Malicious
Malicious

68c4292bbf1b1bf4a6810f2266f987c1

PE Executable
|
MD5: 68c4292bbf1b1bf4a6810f2266f987c1
|
Size: 47.62 KB
|
application/x-dosexec

Infection Chain
Summary by MalvaGPT
Characteristics

Symbol Obfuscation Score

Low

Hash
 Hash Value
MD5
68c4292bbf1b1bf4a6810f2266f987c1
Sha1
215cc69d0a5a58ef717d9497fd3536397c632fd9
Sha256
9a5d6eb14a49a2b8e1ec7e7a2f51c20c279e18eea83a92c9b3cbe7dcaff3358a
Sha384
9e43a5dd50080b17841196f4b0a6e98674b0a2de7a28ffc96821ae486d00df9b7b4e72ec828043d61d000e7ac877ca8c
Sha512
d5c7776bc7b30eee63a520d0dd445cd9e5030a26a1283482e6df1d42df07160496d3322d759b611813ec2e9d0de7132116c25b62c936de9f4fee8a009e6251cd
SSDeep
768:0uh9JTP0FU0WU2j2Cmo2qVhfDyrFx11PISzjb8gX3iM0umMmHbM0NllXxBDZRk:0uh9JTPOY2sGRSS3bTXS1SP0NllXPdRk
TLSH
542329003BF8812BF2BE5F7498F26145867AB6633613D94D1CC4519B5623FC2DA42BFA

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
68c4292bbf1b1bf4a6810f2266f987c1
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Malware Configuration - AsyncRAT config.
Config. Field
 Value
Key (AES_256)

Vmh4SEltakoyRWRiRW1XVG9FS0NhVXVEcVl4RkJZWDc=
Pastebin

-
Certificate

MIIE8jCCAtqgAwIBAgIQAOJMrZWc0rDodAVi3wHYUTANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjYwMjA4MDYyOTAzWhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKobLwQx8zhg1611mIREq+dl1XjU0CeDO2vplvmkYv3J0QpOD7ZDVZvP0yzoZxuB4dqHgny9vyMWiXC6+lz/q6Qepaul9oCDW8r44ORKPK2B/G9fGjWl8qtqf0yDnF3PlXUaBncoXt30iGBe8HDbCgfwjT7210P/oQoHIy9dPXO4UBMHaUbCduA7Mr++Q4HJNXsW4ZdHBhp0iJ/1lk/N8NCPIA3c/6ZmK/e38aan3MhW2dKEmw+rJdne4NtfuoBmLhLL6HU4NsXxY542gzAffKD/ckG+vyclxai3ohrd8PHk3fNFTDEiAFPqf5XfICH06luQB3wcZJffmDXTRs3p5HBR8urSF6sO1PcSc8I3ZzULDSQCC6vSsCOxmH35H2sJOt6EQxkwa6bWjZFttMl3k86A1bWr7rMjo8CT2njZD/PlJXxmkOmrMOTSly1ysO430od0HK+IBfyPWu7ItlY1GRQ3Prlb20XK6wVsFigsABX2W3jpaPmYqAs1SDtr0IXrMmNfGI4CaYx95opfXbO9WXxheIdgcw2J2wkfoN9I96/HqgKgRFsKuXFXpqMqzEKRhcdQWW5iccZ9CGBHJEJxn5X2pkwagoYXHr974vINixeHHWuUCNIUPWqadlrLZmNwfVJk7kQZ8LBCUEQGxgUgeCSkUoulni0IgHjoz93sjXqXAgMBAAGjMjAwMB0GA1UdDgQWBBShQLF7Fxk+w+RNGQ29o4cXE+EODzAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQBOP5fWzxxLIbA25Ed9mONhBeZM41tIk6v8czy7EFf8LtzcqO2GLaHwmF56P3nszkUQTgEV/jIChDPdzxPiYmFCX4rE/8Zhw+2BPQgF7CnaGvfOMSXbQoJK7Uce1o4EQDMkvC+tWhifxB3U+cIMQytV9NluBOLU1qBu7C5PRWFqbMoNtsHY2X4Pk08twztSLgqMx5LAClHk/kW9iOfGOVu1Q3lASZYy165mmClIeVBNgUH1hJb8Fy8WTDrY42dCw7wylT+QgyKu7jq0ddCMJJ0k/iFHnC11rcBE24bTBNM3BMYCshm8Yq537sRsoX0QmTL+5166xeDOtfGYEpTqHJMmWCix0wK0BCGsqc5mq+yD0zSz546xedz3MTyKWsxNxTWDc7yHgjtrh1Y/0kSxVlHowx6sFbpeO7rdLX0o6qxRzPrxAqms1TNjERBhSHkqIqE/X84ak/T30G2FkvbQEkLIq96OkfPyF3jhN+C62w1jCAZxznPCEg+RxlI9e5vKjAvApfqPShUtcg8A1L0wdTb5Sr5wzTD65xMxdzQXs0vZRuxfI2JzDERGrF09xvd7u4mK5sKd/zGbPFB203xQ8cGVJtSp+wRNAtUUVNQe7NbE8/1HJWricCnJoB+KOUz8ENpY9pHtjv0TeSdoIxAMogIKOXrnapX6qAKur0OmO4fnhA==
ServerSignature

IY8SUZvOCWdcpLVpjwzOvVqUw+y2ch/vZjA0bnQJL6GAY6F91tHzJa1QEmUJG0vz01uvbXG/or///KRHvF/Lkm8lT+Rb6USZsi1LXT2PZYgO/IuR+v6VZXBMipdN12bpddUhAQL8ZyL5g8VClPcXoMwUIm7+/Rr16D1IFPjz16FXiMhuGffCoJGxpPhRHvGI2fkeu8VGkz/RE9l6iPE0MVg42b8+LRnL1GaZKJhqZg/NXda55hbkIPXutWboomfmNOZKmvaaDkIY652iR44qj4zRJH7uqUVRWAvRwAh6QP48xEWJmdCaCg4CKRgxKlrvALKfhypJvsfaN37aqZqHuiZhqUpImHYElrkeluD8rSTsJhCXOO3K6qza1GDtWoUQi7t0BTumJU4vn3ZPtjmfm5uhxU9nuTvur88KV1GJ98EaK0FJCguQ/vigewJQcd7jspLxFE82fv86Q3h2yfmwp+XfVlplmOkyGORWs95JfFLnOmV+OzE30Q3QnODCngoYy+952XFxDue7k6OXcEf+pqec95/z6qH1SbYQyOjLTN43t5x7mgzeqNF9h/HoSyVukYVxqIiwpbBGvrdlxJvzSfOLGHuyQGhBi/Xf5zM3c35yv1RdCZlHocudrI1uLke52e/wjdHtxa9JPymvE939n5wIc5fwcCDJYQSuuwmcFks=
Install

true
BDOS

false
Anti-VM

false
Install File

horizonguard.exe
Install-Folder

%AppData%
Hosts

just.co.com,sexdep.blog,demoslotnolimitcity.jp.net,sextop1.page,vlxx88.to,cambodiaslot.jp.net,clipsexsub3x.net,perugia.it.com
Ports

80,443,1337,1604,4782,8080,8848,8888
Mutex

Gq8IXn2Sq1Lk
Version

0.5.8
Delay

3
Group

NovaGuard
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

novaguard_update.exe
Full Name

novaguard_update.exe
EntryPoint

System.Void Client.Program::Main()
Scope Name

novaguard_update.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

novaguard_update
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

120
Main Method

System.Void Client.Program::Main()
Main IL Instruction Count

51
Main IL

ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0043: ldsfld System.String Client.Settings::Anti ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String Client.Settings::Install call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() ldsfld System.String Client.Settings::Install call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BDOS call System.Void Client.Install.NormalStartup::Install() ldsfld System.String Client.Settings::BDOS call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.ProcessCritical::Set() call System.Void Client.Helper.Methods::PreventSleep() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Module Name

novaguard_update.exe
Full Name

novaguard_update.exe
EntryPoint

System.Void Client.Program::Main()
Scope Name

novaguard_update.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

novaguard_update
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

120
Main Method

System.Void Client.Program::Main()
Main IL Instruction Count

51
Main IL

ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0043: ldsfld System.String Client.Settings::Anti ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String Client.Settings::Install call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() ldsfld System.String Client.Settings::Install call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BDOS call System.Void Client.Install.NormalStartup::Install() ldsfld System.String Client.Settings::BDOS call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.ProcessCritical::Set() call System.Void Client.Helper.Methods::PreventSleep() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Artefacts
Name
 Value
Key (AES_256)

Vmh4SEltakoyRWRiRW1XVG9FS0NhVXVEcVl4RkJZWDc=
CnC

just.co.com
CnC

sexdep.blog
CnC

demoslotnolimitcity.jp.net
CnC

sextop1.page
CnC

vlxx88.to
CnC

cambodiaslot.jp.net
CnC

clipsexsub3x.net
CnC

perugia.it.com
Ports

80
Ports

443
Ports

1337
Ports

1604
Ports

4782
Ports

8080
Ports

8848
Ports

8888
Mutex

Gq8IXn2Sq1Lk
68c4292bbf1b1bf4a6810f2266f987c1 (47.62 KB)
File Structure
68c4292bbf1b1bf4a6810f2266f987c1
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Characteristics
Malware Configuration - AsyncRAT config.
Config. Field
 Value
Key (AES_256)

Vmh4SEltakoyRWRiRW1XVG9FS0NhVXVEcVl4RkJZWDc=
Pastebin

-
Certificate

MIIE8jCCAtqgAwIBAgIQAOJMrZWc0rDodAVi3wHYUTANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjYwMjA4MDYyOTAzWhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKobLwQx8zhg1611mIREq+dl1XjU0CeDO2vplvmkYv3J0QpOD7ZDVZvP0yzoZxuB4dqHgny9vyMWiXC6+lz/q6Qepaul9oCDW8r44ORKPK2B/G9fGjWl8qtqf0yDnF3PlXUaBncoXt30iGBe8HDbCgfwjT7210P/oQoHIy9dPXO4UBMHaUbCduA7Mr++Q4HJNXsW4ZdHBhp0iJ/1lk/N8NCPIA3c/6ZmK/e38aan3MhW2dKEmw+rJdne4NtfuoBmLhLL6HU4NsXxY542gzAffKD/ckG+vyclxai3ohrd8PHk3fNFTDEiAFPqf5XfICH06luQB3wcZJffmDXTRs3p5HBR8urSF6sO1PcSc8I3ZzULDSQCC6vSsCOxmH35H2sJOt6EQxkwa6bWjZFttMl3k86A1bWr7rMjo8CT2njZD/PlJXxmkOmrMOTSly1ysO430od0HK+IBfyPWu7ItlY1GRQ3Prlb20XK6wVsFigsABX2W3jpaPmYqAs1SDtr0IXrMmNfGI4CaYx95opfXbO9WXxheIdgcw2J2wkfoN9I96/HqgKgRFsKuXFXpqMqzEKRhcdQWW5iccZ9CGBHJEJxn5X2pkwagoYXHr974vINixeHHWuUCNIUPWqadlrLZmNwfVJk7kQZ8LBCUEQGxgUgeCSkUoulni0IgHjoz93sjXqXAgMBAAGjMjAwMB0GA1UdDgQWBBShQLF7Fxk+w+RNGQ29o4cXE+EODzAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQBOP5fWzxxLIbA25Ed9mONhBeZM41tIk6v8czy7EFf8LtzcqO2GLaHwmF56P3nszkUQTgEV/jIChDPdzxPiYmFCX4rE/8Zhw+2BPQgF7CnaGvfOMSXbQoJK7Uce1o4EQDMkvC+tWhifxB3U+cIMQytV9NluBOLU1qBu7C5PRWFqbMoNtsHY2X4Pk08twztSLgqMx5LAClHk/kW9iOfGOVu1Q3lASZYy165mmClIeVBNgUH1hJb8Fy8WTDrY42dCw7wylT+QgyKu7jq0ddCMJJ0k/iFHnC11rcBE24bTBNM3BMYCshm8Yq537sRsoX0QmTL+5166xeDOtfGYEpTqHJMmWCix0wK0BCGsqc5mq+yD0zSz546xedz3MTyKWsxNxTWDc7yHgjtrh1Y/0kSxVlHowx6sFbpeO7rdLX0o6qxRzPrxAqms1TNjERBhSHkqIqE/X84ak/T30G2FkvbQEkLIq96OkfPyF3jhN+C62w1jCAZxznPCEg+RxlI9e5vKjAvApfqPShUtcg8A1L0wdTb5Sr5wzTD65xMxdzQXs0vZRuxfI2JzDERGrF09xvd7u4mK5sKd/zGbPFB203xQ8cGVJtSp+wRNAtUUVNQe7NbE8/1HJWricCnJoB+KOUz8ENpY9pHtjv0TeSdoIxAMogIKOXrnapX6qAKur0OmO4fnhA==
ServerSignature

IY8SUZvOCWdcpLVpjwzOvVqUw+y2ch/vZjA0bnQJL6GAY6F91tHzJa1QEmUJG0vz01uvbXG/or///KRHvF/Lkm8lT+Rb6USZsi1LXT2PZYgO/IuR+v6VZXBMipdN12bpddUhAQL8ZyL5g8VClPcXoMwUIm7+/Rr16D1IFPjz16FXiMhuGffCoJGxpPhRHvGI2fkeu8VGkz/RE9l6iPE0MVg42b8+LRnL1GaZKJhqZg/NXda55hbkIPXutWboomfmNOZKmvaaDkIY652iR44qj4zRJH7uqUVRWAvRwAh6QP48xEWJmdCaCg4CKRgxKlrvALKfhypJvsfaN37aqZqHuiZhqUpImHYElrkeluD8rSTsJhCXOO3K6qza1GDtWoUQi7t0BTumJU4vn3ZPtjmfm5uhxU9nuTvur88KV1GJ98EaK0FJCguQ/vigewJQcd7jspLxFE82fv86Q3h2yfmwp+XfVlplmOkyGORWs95JfFLnOmV+OzE30Q3QnODCngoYy+952XFxDue7k6OXcEf+pqec95/z6qH1SbYQyOjLTN43t5x7mgzeqNF9h/HoSyVukYVxqIiwpbBGvrdlxJvzSfOLGHuyQGhBi/Xf5zM3c35yv1RdCZlHocudrI1uLke52e/wjdHtxa9JPymvE939n5wIc5fwcCDJYQSuuwmcFks=
Install

true
BDOS

false
Anti-VM

false
Install File

horizonguard.exe
Install-Folder

%AppData%
Hosts

just.co.com,sexdep.blog,demoslotnolimitcity.jp.net,sextop1.page,vlxx88.to,cambodiaslot.jp.net,clipsexsub3x.net,perugia.it.com
Ports

80,443,1337,1604,4782,8080,8848,8888
Mutex

Gq8IXn2Sq1Lk
Version

0.5.8
Delay

3
Group

NovaGuard
Artefacts
Name
 Value Location
Key (AES_256)

Vmh4SEltakoyRWRiRW1XVG9FS0NhVXVEcVl4RkJZWDc=

Malicious

68c4292bbf1b1bf4a6810f2266f987c1
CnC

just.co.com

Malicious

68c4292bbf1b1bf4a6810f2266f987c1
CnC

sexdep.blog

Malicious

68c4292bbf1b1bf4a6810f2266f987c1
CnC

demoslotnolimitcity.jp.net

Malicious

68c4292bbf1b1bf4a6810f2266f987c1
CnC

sextop1.page

Malicious

68c4292bbf1b1bf4a6810f2266f987c1
CnC

vlxx88.to

Malicious

68c4292bbf1b1bf4a6810f2266f987c1
CnC

cambodiaslot.jp.net

Malicious

68c4292bbf1b1bf4a6810f2266f987c1
CnC

clipsexsub3x.net

Malicious

68c4292bbf1b1bf4a6810f2266f987c1
CnC

perugia.it.com

Malicious

68c4292bbf1b1bf4a6810f2266f987c1
Ports

80

Malicious

68c4292bbf1b1bf4a6810f2266f987c1
Ports

443

Malicious

68c4292bbf1b1bf4a6810f2266f987c1
Ports

1337

Malicious

68c4292bbf1b1bf4a6810f2266f987c1
Ports

1604

Malicious

68c4292bbf1b1bf4a6810f2266f987c1
Ports

4782

Malicious

68c4292bbf1b1bf4a6810f2266f987c1
Ports

8080

Malicious

68c4292bbf1b1bf4a6810f2266f987c1
Ports

8848

Malicious

68c4292bbf1b1bf4a6810f2266f987c1
Ports

8888

Malicious

68c4292bbf1b1bf4a6810f2266f987c1
Mutex

Gq8IXn2Sq1Lk

Malicious

68c4292bbf1b1bf4a6810f2266f987c1
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙