

Malicious

5d01c404254dd5d15f8828b79888871b
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙