Malicious
Malicious

8341c41df42418a3e60b58aeada9382c

PE Executable
|
MD5: 8341c41df42418a3e60b58aeada9382c
|
Size: 46.08 KB
|
application/x-dosexec

Infection Chain
Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Low

Hash
 Hash Value
MD5
8341c41df42418a3e60b58aeada9382c
Sha1
a3ca6db514465da457bf303e36e20720563e2b19
Sha256
dfd94151544cfefdfdfc52c9904e295d76d3240b4f6b77728e45096e84da4339
Sha384
08344c49aa50263b59115ad7857279f559ec2b8ca2cf6fb186301c18fb7db466b59c944ee34e0e11edda199f0d64bd2e
Sha512
b71b945734e0b38edd3d8d3dd5a7850c36baf7cc464774d4d1a0e7a8d571186a3a93e4e871ede52bf7747b874217d5ead0c84454367e6ebf6e431a1d29e70bd4
SSDeep
768:luI1tT/w70kWUquzumo2qzEKjPGaG6PIyzjbFgX3ihCwDkJJVnHCVux1KBDZWx:luI1tT/kW2tKTkDy3bCXSbinHg9dWx
TLSH
9D232B003BE8822BF2BE4FB89CF26145867AF5636603D6491CC451DB5713FC69A426FE

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
8341c41df42418a3e60b58aeada9382c
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Malware Configuration - AsyncRAT config.
Config. Field
 Value
Key (AES_256)

MUNGMW9xbHZSZmxBS0puVUw3NEY5c1diQUMxUkVOYng=
Pastebin

-
Certificate

MIIE8jCCAtqgAwIBAgIQAKw9mt/Fkh6TGXVevL8wNTANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjUwOTA0MDUzMTQyWhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAIswodtF9eWn2PKRxQAHI7KS5yn9pdfrOuc6S8ZAvvFKT9oW9ec9oqdC5QNN4fLAotv3Dzlio8076ONysqoGtLhKOTasFu0s++KcPrrdim21KwRHhJAWayb2ST+RojpKkUAac6mWwpDOywjZY08X6Vj1rvWl4tsiALZNMhKYg4sz08+ueSN8TWFMhW4R11BVI8UNgGPw/0Xrht1t0ZW9+gn6ynvcaK2C71SKRHIt5Qib5nf0Om0jqUQIDQW5P4ADmfI+yrCSkksfr38Ub+CXd7YAzdEek35caEEf5yLP9xN5v8cMfyRZQ+oMwgWBFln8vLBvUM4RABhWHPQgq7OOPeCehN0vEjVJ5ddcnS0SyZVYctxCzVFCLis997Oq1KR3mbKZvi36YnGGI7DbYVCegLkp2yzWSV7CU28hqNZS6txSA0LqgXYYOwlsmkH3w433rg0p6VR+GDk6ZwFlsSy5fdHY9xIrn3SFYTEMsBqSQv2+WsP5P2RbD0fkZSBp2EG+O4EZz/9leq3Q69Ma37GvYyB5DKVlNU4soQY3qmuWeaBovTHiKPKFUcjM6QO7h+tmYzr8EDxB7Nz2wVfKqZoveLOb9bgnJLbhP2EdM1DtWgDvDT2eOKvkFX0ncH+ZvLF6bIY2cDNNM6Ea59iWVXZca7yu30wL7FCTTHP1zzjPsnIFAgMBAAGjMjAwMB0GA1UdDgQWBBRq8WAFIbuhPRXzlj0tUDS5E8QrcTAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQAZT5dglkzC65obkrRgavbwYqhre7lNvKOOe7QaJN0iZlxpeoRlkMwUY34bHPQmstztUmGQiUZnRSrp5GIZ6piEBa0dgiEsSdviGuRgH2A2zIuVZLSUBU6toziGFnlgrSDcyWpgkcAcTretsp4gliUTL5Kv0YU8w91OQa5VKZvlL1gmM1cKK8KSh9oA1m7EvKuWnXqApk3QxCLLkR99gCSsEAc6j+eFu/GJLZuag8lIcRlm6OUf7icjqqKcMCUWwLCFJxDuYmvIn3wLqIlmwHYxjQyKTHxMKg5p+uVuQJIvWSdilHAEiOZqMc/FMZKgVbF2N4PFu6+FVgpdQx08FzD7KhsRdZYujDOC2z2JMBBKJ8lmhAdkmR2cGdXccnIomcYHCPPWYgVgAaoCaZEgVji/nDN5WQgeLrkfapcSuN9Fe2TADLja7WIhriKwFrTIbnSyR6AOzwSJZ4byMkucQHni2MFuL3NRrcKoOspyrReM2aAlAkCEIiBmroDtd6mJ16J/DdKa/0ZH+ZP9dqQY254kzmMH4XPyYJP/jj3lsQ9xyembNtx97peRLovT70wQKgd91MPWpjywK337iGcOuw0dkYRIT3ofvdWwBWcppeDPYmldo+Y+3FwoZfZWFnvrW4BzShFV2kIEy/oqsMNXCkTq1cmiyT5e3kWfl4UKpj716A==
ServerSignature

GI5ZsQs1mFNNhlQ/yzK0kqUQRbwCeHLYwDOkIPJ9CEWLAXsZcOJDiCIqh6bMXT1yAhRpyGLjtDcMGIF+TycrLlHpm2yWiEhGLmdtCusUqwqf875qPb0j7RDX9TG5ZHcCC+51vG/u5gdHW3VPwH3rUBKeya+Ao7w/4fx+tkjIy7jM+PoFkPgQcdax8sWuujb/LYRTU5nB/UPSpUeld7C3FlcV4dvL7TwctdLVBGR+SPCgxhn4gQyBFKq99PeRKb4Xu2WVhNPwHp0Ra0eMFfIkstZHYYYWXeu0ffzRqOk/QNMqtHGVsWjVbMmormEFdsIqlzMLUKqLfj+fBx9ahCfcdfPNoj8T0oQpbGOxGKhmsEvtU7PcECfTJAjbGKO3Ysc28rsvCw8Ir7spEmzCvjCv6AbIl/JIQ3pJU5YW5D3cAsl6OheLh8DqyH06EZu1IhQmznNCTa08RrRXpEz38zYN3GBEHhBbJA6CeijDnBPdhNRJXRWVvnlF+ueRf8LUP0WNTywjNN97Omy+7xWZ010/yEqvnls9zTmgc2+32McSsfXDVPgC82ViB11/nPwAgvREHSRxzO918kfmo9xuZOMIRh/jqW/CyNiCHfHqgXwqzJM00KJnUqBsNteBGwTp0leVVQbIVfdIbQOWLagaH3dZxcfnpc22BB+s
Install

true
BDOS

true
Anti-VM

false
Install File

ICANT.exe
Install-Folder

%AppData%
Hosts

192.159.99.13
Ports

7777
Mutex

t7qX3R5iCCpo
Version

0.5.8
Delay

3
Group

Default
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

AsyncClient.exe
Full Name

AsyncClient.exe
EntryPoint

System.Void Client.Program::Main()
Scope Name

AsyncClient.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

AsyncClient
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

120
Main Method

System.Void Client.Program::Main()
Main IL Instruction Count

51
Main IL

ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0043: ldsfld System.String Client.Settings::Anti ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String Client.Settings::Install call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() ldsfld System.String Client.Settings::Install call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BDOS call System.Void Client.Install.NormalStartup::Install() ldsfld System.String Client.Settings::BDOS call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.ProcessCritical::Set() call System.Void Client.Helper.Methods::PreventSleep() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Module Name

AsyncClient.exe
Full Name

AsyncClient.exe
EntryPoint

System.Void Client.Program::Main()
Scope Name

AsyncClient.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

AsyncClient
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

120
Main Method

System.Void Client.Program::Main()
Main IL Instruction Count

51
Main IL

ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0043: ldsfld System.String Client.Settings::Anti ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String Client.Settings::Install call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() ldsfld System.String Client.Settings::Install call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BDOS call System.Void Client.Install.NormalStartup::Install() ldsfld System.String Client.Settings::BDOS call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.ProcessCritical::Set() call System.Void Client.Helper.Methods::PreventSleep() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Artefacts
Name
 Value
Key (AES_256)

MUNGMW9xbHZSZmxBS0puVUw3NEY5c1diQUMxUkVOYng=
CnC

192.159.99.13
Ports

7777
Mutex

t7qX3R5iCCpo
8341c41df42418a3e60b58aeada9382c (46.08 KB)
File Structure
8341c41df42418a3e60b58aeada9382c
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Characteristics
Malware Configuration - AsyncRAT config.
Config. Field
 Value
Key (AES_256)

MUNGMW9xbHZSZmxBS0puVUw3NEY5c1diQUMxUkVOYng=
Pastebin

-
Certificate

MIIE8jCCAtqgAwIBAgIQAKw9mt/Fkh6TGXVevL8wNTANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjUwOTA0MDUzMTQyWhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAIswodtF9eWn2PKRxQAHI7KS5yn9pdfrOuc6S8ZAvvFKT9oW9ec9oqdC5QNN4fLAotv3Dzlio8076ONysqoGtLhKOTasFu0s++KcPrrdim21KwRHhJAWayb2ST+RojpKkUAac6mWwpDOywjZY08X6Vj1rvWl4tsiALZNMhKYg4sz08+ueSN8TWFMhW4R11BVI8UNgGPw/0Xrht1t0ZW9+gn6ynvcaK2C71SKRHIt5Qib5nf0Om0jqUQIDQW5P4ADmfI+yrCSkksfr38Ub+CXd7YAzdEek35caEEf5yLP9xN5v8cMfyRZQ+oMwgWBFln8vLBvUM4RABhWHPQgq7OOPeCehN0vEjVJ5ddcnS0SyZVYctxCzVFCLis997Oq1KR3mbKZvi36YnGGI7DbYVCegLkp2yzWSV7CU28hqNZS6txSA0LqgXYYOwlsmkH3w433rg0p6VR+GDk6ZwFlsSy5fdHY9xIrn3SFYTEMsBqSQv2+WsP5P2RbD0fkZSBp2EG+O4EZz/9leq3Q69Ma37GvYyB5DKVlNU4soQY3qmuWeaBovTHiKPKFUcjM6QO7h+tmYzr8EDxB7Nz2wVfKqZoveLOb9bgnJLbhP2EdM1DtWgDvDT2eOKvkFX0ncH+ZvLF6bIY2cDNNM6Ea59iWVXZca7yu30wL7FCTTHP1zzjPsnIFAgMBAAGjMjAwMB0GA1UdDgQWBBRq8WAFIbuhPRXzlj0tUDS5E8QrcTAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQAZT5dglkzC65obkrRgavbwYqhre7lNvKOOe7QaJN0iZlxpeoRlkMwUY34bHPQmstztUmGQiUZnRSrp5GIZ6piEBa0dgiEsSdviGuRgH2A2zIuVZLSUBU6toziGFnlgrSDcyWpgkcAcTretsp4gliUTL5Kv0YU8w91OQa5VKZvlL1gmM1cKK8KSh9oA1m7EvKuWnXqApk3QxCLLkR99gCSsEAc6j+eFu/GJLZuag8lIcRlm6OUf7icjqqKcMCUWwLCFJxDuYmvIn3wLqIlmwHYxjQyKTHxMKg5p+uVuQJIvWSdilHAEiOZqMc/FMZKgVbF2N4PFu6+FVgpdQx08FzD7KhsRdZYujDOC2z2JMBBKJ8lmhAdkmR2cGdXccnIomcYHCPPWYgVgAaoCaZEgVji/nDN5WQgeLrkfapcSuN9Fe2TADLja7WIhriKwFrTIbnSyR6AOzwSJZ4byMkucQHni2MFuL3NRrcKoOspyrReM2aAlAkCEIiBmroDtd6mJ16J/DdKa/0ZH+ZP9dqQY254kzmMH4XPyYJP/jj3lsQ9xyembNtx97peRLovT70wQKgd91MPWpjywK337iGcOuw0dkYRIT3ofvdWwBWcppeDPYmldo+Y+3FwoZfZWFnvrW4BzShFV2kIEy/oqsMNXCkTq1cmiyT5e3kWfl4UKpj716A==
ServerSignature

GI5ZsQs1mFNNhlQ/yzK0kqUQRbwCeHLYwDOkIPJ9CEWLAXsZcOJDiCIqh6bMXT1yAhRpyGLjtDcMGIF+TycrLlHpm2yWiEhGLmdtCusUqwqf875qPb0j7RDX9TG5ZHcCC+51vG/u5gdHW3VPwH3rUBKeya+Ao7w/4fx+tkjIy7jM+PoFkPgQcdax8sWuujb/LYRTU5nB/UPSpUeld7C3FlcV4dvL7TwctdLVBGR+SPCgxhn4gQyBFKq99PeRKb4Xu2WVhNPwHp0Ra0eMFfIkstZHYYYWXeu0ffzRqOk/QNMqtHGVsWjVbMmormEFdsIqlzMLUKqLfj+fBx9ahCfcdfPNoj8T0oQpbGOxGKhmsEvtU7PcECfTJAjbGKO3Ysc28rsvCw8Ir7spEmzCvjCv6AbIl/JIQ3pJU5YW5D3cAsl6OheLh8DqyH06EZu1IhQmznNCTa08RrRXpEz38zYN3GBEHhBbJA6CeijDnBPdhNRJXRWVvnlF+ueRf8LUP0WNTywjNN97Omy+7xWZ010/yEqvnls9zTmgc2+32McSsfXDVPgC82ViB11/nPwAgvREHSRxzO918kfmo9xuZOMIRh/jqW/CyNiCHfHqgXwqzJM00KJnUqBsNteBGwTp0leVVQbIVfdIbQOWLagaH3dZxcfnpc22BB+s
Install

true
BDOS

true
Anti-VM

false
Install File

ICANT.exe
Install-Folder

%AppData%
Hosts

192.159.99.13
Ports

7777
Mutex

t7qX3R5iCCpo
Version

0.5.8
Delay

3
Group

Default
Artefacts
Name
 Value Location
Key (AES_256)

MUNGMW9xbHZSZmxBS0puVUw3NEY5c1diQUMxUkVOYng=

Malicious

8341c41df42418a3e60b58aeada9382c
CnC

192.159.99.13

Malicious

8341c41df42418a3e60b58aeada9382c
Ports

7777

Malicious

8341c41df42418a3e60b58aeada9382c
Mutex

t7qX3R5iCCpo

Malicious

8341c41df42418a3e60b58aeada9382c
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙