Symbol Obfuscation Score
|
Hash | Hash Value |
|---|---|
| MD5 | 68c4292bbf1b1bf4a6810f2266f987c1
|
| Sha1 | 215cc69d0a5a58ef717d9497fd3536397c632fd9
|
| Sha256 | 9a5d6eb14a49a2b8e1ec7e7a2f51c20c279e18eea83a92c9b3cbe7dcaff3358a
|
| Sha384 | 9e43a5dd50080b17841196f4b0a6e98674b0a2de7a28ffc96821ae486d00df9b7b4e72ec828043d61d000e7ac877ca8c
|
| Sha512 | d5c7776bc7b30eee63a520d0dd445cd9e5030a26a1283482e6df1d42df07160496d3322d759b611813ec2e9d0de7132116c25b62c936de9f4fee8a009e6251cd
|
| SSDeep | 768:0uh9JTP0FU0WU2j2Cmo2qVhfDyrFx11PISzjb8gX3iM0umMmHbM0NllXxBDZRk:0uh9JTPOY2sGRSS3bTXS1SP0NllXPdRk
|
| TLSH | 542329003BF8812BF2BE5F7498F26145867AB6633613D94D1CC4519B5623FC2DA42BFA
|
PeID
|
Config. Field0 | Value |
|---|---|
| Key (AES_256) | Vmh4SEltakoyRWRiRW1XVG9FS0NhVXVEcVl4RkJZWDc= |
| Pastebin | - |
| Certificate | MIIE8jCCAtqgAwIBAgIQAOJMrZWc0rDodAVi3wHYUTANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjYwMjA4MDYyOTAzWhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKobLwQx8zhg1611mIREq+dl1XjU0CeDO2vplvmkYv3J0QpOD7ZDVZvP0yzoZxuB4dqHgny9vyMWiXC6+lz/q6Qepaul9oCDW8r44ORKPK2B/G9fGjWl8qtqf0yDnF3PlXUaBncoXt30iGBe8HDbCgfwjT7210P/oQoHIy9dPXO4UBMHaUbCduA7Mr++Q4HJNXsW4ZdHBhp0iJ/1lk/N8NCPIA3c/6ZmK/e38aan3MhW2dKEmw+rJdne4NtfuoBmLhLL6HU4NsXxY542gzAffKD/ckG+vyclxai3ohrd8PHk3fNFTDEiAFPqf5XfICH06luQB3wcZJffmDXTRs3p5HBR8urSF6sO1PcSc8I3ZzULDSQCC6vSsCOxmH35H2sJOt6EQxkwa6bWjZFttMl3k86A1bWr7rMjo8CT2njZD/PlJXxmkOmrMOTSly1ysO430od0HK+IBfyPWu7ItlY1GRQ3Prlb20XK6wVsFigsABX2W3jpaPmYqAs1SDtr0IXrMmNfGI4CaYx95opfXbO9WXxheIdgcw2J2wkfoN9I96/HqgKgRFsKuXFXpqMqzEKRhcdQWW5iccZ9CGBHJEJxn5X2pkwagoYXHr974vINixeHHWuUCNIUPWqadlrLZmNwfVJk7kQZ8LBCUEQGxgUgeCSkUoulni0IgHjoz93sjXqXAgMBAAGjMjAwMB0GA1UdDgQWBBShQLF7Fxk+w+RNGQ29o4cXE+EODzAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQBOP5fWzxxLIbA25Ed9mONhBeZM41tIk6v8czy7EFf8LtzcqO2GLaHwmF56P3nszkUQTgEV/jIChDPdzxPiYmFCX4rE/8Zhw+2BPQgF7CnaGvfOMSXbQoJK7Uce1o4EQDMkvC+tWhifxB3U+cIMQytV9NluBOLU1qBu7C5PRWFqbMoNtsHY2X4Pk08twztSLgqMx5LAClHk/kW9iOfGOVu1Q3lASZYy165mmClIeVBNgUH1hJb8Fy8WTDrY42dCw7wylT+QgyKu7jq0ddCMJJ0k/iFHnC11rcBE24bTBNM3BMYCshm8Yq537sRsoX0QmTL+5166xeDOtfGYEpTqHJMmWCix0wK0BCGsqc5mq+yD0zSz546xedz3MTyKWsxNxTWDc7yHgjtrh1Y/0kSxVlHowx6sFbpeO7rdLX0o6qxRzPrxAqms1TNjERBhSHkqIqE/X84ak/T30G2FkvbQEkLIq96OkfPyF3jhN+C62w1jCAZxznPCEg+RxlI9e5vKjAvApfqPShUtcg8A1L0wdTb5Sr5wzTD65xMxdzQXs0vZRuxfI2JzDERGrF09xvd7u4mK5sKd/zGbPFB203xQ8cGVJtSp+wRNAtUUVNQe7NbE8/1HJWricCnJoB+KOUz8ENpY9pHtjv0TeSdoIxAMogIKOXrnapX6qAKur0OmO4fnhA== |
| ServerSignature | IY8SUZvOCWdcpLVpjwzOvVqUw+y2ch/vZjA0bnQJL6GAY6F91tHzJa1QEmUJG0vz01uvbXG/or///KRHvF/Lkm8lT+Rb6USZsi1LXT2PZYgO/IuR+v6VZXBMipdN12bpddUhAQL8ZyL5g8VClPcXoMwUIm7+/Rr16D1IFPjz16FXiMhuGffCoJGxpPhRHvGI2fkeu8VGkz/RE9l6iPE0MVg42b8+LRnL1GaZKJhqZg/NXda55hbkIPXutWboomfmNOZKmvaaDkIY652iR44qj4zRJH7uqUVRWAvRwAh6QP48xEWJmdCaCg4CKRgxKlrvALKfhypJvsfaN37aqZqHuiZhqUpImHYElrkeluD8rSTsJhCXOO3K6qza1GDtWoUQi7t0BTumJU4vn3ZPtjmfm5uhxU9nuTvur88KV1GJ98EaK0FJCguQ/vigewJQcd7jspLxFE82fv86Q3h2yfmwp+XfVlplmOkyGORWs95JfFLnOmV+OzE30Q3QnODCngoYy+952XFxDue7k6OXcEf+pqec95/z6qH1SbYQyOjLTN43t5x7mgzeqNF9h/HoSyVukYVxqIiwpbBGvrdlxJvzSfOLGHuyQGhBi/Xf5zM3c35yv1RdCZlHocudrI1uLke52e/wjdHtxa9JPymvE939n5wIc5fwcCDJYQSuuwmcFks= |
| Install | true |
| BDOS | false |
| Anti-VM | false |
| Install File | horizonguard.exe |
| Install-Folder | %AppData% |
| Hosts | just.co.com,sexdep.blog,demoslotnolimitcity.jp.net,sextop1.page,vlxx88.to,cambodiaslot.jp.net,clipsexsub3x.net,perugia.it.com |
| Ports | 80,443,1337,1604,4782,8080,8848,8888 |
| Mutex | Gq8IXn2Sq1Lk |
| Version | 0.5.8 |
| Delay | 3 |
| Group | NovaGuard |
|
Name0 | Value |
|---|---|
| Info | PE Detect: PeReader OK (file layout) |
| Module Name | novaguard_update.exe |
| Full Name | novaguard_update.exe |
| EntryPoint | System.Void Client.Program::Main() |
| Scope Name | novaguard_update.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v4.0.30319 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | novaguard_update |
| Assembly Version | 1.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | .NETFramework,Version=v4.0,Profile=Client |
| Total Strings | 120 |
| Main Method | System.Void Client.Program::Main() |
| Main IL Instruction Count | 51 |
| Main IL | ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0043: ldsfld System.String Client.Settings::Anti ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String Client.Settings::Install call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() ldsfld System.String Client.Settings::Install call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BDOS call System.Void Client.Install.NormalStartup::Install() ldsfld System.String Client.Settings::BDOS call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.ProcessCritical::Set() call System.Void Client.Helper.Methods::PreventSleep() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop |
| Module Name | novaguard_update.exe |
| Full Name | novaguard_update.exe |
| EntryPoint | System.Void Client.Program::Main() |
| Scope Name | novaguard_update.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v4.0.30319 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | novaguard_update |
| Assembly Version | 1.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | .NETFramework,Version=v4.0,Profile=Client |
| Total Strings | 120 |
| Main Method | System.Void Client.Program::Main() |
| Main IL Instruction Count | 51 |
| Main IL | ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0043: ldsfld System.String Client.Settings::Anti ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String Client.Settings::Install call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() ldsfld System.String Client.Settings::Install call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BDOS call System.Void Client.Install.NormalStartup::Install() ldsfld System.String Client.Settings::BDOS call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.ProcessCritical::Set() call System.Void Client.Helper.Methods::PreventSleep() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop |
|
Name0 | Value |
|---|---|
| Key (AES_256) | Vmh4SEltakoyRWRiRW1XVG9FS0NhVXVEcVl4RkJZWDc= |
| CnC | just.co.com |
| CnC | sexdep.blog |
| CnC | demoslotnolimitcity.jp.net |
| CnC | sextop1.page |
| CnC | vlxx88.to |
| CnC | cambodiaslot.jp.net |
| CnC | clipsexsub3x.net |
| CnC | perugia.it.com |
| Ports | 80 |
| Ports | 443 |
| Ports | 1337 |
| Ports | 1604 |
| Ports | 4782 |
| Ports | 8080 |
| Ports | 8848 |
| Ports | 8888 |
| Mutex | Gq8IXn2Sq1Lk |
|
Config. Field0 | Value |
|---|---|
| Key (AES_256) | Vmh4SEltakoyRWRiRW1XVG9FS0NhVXVEcVl4RkJZWDc= |
| Pastebin | - |
| Certificate | MIIE8jCCAtqgAwIBAgIQAOJMrZWc0rDodAVi3wHYUTANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjYwMjA4MDYyOTAzWhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKobLwQx8zhg1611mIREq+dl1XjU0CeDO2vplvmkYv3J0QpOD7ZDVZvP0yzoZxuB4dqHgny9vyMWiXC6+lz/q6Qepaul9oCDW8r44ORKPK2B/G9fGjWl8qtqf0yDnF3PlXUaBncoXt30iGBe8HDbCgfwjT7210P/oQoHIy9dPXO4UBMHaUbCduA7Mr++Q4HJNXsW4ZdHBhp0iJ/1lk/N8NCPIA3c/6ZmK/e38aan3MhW2dKEmw+rJdne4NtfuoBmLhLL6HU4NsXxY542gzAffKD/ckG+vyclxai3ohrd8PHk3fNFTDEiAFPqf5XfICH06luQB3wcZJffmDXTRs3p5HBR8urSF6sO1PcSc8I3ZzULDSQCC6vSsCOxmH35H2sJOt6EQxkwa6bWjZFttMl3k86A1bWr7rMjo8CT2njZD/PlJXxmkOmrMOTSly1ysO430od0HK+IBfyPWu7ItlY1GRQ3Prlb20XK6wVsFigsABX2W3jpaPmYqAs1SDtr0IXrMmNfGI4CaYx95opfXbO9WXxheIdgcw2J2wkfoN9I96/HqgKgRFsKuXFXpqMqzEKRhcdQWW5iccZ9CGBHJEJxn5X2pkwagoYXHr974vINixeHHWuUCNIUPWqadlrLZmNwfVJk7kQZ8LBCUEQGxgUgeCSkUoulni0IgHjoz93sjXqXAgMBAAGjMjAwMB0GA1UdDgQWBBShQLF7Fxk+w+RNGQ29o4cXE+EODzAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQBOP5fWzxxLIbA25Ed9mONhBeZM41tIk6v8czy7EFf8LtzcqO2GLaHwmF56P3nszkUQTgEV/jIChDPdzxPiYmFCX4rE/8Zhw+2BPQgF7CnaGvfOMSXbQoJK7Uce1o4EQDMkvC+tWhifxB3U+cIMQytV9NluBOLU1qBu7C5PRWFqbMoNtsHY2X4Pk08twztSLgqMx5LAClHk/kW9iOfGOVu1Q3lASZYy165mmClIeVBNgUH1hJb8Fy8WTDrY42dCw7wylT+QgyKu7jq0ddCMJJ0k/iFHnC11rcBE24bTBNM3BMYCshm8Yq537sRsoX0QmTL+5166xeDOtfGYEpTqHJMmWCix0wK0BCGsqc5mq+yD0zSz546xedz3MTyKWsxNxTWDc7yHgjtrh1Y/0kSxVlHowx6sFbpeO7rdLX0o6qxRzPrxAqms1TNjERBhSHkqIqE/X84ak/T30G2FkvbQEkLIq96OkfPyF3jhN+C62w1jCAZxznPCEg+RxlI9e5vKjAvApfqPShUtcg8A1L0wdTb5Sr5wzTD65xMxdzQXs0vZRuxfI2JzDERGrF09xvd7u4mK5sKd/zGbPFB203xQ8cGVJtSp+wRNAtUUVNQe7NbE8/1HJWricCnJoB+KOUz8ENpY9pHtjv0TeSdoIxAMogIKOXrnapX6qAKur0OmO4fnhA== |
| ServerSignature | IY8SUZvOCWdcpLVpjwzOvVqUw+y2ch/vZjA0bnQJL6GAY6F91tHzJa1QEmUJG0vz01uvbXG/or///KRHvF/Lkm8lT+Rb6USZsi1LXT2PZYgO/IuR+v6VZXBMipdN12bpddUhAQL8ZyL5g8VClPcXoMwUIm7+/Rr16D1IFPjz16FXiMhuGffCoJGxpPhRHvGI2fkeu8VGkz/RE9l6iPE0MVg42b8+LRnL1GaZKJhqZg/NXda55hbkIPXutWboomfmNOZKmvaaDkIY652iR44qj4zRJH7uqUVRWAvRwAh6QP48xEWJmdCaCg4CKRgxKlrvALKfhypJvsfaN37aqZqHuiZhqUpImHYElrkeluD8rSTsJhCXOO3K6qza1GDtWoUQi7t0BTumJU4vn3ZPtjmfm5uhxU9nuTvur88KV1GJ98EaK0FJCguQ/vigewJQcd7jspLxFE82fv86Q3h2yfmwp+XfVlplmOkyGORWs95JfFLnOmV+OzE30Q3QnODCngoYy+952XFxDue7k6OXcEf+pqec95/z6qH1SbYQyOjLTN43t5x7mgzeqNF9h/HoSyVukYVxqIiwpbBGvrdlxJvzSfOLGHuyQGhBi/Xf5zM3c35yv1RdCZlHocudrI1uLke52e/wjdHtxa9JPymvE939n5wIc5fwcCDJYQSuuwmcFks= |
| Install | true |
| BDOS | false |
| Anti-VM | false |
| Install File | horizonguard.exe |
| Install-Folder | %AppData% |
| Hosts | just.co.com,sexdep.blog,demoslotnolimitcity.jp.net,sextop1.page,vlxx88.to,cambodiaslot.jp.net,clipsexsub3x.net,perugia.it.com |
| Ports | 80,443,1337,1604,4782,8080,8848,8888 |
| Mutex | Gq8IXn2Sq1Lk |
| Version | 0.5.8 |
| Delay | 3 |
| Group | NovaGuard |
|
Name0 | Value | Location |
|---|---|---|
| Key (AES_256) | Vmh4SEltakoyRWRiRW1XVG9FS0NhVXVEcVl4RkJZWDc= Malicious |
68c4292bbf1b1bf4a6810f2266f987c1 |
| CnC | just.co.com Malicious |
68c4292bbf1b1bf4a6810f2266f987c1 |
| CnC | sexdep.blog Malicious |
68c4292bbf1b1bf4a6810f2266f987c1 |
| CnC | demoslotnolimitcity.jp.net Malicious |
68c4292bbf1b1bf4a6810f2266f987c1 |
| CnC | sextop1.page Malicious |
68c4292bbf1b1bf4a6810f2266f987c1 |
| CnC | vlxx88.to Malicious |
68c4292bbf1b1bf4a6810f2266f987c1 |
| CnC | cambodiaslot.jp.net Malicious |
68c4292bbf1b1bf4a6810f2266f987c1 |
| CnC | clipsexsub3x.net Malicious |
68c4292bbf1b1bf4a6810f2266f987c1 |
| CnC | perugia.it.com Malicious |
68c4292bbf1b1bf4a6810f2266f987c1 |
| Ports | 80 Malicious |
68c4292bbf1b1bf4a6810f2266f987c1 |
| Ports | 443 Malicious |
68c4292bbf1b1bf4a6810f2266f987c1 |
| Ports | 1337 Malicious |
68c4292bbf1b1bf4a6810f2266f987c1 |
| Ports | 1604 Malicious |
68c4292bbf1b1bf4a6810f2266f987c1 |
| Ports | 4782 Malicious |
68c4292bbf1b1bf4a6810f2266f987c1 |
| Ports | 8080 Malicious |
68c4292bbf1b1bf4a6810f2266f987c1 |
| Ports | 8848 Malicious |
68c4292bbf1b1bf4a6810f2266f987c1 |
| Ports | 8888 Malicious |
68c4292bbf1b1bf4a6810f2266f987c1 |
| Mutex | Gq8IXn2Sq1Lk Malicious |
68c4292bbf1b1bf4a6810f2266f987c1 |