Malicious
Malicious

PE Executable
MD5: 6b15e3aeade276291d73b09e9c37dcc2
Size: 155.65 KB
application/x-dosexec
Infection Chain
Infection chain Ctrl + scroll to zoom · drag to pan
Summary by MalvaGPT
Characteristics

Symbol Obfuscation Score

Low

Hash
 Hash Value
MD5
6b15e3aeade276291d73b09e9c37dcc2
Sha1
554b47e6504255157ebf909caa935fdf0c3e51ae
Sha256
9add4b744ba1937057ff7b5a0e2b1e86e4a4cfff53faa012bd0f49d22dfdff7b
Sha384
ace05ff9e1d965b11de96bfcfd42a84bb824bff4fc47a90b119d9fdc77578e0af7d5b11e154024ef678c93d2cc7f0632
Sha512
cbfe8440b89d15cd3134830f1d8eb1ab60ade929349ad8d1cb56dee236f21bc2ff8c624235b40566a71c064aff5f6735fb1b4fc1383431f72d85d8b1fae5f443
SSDeep
1536:D+C5Xzpd7DM2RGbb1wQj/71GBAbYw1L0HmDQnv7IUVclN:DfzL7gCGbb1F/oAbYwCHmDQnv7IGY
TLSH
E5E3E8033317C459E63D4F706D9A4D6019B44EBF9404CA9E3CCC76DBAAF9760281A3AE

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
6b15e3aeade276291d73b09e9c37dcc2
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Malware Configuration - DcRat config.
Config. Field
 Value
Key (AES_256)
Tm5laGhuhuhuhuhuhuhuhuhuhuhu
Pastebin
-huhuhuhu
Certificate
MIICMDhuhuhuhuhuhuhuhuhuhuhu
ServerSignature
EO5eQ0huhuhuhuhuhuhuhuhuhuhu
Install
thuhuhuhu
BDOS
fhuhuhuhu
Anti-VM
fhuhuhuhu
Install File
unihuhuhuhu
Install-Folder
%Aphuhuhuhu
Hosts
sun.wihuhuhuhuhuhuhuhuhuhuhu
Ports
80,443huhuhuhuhuhuhuhuhuhuhu
Mutex
DcRatMhuhuhuhuhuhuhu
Version
1huhuhuhu
Delay
1huhuhuhu
Group
Dehuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

unikay.exe
Full Name

unikay.exe
EntryPoint

System.Void Client.Program::Main()
Scope Name

unikay.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

unikay
Assembly Version

1.0.7.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0
Total Strings

157
Main Method

System.Void Client.Program::Main()
Main IL Instruction Count

77
Main IL

ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::De_lay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> ldsfld System.String Client.Settings::An_ti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0047: leave IL_0052 call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() leave IL_0052: call System.Void Client.Helper.A::B() pop <null> leave IL_0052: call System.Void Client.Helper.A::B() call System.Void Client.Helper.A::B() call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0067: leave IL_0072 ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) leave IL_0072: nop pop <null> leave IL_0072: nop nop <null> ldsfld System.String Client.Settings::Anti_Process call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0087: leave IL_0092 call System.Void Client.Helper.AntiProcess::StartBlock() leave IL_0092: nop pop <null> leave IL_0092: nop nop <null> ldsfld System.String Client.Settings::BS_OD call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_00B1: leave IL_00BC call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_00B1: leave IL_00BC call System.Void Client.Helper.ProcessCritical::Set() leave IL_00BC: nop pop <null> leave IL_00BC: nop nop <null> ldsfld System.String Client.Settings::In_stall call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_00D1: leave IL_00DC call System.Void Client.Install.NormalStartup::Install() leave IL_00DC: call System.Void Client.Helper.Methods::PreventSleep() pop <null> leave IL_00DC: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_00F0: leave IL_00FB call System.Void Client.Helper.Methods::ClearSetting() leave IL_00FB: nop pop <null> leave IL_00FB: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_0110: leave IL_011B call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_011B: ldc.i4 5000 pop <null> leave IL_011B: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_00FB: nop
Module Name

unikay.exe
Full Name

unikay.exe
EntryPoint

System.Void Client.Program::Main()
Scope Name

unikay.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

unikay
Assembly Version

1.0.7.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0
Total Strings

157
Main Method

System.Void Client.Program::Main()
Main IL Instruction Count

77
Main IL

ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::De_lay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> ldsfld System.String Client.Settings::An_ti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0047: leave IL_0052 call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() leave IL_0052: call System.Void Client.Helper.A::B() pop <null> leave IL_0052: call System.Void Client.Helper.A::B() call System.Void Client.Helper.A::B() call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0067: leave IL_0072 ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) leave IL_0072: nop pop <null> leave IL_0072: nop nop <null> ldsfld System.String Client.Settings::Anti_Process call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0087: leave IL_0092 call System.Void Client.Helper.AntiProcess::StartBlock() leave IL_0092: nop pop <null> leave IL_0092: nop nop <null> ldsfld System.String Client.Settings::BS_OD call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_00B1: leave IL_00BC call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_00B1: leave IL_00BC call System.Void Client.Helper.ProcessCritical::Set() leave IL_00BC: nop pop <null> leave IL_00BC: nop nop <null> ldsfld System.String Client.Settings::In_stall call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_00D1: leave IL_00DC call System.Void Client.Install.NormalStartup::Install() leave IL_00DC: call System.Void Client.Helper.Methods::PreventSleep() pop <null> leave IL_00DC: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_00F0: leave IL_00FB call System.Void Client.Helper.Methods::ClearSetting() leave IL_00FB: nop pop <null> leave IL_00FB: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_0110: leave IL_011B call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_011B: ldc.i4 5000 pop <null> leave IL_011B: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_00FB: nop
Artefacts
Name
 Value
Key (AES_256)
Tm5laGhuhuhuhuhuhuhuhuhuhuhu
CnC
suhuhuhuhu
CnC
unikhuhuhuhuhuhuhu
CnC
sarahuhuhuhuhuhuhu
CnC
unikeyhuhuhuhuhuhuhu
Ports
8huhuhuhu
Ports
4huhuhuhu
Ports
2huhuhuhu
Ports
2huhuhuhu
Ports
2huhuhuhu
Ports
2huhuhuhu
Ports
8huhuhuhu
Ports
8huhuhuhu
Ports
8huhuhuhu
Mutex
DcRatMhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys…) are available with Essential.
Unlock with Essential
6b15e3aeade276291d73b09e9c37dcc2 (155.65 KB)
File Structure
6b15e3aeade276291d73b09e9c37dcc2
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Characteristics
Malware Configuration - DcRat config.
Config. Field
 Value
Key (AES_256)
Tm5laGhuhuhuhuhuhuhuhuhuhuhu
Pastebin
-huhuhuhu
Certificate
MIICMDhuhuhuhuhuhuhuhuhuhuhu
ServerSignature
EO5eQ0huhuhuhuhuhuhuhuhuhuhu
Install
thuhuhuhu
BDOS
fhuhuhuhu
Anti-VM
fhuhuhuhu
Install File
unihuhuhuhu
Install-Folder
%Aphuhuhuhu
Hosts
sun.wihuhuhuhuhuhuhuhuhuhuhu
Ports
80,443huhuhuhuhuhuhuhuhuhuhu
Mutex
DcRatMhuhuhuhuhuhuhu
Version
1huhuhuhu
Delay
1huhuhuhu
Group
Dehuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Artefacts
Name
 Value Location
Key (AES_256)
Tm5laGhuhuhuhuhuhuhuhuhuhuhu
Malicious

6b15e3aeade276291d73b09e9c37dcc2
CnC
suhuhuhuhu
Malicious

6b15e3aeade276291d73b09e9c37dcc2
CnC
unikhuhuhuhuhuhuhu
Malicious

6b15e3aeade276291d73b09e9c37dcc2
CnC
sarahuhuhuhuhuhuhu
Malicious

6b15e3aeade276291d73b09e9c37dcc2
CnC
unikeyhuhuhuhuhuhuhu
Malicious

6b15e3aeade276291d73b09e9c37dcc2
Ports
8huhuhuhu
Malicious

6b15e3aeade276291d73b09e9c37dcc2
Ports
4huhuhuhu
Malicious

6b15e3aeade276291d73b09e9c37dcc2
Ports
2huhuhuhu
Malicious

6b15e3aeade276291d73b09e9c37dcc2
Ports
2huhuhuhu
Malicious

6b15e3aeade276291d73b09e9c37dcc2
Ports
2huhuhuhu
Malicious

6b15e3aeade276291d73b09e9c37dcc2
Ports
2huhuhuhu
Malicious

6b15e3aeade276291d73b09e9c37dcc2
Ports
8huhuhuhu
Malicious

6b15e3aeade276291d73b09e9c37dcc2
Ports
8huhuhuhu
Malicious

6b15e3aeade276291d73b09e9c37dcc2
Ports
8huhuhuhu
Malicious

6b15e3aeade276291d73b09e9c37dcc2
Mutex
DcRatMhuhuhuhuhuhuhu
Malicious

6b15e3aeade276291d73b09e9c37dcc2
Full artefact values (URLs, paths, registry keys…) are available with Essential.
Unlock with Essential
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙