Malicious
Malicious

836c2f57076a8027cad51c4fb14a7088

PE Executable
|
MD5: 836c2f57076a8027cad51c4fb14a7088
|
Size: 47.62 KB
|
application/x-dosexec

Print
Infection Chain
Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Low

Hash
 Hash Value
MD5
836c2f57076a8027cad51c4fb14a7088
Sha1
a2c0a8af0f784a37e93ad2dea0156933429f0c77
Sha256
ce79aba649f0300718d55ecdc9d9f3b6be82c656b2a76dc38924d932391bce89
Sha384
de86e624e94c0282cd51ca9eecfaee60b428774a8377634444b8375cbf5d12b9ef8405417d7df636852b93028d94ed28
Sha512
deb23ed24e7456efb811085de126046e69d5cb0476ce2568cc7397ce5162e41fe5c0c9dcd6bf8facf3c7f4702b27e2019dbda97b5d6e2f9909b309805f37942e
SSDeep
768:RuntVTRst9nWUbUNlmo2q9IKAB6Q6TXwraPIwzjb3gX3i12kgRiQoJoHFsJBDZfM:RuntVTR602CA/w3bQXS12kkiQoCWXdfM
TLSH
BB232B003BE8822AF2BE5F74ADF26145467AF6637603D98D1CC4419B1713BC6DA426FE

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
836c2f57076a8027cad51c4fb14a7088
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Malware Configuration - AsyncRAT config.
Config. Field
 Value
Key (AES_256)

R08xcEdHM202eTJSTFVmbTg3ZUlpNElCSEE1TUFoWlE=
Pastebin

-
Certificate

MIIE8jCCAtqgAwIBAgIQAN2xrdVOwvtSIepKvvmsVzANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjUxMjE4MTMyNDI0WhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAJjaRa5Hs6nxH+3cdTupHksR+Q48WsyeiUrxZVa/QMltY+1EhSC3nQoTXDwwx5L2OFiDI2dptS9QbjQHOSbQ9Dpfe3NkzdYCJNo9h5sjzrXNHa+sC3S79TnmMoGug9tI4mtEX7/xMKtbXleSTV0Y/C2DYw/sYHEXOpjBHuGQTUibAlCP9RwdoxVr202scd0HaTErk9Bf2tw0kX62iOs5Xt0egd0Mc/Tzli3bSSpG0MNWc58rYdWYZSqBODiWRDSi9bJBSDdac+NNosa2L6KmDrlA1bpEY6dR/EnIn+bNgm8q3nCqoF8Hl5HxssdeB2cl2Aec3KgUaVfwItJH7as07gbW1n7peG3r8DeWucVODHOOK2LUPmNvrrs2KBbMX6qeU70Zswtom8H++7cmlHE1wi5mpgAfBhqgtnuP/NbROPIg3VEcZAAOWAAPe+7XAhESXEgxnKXLMoIOXSX7l+37OtcJB3tJcnSWI/QLYltK1iV8YltRwpNMPC4rdAT2UmOKkpZiuLZcGL+Z6b2KR6Iyar6YGOKh8z+xR08DXxEs0MJ9VktnoP0A5dMnwTUfs18c3kVvozfId86fwdsgMMqRTYvXdsOLyi6NGrYPwRb5pPu33fp+VKwh9n6azfh216ZbRFNY1OBUJOZm4GQks+ygzOCjHkqZLqpecJcSXYI8u9ztAgMBAAGjMjAwMB0GA1UdDgQWBBQpiOlMEUzlCotVDcCWs4U/jF6TbDAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQAkcW9KcZUqILeoRYgWg6OzvZHSmDtp17uH9+TI4EJpozASN53gwcBcASX15k3s3IaELck93KX/R+B1l6XlFYzfd5POToC8oapL5R+Yb2a5edlyWm22qsc3TI6IoI4yf+0KqY4eYfDplt6/PfW6QWLYEuC13L3teF6jbiApsJB1aUq+vLgN+N3YbpzNKJkPopQTtVvwskLeO6xNeADF3EL5RE7tpKT7AGA4dxEpMB9uRY0Ty+hQwNh8fTaOcdqicNs9c2YP4X6RYE+35iSoIkqPtLb251tAoM/zPkqJwt3GJvJpTDeFcpbpUseEKWh1KSdhD5aYbJC9wgRv8VKmbCocKpUhCgNEJwLqXT2gVxKmkoi/OCmRYKniheku691eUwxJl7/3GjskOiOCIWO+ujT9Ma7OzGhzVcS0u4mxeTnHqi2b1lTIVosqFMcOdSa7csdfeedzx8tJqceHGXC4UTYnZwjdd5Z0cYUPj/y9nc6i67oIezxcqazGnSD/sSaguvSq9f1ej6EE+MQJ+5QLJEguu0YM+SDnSf5Kjm6Htz2nnWtVs8TQGrHz+f/eIrurdYvlY8za1KV1qSjRGLGwbXW1jQdnf3r2ZhF/zHl+/i9munZbX8FNFvu7KgmzrYo5Lz+f7KBk5W4LFMRUQ3eF9zlTxKHVJjIQuCcLw5rfhSnA6A==
ServerSignature

UPb/5vHSdsxmoJzQX9rTL4k+rntX57HACxzLVHELLgFEDpRU13VvYj04gzpR5UzNHwUu3dfXco8yQNAZMJIxf3AOy52NbKBpY6OZ4oxJE8VeCnA1gtCLfoFdK4d87fmpTvr6r7+dLDv5tv5QPtAgYLNAMwFr221/sTNG7pZNL/ld5QJgmdBF1zLBdIQWt10t5lKK3eAAWQLkYCi4sh6SEJA39rfhZTfAs3gHUAbGB8iiLNntvpRueDj0+xjVeRsaTY0inUVhebAIdCZ6jFvs3/ZNJgdeZCnfnlPYTCd1CkPVzC4LjilYHvkSJJufV4OjpZZ+zpHqS9rR0SLow754u1lwW+9BicLZ4WZAV09BAY1WFu4aMyMhMXPoRcXjiqeJ7lyiiI9QORuuznuQcgZAMpdG0rlJ2RbsFm+vZiTGRSHYANFqzdPcy9Wr6MQOC8LmFse/6EW8KNNsgBdRUHTRzm8vLaOBE8DFawmG1PsJdZw6rEoTK23LNguvfBxD6JNBDd6fHUlwHzFyBULMYYr89p+6JlS/3UwQcJmMiJssGQFqaVLOvHKo3EIhJDp5+gHECHprpx1fxwAnuk+5bWMPgJelbioCUo5sXoc+ixb9jBa782mGcqRpXhH4IALviDmJOix9haUHEzJ5hCBMy6VRpVv+s5IGn9BN
Install

true
BDOS

false
Anti-VM

false
Install File

unikey.exe
Install-Folder

%AppData%
Ports

80,443,8080,8848
Mutex

gb8Arf95yD6I
Version

0.5.8
Delay

3
Group

Default
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

VertexGuardianPro_v2.exe
Full Name

VertexGuardianPro_v2.exe
EntryPoint

System.Void Client.Program::Main()
Scope Name

VertexGuardianPro_v2.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

VertexGuardianPro_v2
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

120
Main Method

System.Void Client.Program::Main()
Main IL Instruction Count

51
Main IL

ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0043: ldsfld System.String Client.Settings::Anti ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String Client.Settings::Install call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() ldsfld System.String Client.Settings::Install call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BDOS call System.Void Client.Install.NormalStartup::Install() ldsfld System.String Client.Settings::BDOS call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.ProcessCritical::Set() call System.Void Client.Helper.Methods::PreventSleep() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Module Name

VertexGuardianPro_v2.exe
Full Name

VertexGuardianPro_v2.exe
EntryPoint

System.Void Client.Program::Main()
Scope Name

VertexGuardianPro_v2.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

VertexGuardianPro_v2
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

120
Main Method

System.Void Client.Program::Main()
Main IL Instruction Count

51
Main IL

ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0043: ldsfld System.String Client.Settings::Anti ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String Client.Settings::Install call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() ldsfld System.String Client.Settings::Install call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BDOS call System.Void Client.Install.NormalStartup::Install() ldsfld System.String Client.Settings::BDOS call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.ProcessCritical::Set() call System.Void Client.Helper.Methods::PreventSleep() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Artefacts
Name
 Value
Key (AES_256)

R08xcEdHM202eTJSTFVmbTg3ZUlpNElCSEE1TUFoWlE=
Ports

80
Ports

443
Ports

8080
Ports

8848
Mutex

gb8Arf95yD6I
836c2f57076a8027cad51c4fb14a7088 (47.62 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙