804535fc5f5c8c802ebd2502c351b57c

PE Executable
|
MD5: 804535fc5f5c8c802ebd2502c351b57c
|
Size: 48.64 KB
|
application/x-dosexec

Infection Chain

Summary by MalvaGPT

Characteristics

Hash	Hash Value
MD5	804535fc5f5c8c802ebd2502c351b57c
Sha1	237e47469bc88e7e715bf6d416ae3d5e1d97249f
Sha256	5e680cd8708e4e87ef858a5a8921157e7e8bc13a7ea04a93086a7996642605b0
Sha384	56be9285ed570c18946f41a746688f3b6b961d1b222f47540fecd4a595c534331b62a135e2135d9b9bac14d90dd4a291
Sha512	f68002422a9d24630e749bd68b690a6e9dcbc103a1f5387ba6ac0e207ba2c698fc4ae7202539ca94d016bfa96e1d66f2b11515524df5e152fd9e06f36e618759
SSDeep	768:LukzVT0kLd3WULVPdVmo2qDXDS9eCSY/2wWeKvmcd0bk6hIYLvd/RscDr3DcDZ9m:LukzVT0M912U9YejeKvIbk6WYL4c4d9m
TLSH	36233B0037E9812BF3BE4F74A9F26205457BF2773603D64A2CC451D65A23BC69A429FE

PeID

.NET executable

Microsoft Visual C# / Basic .NET

Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL

Microsoft Visual C# v7.0 / Basic .NET

Microsoft Visual Studio .NET

File Structure

Malware Configuration - AsyncRAT config.

Config. Field0	Value
Key (AES_256)	SklyTXhJcVVBc2xqRXhqZncyYWE3MjdreFVTSFB6RkE=
Pastebin	-
Certificate	MIIE8jCCAtqgAwIBAgIQALE68jKeuRy9BViGkxcFXTANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjUxMjA3MTIxMjU4WhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAJmhO7weERMU9y08zf19/eWApZ6jwtdzk4b9lXF/nA1k14eYupe7DHZmapxBBYVz7zhwGtsT0j6tLi+p80uBhsNmvgkZqGHuFiPPW33rGdI/B4VRBGUG0Y0zPS3cXEItWdVIo8LddisECnkOu4hNNyjbAu6RPWMgSCbwNPN4BGElZkFrL5q3oFLA5ksbbD+Qmt9GT8Rc6N8+Ga+A8A3zO1MKjm7fhyreeLHNEIlDwzKQEvNpG79IP2V6/LiEetsWWc0EPZFc0OuWFapuzITmV3QUl+wJMQbU8kNitSsEBBblUnDAkaQBCvd9BpIUfOan10CBPTuO3ePQCN3HJu60crnvrJqo8VbgXpG7C0lb5TtOLV2y+ybTT3EuvGHyzWqQZRKhX55O/cKQHq0hu8VzzONTSq3jaqUIknwe7I70kZ5fvUgNbeMmDx3PdSwx091lgW9ucv5sVr/odABaiN88R1GPgrx/T/5LtLwSuuPK0JG2PImGZabpjnoeiegXNryZs0T9mYXLSMj1YbhTbUL57jGdoDFObbZkzdARfwapkpnw3nUYS893Ivef02i7AXHlvYdPnZplC2+CuhvP/SzPj3/P4d3VjSHOlVtpSARJzV4BSO3DFDfeRtSy+RuJk3VFbpesRfl1h81Sk5mtovRzM+ZIyarZHRZug5s3Z2eYyc4PAgMBAAGjMjAwMB0GA1UdDgQWBBSL9ZJ4aNjsa4cQoJMBGHlKXqe5MzAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQAfLokeaEHGWDG9Z22YZSQlwo1DmqBklUQwjG3r/VMZnztEfVvgruyrz9L7Ip5NzvbpTra7NEKu+gGw6Aq4OceLZ/zJ1ET1MP16dE8RQC8f2T0Mqbe67rpQTjqU6kSxmx+VGnvLpNFpy69SDwTAlKY7w9BP+fZQ5RbHYiyRyJ8vWKeXf9Ky614o2A86+X2JDqVbf1LcqUpSWrewlHt6IYNTAimiMdKfFzPYUl33K7QgC9zlZuj2w1/qcdI4zQBCSDtwW5ZAi8yC/aJXGFGGBC284KSTZ1c87PsmpM/lLOezVyA5WGjw6brUTaWXWh4ihDQmDBA/zmAGsQKtajuQbSBPFSJdYNHMGaaEmS+C0QqM4olonGPtnUDYt9Y3s102dsJhU7Yjb6EKoaoIB3trjVzy0x0KR1JUgeLi5Nur7cvzakbRBflvykPv61N2z+cX72Yf1iTmb/JvU4/p8ivFc67SsHuiNwUsG+JHLq0Xjklps2japJnGMDVkRvkIhOGHlHnaUI3giZxrbF3EePwt64Gm2MhI3IBQFnQO0eJU/CHGgGVamz7t/HXx1clfR09hxlKKtB8rBnBxl+fVDlH3a5m+SV+6Yh3I1WXTCT31vYFS8uQn4jiXUgxwnSzOLGh0vfK7lhOjFqE8POlSJBgcsyeIwItoniMIaYBICAGIMryddQ==
ServerSignature	fujNFEVzz4f4QKTpeWUUy9XDv8ZMogTudOJzmImHBHerj4cguMI7X7mStrm2yDXKcif2858aO/DoUzk2vn61s8W+GYnj9uK4IDrkGRQCBinQfrNYZMvnbbFiRr5YXbrVH33kMi1x6+ByZzSNAdHLvzaXCjKRfs0m9KzdA9UzkkCVpizAYKK6D5O2se0FMlEovEge9MOYBqUNZc+N61f0bMBVqgJUn0ygIDaFJf02bfs5nU15BgR/vqgPJzcwMB8OsDl0xZgxYfnFtldRLvzJlgGYvbzzujaREPZllOh5MoqfcpyvFr5+cP8LWSupKAO7NvmVOlYQ0JLa3Qo0Wv9VIdIQ2c7OoFUMmYHmJBGOZ2W7UZqBe7qYC06V5X3GdkQwC0qdqVgnyoVgxJ1o4OZJhrUltOjmsdNiCZjKI9LxauNaWQRH3kwugAxdZAL+SEcC7tw0USlUWZYeHVjCLGP3LL7f+h2O8G29kyjArH+lNRTmt7gyfX1E/G6Lgmg2RhAkeNRqh5NXiD+w15W2HpPDbVO/aoo8FFjOmqPGdACKpDGmLICgSUVIY+clnvqaBqHam72abeBriByPFtbzglo9sEAnOmACoAT9C9elbdb7jtvNYUxG4P+t52iKHepY82l+OOsmet6tCULlXe+22IY/FT6hr0WeXm63
Install	false
BDOS	false
Anti-VM	false
Install File	update.exe
Install-Folder	%AppData%
Version	0.5.7B
Hosts	88.251.102.37
Ports	4488
Mutex	AsyncMutex_6SI8O
Delay	3
Group	Default

Informations

Name0	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	ysJBLicFCgZq
Full Name	ysJBLicFCgZq
EntryPoint	System.Void PLuSPdcDzppK.UQHmKFGmsbcKeo::Main()
Scope Name	ysJBLicFCgZq
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	syrogenerator
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.8
Total Strings	120
Main Method	System.Void PLuSPdcDzppK.UQHmKFGmsbcKeo::Main()
Main IL Instruction Count	51
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String PLuSPdcDzppK.vrhVMONQropgA::nRGrXhrJluM call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean PLuSPdcDzppK.vrhVMONQropgA::TWhnJPiGIHIJKh() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean DjgdyfteXQTH.yrcoTRrhCLLNJ::tucSdYJIKHjQEPW() brtrue IL_0043: ldsfld System.String PLuSPdcDzppK.vrhVMONQropgA::WuOknDSiRMWq ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String PLuSPdcDzppK.vrhVMONQropgA::WuOknDSiRMWq call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String PLuSPdcDzppK.vrhVMONQropgA::XONAikmueQZyfBT call System.Void DjgdyfteXQTH.iVCbbhqsoyZjTsrl::VueCBpDbYUmnmh() ldsfld System.String PLuSPdcDzppK.vrhVMONQropgA::XONAikmueQZyfBT call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String PLuSPdcDzppK.vrhVMONQropgA::oegmIuZzGtPd call System.Void ROgeBRnOuebPW.oQKsqUpSJhuoh::vFMLouLWkYk() ldsfld System.String PLuSPdcDzppK.vrhVMONQropgA::oegmIuZzGtPd call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void DjgdyfteXQTH.JSWTthSteHL::vlswcDTGxDQI() call System.Boolean DjgdyfteXQTH.JSWTthSteHL::bQpruWmHtkgR() brfalse IL_0089: call System.Void DjgdyfteXQTH.JSWTthSteHL::vlswcDTGxDQI() call System.Void DjgdyfteXQTH.ZPzwaZGSXo::BFmWVIqnIDqozy() call System.Void DjgdyfteXQTH.JSWTthSteHL::vlswcDTGxDQI() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean axhTdnWQhBDTksE.UsbsGvBITN::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void axhTdnWQhBDTksE.UsbsGvBITN::XOZPepTsEskLQoM() call System.Void axhTdnWQhBDTksE.UsbsGvBITN::ZHofSQKsYJ() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Module Name	ysJBLicFCgZq
Full Name	ysJBLicFCgZq
EntryPoint	System.Void PLuSPdcDzppK.UQHmKFGmsbcKeo::Main()
Scope Name	ysJBLicFCgZq
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	syrogenerator
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.8
Total Strings	120
Main Method	System.Void PLuSPdcDzppK.UQHmKFGmsbcKeo::Main()
Main IL Instruction Count	51
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String PLuSPdcDzppK.vrhVMONQropgA::nRGrXhrJluM call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean PLuSPdcDzppK.vrhVMONQropgA::TWhnJPiGIHIJKh() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean DjgdyfteXQTH.yrcoTRrhCLLNJ::tucSdYJIKHjQEPW() brtrue IL_0043: ldsfld System.String PLuSPdcDzppK.vrhVMONQropgA::WuOknDSiRMWq ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String PLuSPdcDzppK.vrhVMONQropgA::WuOknDSiRMWq call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String PLuSPdcDzppK.vrhVMONQropgA::XONAikmueQZyfBT call System.Void DjgdyfteXQTH.iVCbbhqsoyZjTsrl::VueCBpDbYUmnmh() ldsfld System.String PLuSPdcDzppK.vrhVMONQropgA::XONAikmueQZyfBT call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String PLuSPdcDzppK.vrhVMONQropgA::oegmIuZzGtPd call System.Void ROgeBRnOuebPW.oQKsqUpSJhuoh::vFMLouLWkYk() ldsfld System.String PLuSPdcDzppK.vrhVMONQropgA::oegmIuZzGtPd call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void DjgdyfteXQTH.JSWTthSteHL::vlswcDTGxDQI() call System.Boolean DjgdyfteXQTH.JSWTthSteHL::bQpruWmHtkgR() brfalse IL_0089: call System.Void DjgdyfteXQTH.JSWTthSteHL::vlswcDTGxDQI() call System.Void DjgdyfteXQTH.ZPzwaZGSXo::BFmWVIqnIDqozy() call System.Void DjgdyfteXQTH.JSWTthSteHL::vlswcDTGxDQI() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean axhTdnWQhBDTksE.UsbsGvBITN::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void axhTdnWQhBDTksE.UsbsGvBITN::XOZPepTsEskLQoM() call System.Void axhTdnWQhBDTksE.UsbsGvBITN::ZHofSQKsYJ() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop

Artefacts

Name0	Value
Key (AES_256)	SklyTXhJcVVBc2xqRXhqZncyYWE3MjdreFVTSFB6RkE=
CnC	88.251.102.37
Ports	4488
Mutex	AsyncMutex_6SI8O

804535fc5f5c8c802ebd2502c351b57c (48.64 KB)