Malicious
Malicious

804535fc5f5c8c802ebd2502c351b57c

PE Executable
|
MD5: 804535fc5f5c8c802ebd2502c351b57c
|
Size: 48.64 KB
|
application/x-dosexec

Print
Infection Chain
Summary by MalvaGPT
Characteristics

Symbol Obfuscation Score

Very high

Hash
 Hash Value
MD5
804535fc5f5c8c802ebd2502c351b57c
Sha1
237e47469bc88e7e715bf6d416ae3d5e1d97249f
Sha256
5e680cd8708e4e87ef858a5a8921157e7e8bc13a7ea04a93086a7996642605b0
Sha384
56be9285ed570c18946f41a746688f3b6b961d1b222f47540fecd4a595c534331b62a135e2135d9b9bac14d90dd4a291
Sha512
f68002422a9d24630e749bd68b690a6e9dcbc103a1f5387ba6ac0e207ba2c698fc4ae7202539ca94d016bfa96e1d66f2b11515524df5e152fd9e06f36e618759
SSDeep
768:LukzVT0kLd3WULVPdVmo2qDXDS9eCSY/2wWeKvmcd0bk6hIYLvd/RscDr3DcDZ9m:LukzVT0M912U9YejeKvIbk6WYL4c4d9m
TLSH
36233B0037E9812BF3BE4F74A9F26205457BF2773603D64A2CC451D65A23BC69A429FE

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
804535fc5f5c8c802ebd2502c351b57c
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Malware Configuration - AsyncRAT config.
Config. Field
 Value
Key (AES_256)

SklyTXhJcVVBc2xqRXhqZncyYWE3MjdreFVTSFB6RkE=
Pastebin

-
Certificate

MIIE8jCCAtqgAwIBAgIQALE68jKeuRy9BViGkxcFXTANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjUxMjA3MTIxMjU4WhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAJmhO7weERMU9y08zf19/eWApZ6jwtdzk4b9lXF/nA1k14eYupe7DHZmapxBBYVz7zhwGtsT0j6tLi+p80uBhsNmvgkZqGHuFiPPW33rGdI/B4VRBGUG0Y0zPS3cXEItWdVIo8LddisECnkOu4hNNyjbAu6RPWMgSCbwNPN4BGElZkFrL5q3oFLA5ksbbD+Qmt9GT8Rc6N8+Ga+A8A3zO1MKjm7fhyreeLHNEIlDwzKQEvNpG79IP2V6/LiEetsWWc0EPZFc0OuWFapuzITmV3QUl+wJMQbU8kNitSsEBBblUnDAkaQBCvd9BpIUfOan10CBPTuO3ePQCN3HJu60crnvrJqo8VbgXpG7C0lb5TtOLV2y+ybTT3EuvGHyzWqQZRKhX55O/cKQHq0hu8VzzONTSq3jaqUIknwe7I70kZ5fvUgNbeMmDx3PdSwx091lgW9ucv5sVr/odABaiN88R1GPgrx/T/5LtLwSuuPK0JG2PImGZabpjnoeiegXNryZs0T9mYXLSMj1YbhTbUL57jGdoDFObbZkzdARfwapkpnw3nUYS893Ivef02i7AXHlvYdPnZplC2+CuhvP/SzPj3/P4d3VjSHOlVtpSARJzV4BSO3DFDfeRtSy+RuJk3VFbpesRfl1h81Sk5mtovRzM+ZIyarZHRZug5s3Z2eYyc4PAgMBAAGjMjAwMB0GA1UdDgQWBBSL9ZJ4aNjsa4cQoJMBGHlKXqe5MzAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQAfLokeaEHGWDG9Z22YZSQlwo1DmqBklUQwjG3r/VMZnztEfVvgruyrz9L7Ip5NzvbpTra7NEKu+gGw6Aq4OceLZ/zJ1ET1MP16dE8RQC8f2T0Mqbe67rpQTjqU6kSxmx+VGnvLpNFpy69SDwTAlKY7w9BP+fZQ5RbHYiyRyJ8vWKeXf9Ky614o2A86+X2JDqVbf1LcqUpSWrewlHt6IYNTAimiMdKfFzPYUl33K7QgC9zlZuj2w1/qcdI4zQBCSDtwW5ZAi8yC/aJXGFGGBC284KSTZ1c87PsmpM/lLOezVyA5WGjw6brUTaWXWh4ihDQmDBA/zmAGsQKtajuQbSBPFSJdYNHMGaaEmS+C0QqM4olonGPtnUDYt9Y3s102dsJhU7Yjb6EKoaoIB3trjVzy0x0KR1JUgeLi5Nur7cvzakbRBflvykPv61N2z+cX72Yf1iTmb/JvU4/p8ivFc67SsHuiNwUsG+JHLq0Xjklps2japJnGMDVkRvkIhOGHlHnaUI3giZxrbF3EePwt64Gm2MhI3IBQFnQO0eJU/CHGgGVamz7t/HXx1clfR09hxlKKtB8rBnBxl+fVDlH3a5m+SV+6Yh3I1WXTCT31vYFS8uQn4jiXUgxwnSzOLGh0vfK7lhOjFqE8POlSJBgcsyeIwItoniMIaYBICAGIMryddQ==
ServerSignature

fujNFEVzz4f4QKTpeWUUy9XDv8ZMogTudOJzmImHBHerj4cguMI7X7mStrm2yDXKcif2858aO/DoUzk2vn61s8W+GYnj9uK4IDrkGRQCBinQfrNYZMvnbbFiRr5YXbrVH33kMi1x6+ByZzSNAdHLvzaXCjKRfs0m9KzdA9UzkkCVpizAYKK6D5O2se0FMlEovEge9MOYBqUNZc+N61f0bMBVqgJUn0ygIDaFJf02bfs5nU15BgR/vqgPJzcwMB8OsDl0xZgxYfnFtldRLvzJlgGYvbzzujaREPZllOh5MoqfcpyvFr5+cP8LWSupKAO7NvmVOlYQ0JLa3Qo0Wv9VIdIQ2c7OoFUMmYHmJBGOZ2W7UZqBe7qYC06V5X3GdkQwC0qdqVgnyoVgxJ1o4OZJhrUltOjmsdNiCZjKI9LxauNaWQRH3kwugAxdZAL+SEcC7tw0USlUWZYeHVjCLGP3LL7f+h2O8G29kyjArH+lNRTmt7gyfX1E/G6Lgmg2RhAkeNRqh5NXiD+w15W2HpPDbVO/aoo8FFjOmqPGdACKpDGmLICgSUVIY+clnvqaBqHam72abeBriByPFtbzglo9sEAnOmACoAT9C9elbdb7jtvNYUxG4P+t52iKHepY82l+OOsmet6tCULlXe+22IY/FT6hr0WeXm63
Install

false
BDOS

false
Anti-VM

false
Install File

update.exe
Install-Folder

%AppData%
Version

0.5.7B
Hosts

88.251.102.37
Ports

4488
Mutex

AsyncMutex_6SI8O
Delay

3
Group

Default
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

ysJBLicFCgZq
Full Name

ysJBLicFCgZq
EntryPoint

System.Void PLuSPdcDzppK.UQHmKFGmsbcKeo::Main()
Scope Name

ysJBLicFCgZq
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

syrogenerator
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.8
Total Strings

120
Main Method

System.Void PLuSPdcDzppK.UQHmKFGmsbcKeo::Main()
Main IL Instruction Count

51
Main IL

ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String PLuSPdcDzppK.vrhVMONQropgA::nRGrXhrJluM call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean PLuSPdcDzppK.vrhVMONQropgA::TWhnJPiGIHIJKh() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean DjgdyfteXQTH.yrcoTRrhCLLNJ::tucSdYJIKHjQEPW() brtrue IL_0043: ldsfld System.String PLuSPdcDzppK.vrhVMONQropgA::WuOknDSiRMWq ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String PLuSPdcDzppK.vrhVMONQropgA::WuOknDSiRMWq call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String PLuSPdcDzppK.vrhVMONQropgA::XONAikmueQZyfBT call System.Void DjgdyfteXQTH.iVCbbhqsoyZjTsrl::VueCBpDbYUmnmh() ldsfld System.String PLuSPdcDzppK.vrhVMONQropgA::XONAikmueQZyfBT call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String PLuSPdcDzppK.vrhVMONQropgA::oegmIuZzGtPd call System.Void ROgeBRnOuebPW.oQKsqUpSJhuoh::vFMLouLWkYk() ldsfld System.String PLuSPdcDzppK.vrhVMONQropgA::oegmIuZzGtPd call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void DjgdyfteXQTH.JSWTthSteHL::vlswcDTGxDQI() call System.Boolean DjgdyfteXQTH.JSWTthSteHL::bQpruWmHtkgR() brfalse IL_0089: call System.Void DjgdyfteXQTH.JSWTthSteHL::vlswcDTGxDQI() call System.Void DjgdyfteXQTH.ZPzwaZGSXo::BFmWVIqnIDqozy() call System.Void DjgdyfteXQTH.JSWTthSteHL::vlswcDTGxDQI() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean axhTdnWQhBDTksE.UsbsGvBITN::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void axhTdnWQhBDTksE.UsbsGvBITN::XOZPepTsEskLQoM() call System.Void axhTdnWQhBDTksE.UsbsGvBITN::ZHofSQKsYJ() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Module Name

ysJBLicFCgZq
Full Name

ysJBLicFCgZq
EntryPoint

System.Void PLuSPdcDzppK.UQHmKFGmsbcKeo::Main()
Scope Name

ysJBLicFCgZq
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

syrogenerator
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.8
Total Strings

120
Main Method

System.Void PLuSPdcDzppK.UQHmKFGmsbcKeo::Main()
Main IL Instruction Count

51
Main IL

ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String PLuSPdcDzppK.vrhVMONQropgA::nRGrXhrJluM call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean PLuSPdcDzppK.vrhVMONQropgA::TWhnJPiGIHIJKh() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean DjgdyfteXQTH.yrcoTRrhCLLNJ::tucSdYJIKHjQEPW() brtrue IL_0043: ldsfld System.String PLuSPdcDzppK.vrhVMONQropgA::WuOknDSiRMWq ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String PLuSPdcDzppK.vrhVMONQropgA::WuOknDSiRMWq call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String PLuSPdcDzppK.vrhVMONQropgA::XONAikmueQZyfBT call System.Void DjgdyfteXQTH.iVCbbhqsoyZjTsrl::VueCBpDbYUmnmh() ldsfld System.String PLuSPdcDzppK.vrhVMONQropgA::XONAikmueQZyfBT call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String PLuSPdcDzppK.vrhVMONQropgA::oegmIuZzGtPd call System.Void ROgeBRnOuebPW.oQKsqUpSJhuoh::vFMLouLWkYk() ldsfld System.String PLuSPdcDzppK.vrhVMONQropgA::oegmIuZzGtPd call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void DjgdyfteXQTH.JSWTthSteHL::vlswcDTGxDQI() call System.Boolean DjgdyfteXQTH.JSWTthSteHL::bQpruWmHtkgR() brfalse IL_0089: call System.Void DjgdyfteXQTH.JSWTthSteHL::vlswcDTGxDQI() call System.Void DjgdyfteXQTH.ZPzwaZGSXo::BFmWVIqnIDqozy() call System.Void DjgdyfteXQTH.JSWTthSteHL::vlswcDTGxDQI() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean axhTdnWQhBDTksE.UsbsGvBITN::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void axhTdnWQhBDTksE.UsbsGvBITN::XOZPepTsEskLQoM() call System.Void axhTdnWQhBDTksE.UsbsGvBITN::ZHofSQKsYJ() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Artefacts
Name
 Value
Key (AES_256)

SklyTXhJcVVBc2xqRXhqZncyYWE3MjdreFVTSFB6RkE=
CnC

88.251.102.37
Ports

4488
Mutex

AsyncMutex_6SI8O
804535fc5f5c8c802ebd2502c351b57c (48.64 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙