Malicious
Malicious

PE Executable
MD5: 64634744841a438beb671c6d0bb91fad
Size: 47.1 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Size
47.1 KB · 47,104 B
Hashes
MD5 64634744841a438beb671c6d0bb91fad Sha1 6cf7722d0fa7138d85b5a2c6d4f5b9b2035089dc Sha256 657c2518dc1d294cbf1ffeb4cb53af7cdf5584346a55fed926613083c8ee5a6e Sha384 502d3a290261377cc65a5fce15df5385a161669578ee02c42a63ae4d40485560586c67635df1be56208da362b5b6bf58 Sha512 60e4f1bcaa7823c6e09a9a8615c4c6670d06f7f09abf75dad36b12152d40c8a497a7b68709b01ab21fb1a0da92c23450f5f2d0ce9c7226755b4c9f47bc9d91e5 SSDeep 768:YCq/z5bX/wPLsekOicvHk3eHlWMPbPgF0qfUuSsI0wf22JMI1YI6OC22tYcFmVcl:YC7seXvZH0ub4FrcuS1hzT6O7KmVcl TLSH 23233B003BD9812AE2FE5FB8ACF1514187B6E6632603D65E3CC941DB1B137C6CA51AF6
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Low
1 malicious · 3 files
EXE64634744841a438beb671c6d0bb91fadAsyncRAT
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
Config. Field Value
Key (AES_256) b0FiVEhuhuhuhuhuhuhuhuhuhuhu
Pastebin -huhuhuhu
Certificate MIIE8jhuhuhuhuhuhuhuhuhuhuhu
ServerSignature IgKrlyhuhuhuhuhuhuhuhuhuhuhu
Install fhuhuhuhu
BDOS fhuhuhuhu
Anti-VM fhuhuhuhu
Install File syshuhuhuhu
Install-Folder %Aphuhuhuhu
Version 0.huhuhuhu
Hosts erikhuhuhuhuhuhuhu
Ports 80,443huhuhuhuhuhuhu
Mutex mesthuhuhuhuhuhuhu
Delay 5huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Stub.exe
Full Name
Stub.exe
EntryPoint
System.Void Client.Program::Main()
Scope Name
Stub.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Stub
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
130
Main Method
System.Void Client.Program::Main()
Main IL Instruction Count
53
Main IL 
ldc.i4.0 <null>
stloc.0 <null>
br.s IL_0012: ldloc.0
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
ldc.i4.1 <null>
add <null>
stloc.0 <null>
ldloc.0 <null>
ldsfld System.String Client.Settings::Delay
call System.Int32 System.Convert::ToInt32(System.String)
blt.s IL_0004: ldc.i4 1000
call System.Boolean Client.Settings::InitializeSettings()
brtrue.s IL_002C: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Boolean Client.Helper.MutexControl::CreateMutex()
brtrue.s IL_003A: ldsfld System.String Client.Settings::Anti
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String Client.Settings::Anti
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_004B: ldsfld System.String Client.Settings::Install
call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis()
ldsfld System.String Client.Settings::Install
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_005C: ldsfld System.String Client.Settings::BDOS
call System.Void Client.Install.NormalStartup::Install()
ldsfld System.String Client.Settings::BDOS
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_0074: call System.Void Client.Helper.Methods::PreventSleep()
call System.Boolean Client.Helper.Methods::IsAdmin()
brfalse.s IL_0074: call System.Void Client.Helper.Methods::PreventSleep()
call System.Void Client.Helper.ProcessCritical::Set()
call System.Void Client.Helper.Methods::PreventSleep()
newobj System.Void Client.Helper.CheckMiner::.ctor()
call System.String Client.Helper.CheckMiner::GetProcess()
pop <null>
leave.s IL_0089: call System.Boolean Client.Connection.ClientSocket::get_IsConnected()
pop <null>
leave.s IL_0089: call System.Boolean Client.Connection.ClientSocket::get_IsConnected()
call System.Boolean Client.Connection.ClientSocket::get_IsConnected()
brtrue.s IL_009A: newobj System.Void System.Random::.ctor()
call System.Void Client.Connection.ClientSocket::Reconnect()
call System.Void Client.Connection.ClientSocket::InitializeClient()
newobj System.Void System.Random::.ctor()
ldc.i4 1000
ldc.i4 5000
callvirt System.Int32 System.Random::Next(System.Int32,System.Int32)
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_0089: call System.Boolean Client.Connection.ClientSocket::get_IsConnected()
Module Name
Stub.exe
Full Name
Stub.exe
EntryPoint
System.Void Client.Program::Main()
Scope Name
Stub.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Stub
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
130
Main Method
System.Void Client.Program::Main()
Main IL Instruction Count
53
Main IL 
ldc.i4.0 <null>
stloc.0 <null>
br.s IL_0012: ldloc.0
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
ldc.i4.1 <null>
add <null>
stloc.0 <null>
ldloc.0 <null>
ldsfld System.String Client.Settings::Delay
call System.Int32 System.Convert::ToInt32(System.String)
blt.s IL_0004: ldc.i4 1000
call System.Boolean Client.Settings::InitializeSettings()
brtrue.s IL_002C: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Boolean Client.Helper.MutexControl::CreateMutex()
brtrue.s IL_003A: ldsfld System.String Client.Settings::Anti
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String Client.Settings::Anti
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_004B: ldsfld System.String Client.Settings::Install
call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis()
ldsfld System.String Client.Settings::Install
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_005C: ldsfld System.String Client.Settings::BDOS
call System.Void Client.Install.NormalStartup::Install()
ldsfld System.String Client.Settings::BDOS
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_0074: call System.Void Client.Helper.Methods::PreventSleep()
call System.Boolean Client.Helper.Methods::IsAdmin()
brfalse.s IL_0074: call System.Void Client.Helper.Methods::PreventSleep()
call System.Void Client.Helper.ProcessCritical::Set()
call System.Void Client.Helper.Methods::PreventSleep()
newobj System.Void Client.Helper.CheckMiner::.ctor()
call System.String Client.Helper.CheckMiner::GetProcess()
pop <null>
leave.s IL_0089: call System.Boolean Client.Connection.ClientSocket::get_IsConnected()
pop <null>
leave.s IL_0089: call System.Boolean Client.Connection.ClientSocket::get_IsConnected()
call System.Boolean Client.Connection.ClientSocket::get_IsConnected()
brtrue.s IL_009A: newobj System.Void System.Random::.ctor()
call System.Void Client.Connection.ClientSocket::Reconnect()
call System.Void Client.Connection.ClientSocket::InitializeClient()
newobj System.Void System.Random::.ctor()
ldc.i4 1000
ldc.i4 5000
callvirt System.Int32 System.Random::Next(System.Int32,System.Int32)
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_0089: call System.Boolean Client.Connection.ClientSocket::get_IsConnected()
Key (AES_256) MUTEXmalicious
b0FiVEhuhuhuhuhuhuhuhuhuhuhu
CnC CNCmalicious
erikhuhuhuhuhuhuhu
Ports PORTmalicious
8huhuhuhu
Ports PORTmalicious
4huhuhuhu
Ports PORTmalicious
6huhuhuhu
Ports PORTmalicious
7huhuhuhu
Ports PORTmalicious
8huhuhuhu
Ports PORTmalicious
8huhuhuhu
Mutex MUTEXmalicious
mesthuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
1 malicious · 3 files
EXE64634744841a438beb671c6d0bb91fadAsyncRAT
Structure
Config. Field Value
Key (AES_256) b0FiVEhuhuhuhuhuhuhuhuhuhuhu
Pastebin -huhuhuhu
Certificate MIIE8jhuhuhuhuhuhuhuhuhuhuhu
ServerSignature IgKrlyhuhuhuhuhuhuhuhuhuhuhu
Install fhuhuhuhu
BDOS fhuhuhuhu
Anti-VM fhuhuhuhu
Install File syshuhuhuhu
Install-Folder %Aphuhuhuhu
Version 0.huhuhuhu
Hosts erikhuhuhuhuhuhuhu
Ports 80,443huhuhuhuhuhuhu
Mutex mesthuhuhuhuhuhuhu
Delay 5huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Key (AES_256) MUTEXmalicious
b0FiVEhuhuhuhuhuhuhuhuhuhuhu
64634744841a438beb671c6d0bb91fad
CnC CNCmalicious
erikhuhuhuhuhuhuhu
64634744841a438beb671c6d0bb91fad
Ports PORTmalicious
8huhuhuhu
64634744841a438beb671c6d0bb91fad
Ports PORTmalicious
4huhuhuhu
64634744841a438beb671c6d0bb91fad
Ports PORTmalicious
6huhuhuhu
64634744841a438beb671c6d0bb91fad
Ports PORTmalicious
7huhuhuhu
64634744841a438beb671c6d0bb91fad
Ports PORTmalicious
8huhuhuhu
64634744841a438beb671c6d0bb91fad
Ports PORTmalicious
8huhuhuhu
64634744841a438beb671c6d0bb91fad
Mutex MUTEXmalicious
mesthuhuhuhuhuhuhu
64634744841a438beb671c6d0bb91fad
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙