Malicious
Malicious

8c962a7dadd6ee047c86ea37f95d334c

PE Executable
|
MD5: 8c962a7dadd6ee047c86ea37f95d334c
|
Size: 114.69 KB
|
application/x-dosexec

Print
Infection Chain
Summary by MalvaGPT
Characteristics

Symbol Obfuscation Score

Low

Hash
 Hash Value
MD5
8c962a7dadd6ee047c86ea37f95d334c
Sha1
5bd20f0243a95e1397b95c859d07f10da51ecb93
Sha256
f07e85c6e9a94e0502a927410135314b878c395a273e49ab414868149f71d04d
Sha384
a601cfe5aac48d2a6c282639ab5ec82999bd16a6c0f637de183f6e4414150479c9af7fd18019bbd0f4d44c2aedd8797d
Sha512
9d6e121f5214823982a6772204f871b17232627bd6ef8ab1aff8e30c81a138d94659bc727ed9a540b12288fdcede9a8e98c4441ef2fb91f0db436859df3e0b90
SSDeep
768:auANNTR4ydbWUnrGJmo2q7vLDpPPI8zjbKgX3iT3c+WM6F7gBS2BDZALj8mqOp:auANNTRZ22mdI83bdXSTNCeBSYdA9p
TLSH
26B390073B944322E5AE0AF478B225FCC52FAD237AD7FB4A1C44715603336EA5A115EB

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
8c962a7dadd6ee047c86ea37f95d334c
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Malware Configuration - AsyncRAT config.
Config. Field
 Value
Key (AES_256)

M1FWdko1ZVIwYTB1UkY0b3MzWHYwVFpQNDAxTTdBN2I=
Pastebin

-
Certificate

MIIE8jCCAtqgAwIBAgIQAKVftBHhqqUdcMK3c1LUQTANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjYwNTA1MjI1OTMzWhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALSCt94AtQhLG8af3dtv0P+9GwwD3m0u/MwmPomfcdSb/bNV12kRkw5ovGQBq1XMo1VAoBvNv2225Ch4tc/Z47hsxcIG09TJRL3pVazPn0ax6ax7ERqznDQXYgqk7nArCUcs51fWekUucNPCqKnscSijDMLCTt7IQCtClTuCkByJJsP9f0wG3IFRwV49X/Us0wcRDU3HDJ+GxKMdWw0y5pawRrXmDOGuTRIExksDWBnhDh7akQ1RDmtWFEGwGNi+wBD5vtAxCZ6UnPF/LWerUqbQzqMf5TECCXrl6DnVijffvcDYwGFi2aXm5wamVXc/qILNWRzuMZdtQzskdBWkCpOdqyZ9V2YqLZjmux2l312yx7Jmw6jPn9jIKJ73JKYL9cUXa2Edm/rMtEJfemAVtxF76tn+U3XkhW8e1sLMvCe/4tB2BKtX0a8h8NKBf2VYWnbj70eQwa+ToV+cCqp/d5SSmO4NuVvyekuYjnmQO+ADTd9TgVC/iO9k7UJxu8+ZBjBC17XIKcvPszOhm5XmdRixGfN55Y6bIIVOsC4xrV9ZElJzMed7ZXPwHcLtjS6OZCccl4RNqDKFnRAFTA4f3PWC7+0xYbpx5kCm1XzGzXVImikch5uVvb2rzhyivC9XbKksffvzXEVr8oulgJaJXDDEz5B8C2I2jam/xraisRBXAgMBAAGjMjAwMB0GA1UdDgQWBBTI/ofcyXL2Qz4Re84MP7dhioYazzAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQAMbLSWC0mVgwSx+hTIB1g7Vg7qFdYUuF4fagRJV0DLuDeeV8imeS5/YGMyY4mFEXGDYPWCu123gpnOgpiLT7QdxV0dIJfedcDoluzreDLpUIwLYIe5xVuk2g2VsqOvajvRcEt1O2ajA/KQS0oKv95ercHggRB5iCQg3IykUEEYev/t7mgoGWBA+V6/22tJ1HQUo4c1u1DHG3tp7b1DD2Kz0/2IkRyjCtF0GWT/GBNSxkxdaSwlLGYc0RZXLlLGkk0FpOvcJDWh8BqSCjt+0isqO11lbVBuMGS6Vd/H28FujzdUhhf9ldvpUwiuignHf8Ww+mq2/t+v9xiqGHmM/vdGSLvbiJGvV+TlIYiEk5Yq10G4aGmbB36SRQuWnGuaizyVBtCj71emstYkGpZFBmI6hAIDZi5uqrxrgMWx/qxiMAMUPJ9fKyqYLJqao1upkvOIw44hOG+XDgu3lt+fhbxLpAtIGZlXG46kQ//EU2qDyO/dHWEHFn8YUDSGkso2qJwH6NFs5cbk5orpPDShPkyKPx/glq9+EcZoVtqxYfIvIEsEF6soJHQ9nLGgb/yI1QFdDaJ0hvwCKzc8fVHOcKyF7WcbXn2IUChNMKry7QzZXh1+yI/+u5mvVeWEksgeK5XnuWVxl+LnItOzYuGmnShTuH5BBiPzPgc7msZWHle3Mg==
ServerSignature

M05JbFqn2THg4W6vwwvbpqwsBivxuhXznLa4aTSg3dPBbekpM+E8Ob5Cje9m8dYd3vxC76TRBGMYdu951i8hDKxR3hoBq8IPXLOxwwi/05bTwjn6RL7B824Pxg4wnZOBecu5FnYtW+hlL9YWwP93IPcCVQzICpkf9s5raXz+oi5CHk5MSFy0ti44wQhKari5R94+Jh5uJ1h/6qD5ufwMtskYiPwgDZ8RyzOH78rKg+Bxoy5/ZKfUHIRE2ctsJ3gcE4cX25x0KANBr6k19gPOBAuYu+NRUlNFY1qQZZCronqT9iyPOLUE8Ehz17n5WWNluaFUgj0Ui+LR5NXjSudXKI/Onl0XXoab42rNzDYWXJ25tcfviWbolUwg6cRDFekuwMCXLXgfWiuCbEIsTHUkUFOgpn7Us4K1ds9k7TjyXqeL3FB0HM1kWFekKU50k97srR01NA/yO5IEal8PRhHfyIn+xbKbaejAsRWRcZiuydEtt2HiM0FVfoRS5e9PnQ4+mbVz302x7Ze6PYPGWZcySuzkQ332z6MD0kUF4AkJTq7bFTLcvM44Mic8xRWOpYHINOhIqeOTctfLQY2ZIjKlvpWuYYkN6UNWcQeTI4mHb1RzZVpg6gRBhar7UQMAnGY/vQcktlftoV7/RwS5jLNGEDzfLg/ZLPJqDbL4haw4vOE=
Install

true
BDOS

false
Anti-VM

false
Install File

DiscordSetup.exe
Install-Folder

%AppData%
Hosts

www.crewbloom.it.com,crewbloom.it.com
Ports

80,443,8080,8848
Mutex

CT3dapX6ofg1
Version

0.5.8
Delay

3
Group

Default
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

Discord (1).exe
Full Name

Discord (1).exe
EntryPoint

System.Void Client.Program::Main()
Scope Name

Discord (1).exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Discord (1)
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

120
Main Method

System.Void Client.Program::Main()
Main IL Instruction Count

51
Main IL

ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0043: ldsfld System.String Client.Settings::Anti ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String Client.Settings::Install call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() ldsfld System.String Client.Settings::Install call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BDOS call System.Void Client.Install.NormalStartup::Install() ldsfld System.String Client.Settings::BDOS call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.ProcessCritical::Set() call System.Void Client.Helper.Methods::PreventSleep() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Module Name

Discord (1).exe
Full Name

Discord (1).exe
EntryPoint

System.Void Client.Program::Main()
Scope Name

Discord (1).exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Discord (1)
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

120
Main Method

System.Void Client.Program::Main()
Main IL Instruction Count

51
Main IL

ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0043: ldsfld System.String Client.Settings::Anti ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String Client.Settings::Install call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() ldsfld System.String Client.Settings::Install call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BDOS call System.Void Client.Install.NormalStartup::Install() ldsfld System.String Client.Settings::BDOS call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.ProcessCritical::Set() call System.Void Client.Helper.Methods::PreventSleep() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Artefacts
Name
 Value
Key (AES_256)

M1FWdko1ZVIwYTB1UkY0b3MzWHYwVFpQNDAxTTdBN2I=
CnC

www.crewbloom.it.com
CnC

crewbloom.it.com
Ports

80
Ports

443
Ports

8080
Ports

8848
Mutex

CT3dapX6ofg1
8c962a7dadd6ee047c86ea37f95d334c (114.69 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙