Symbol Obfuscation Score
|
Hash | Hash Value |
|---|---|
| MD5 | 92528bef32ecca33e1d5b133de0cc851
|
| Sha1 | 77747226b6f6b3b38b5e1f71d23ddaefd38abaf7
|
| Sha256 | 513e79e43a92f59544bfbcfd0953aaadb4cf330e94c054afb465de5988feb735
|
| Sha384 | 1fb3118ae3f4c0cd69eb23bcf5d8499d42ac926efbbcc973a99f1df5f6ea1050a4f726cdf0740c11239266bf9b3a5c5c
|
| Sha512 | acdb09dc514d06795f8e368fb168126a62566430950297036265737f21f30be30f29ab5e7d96de908d6382777800c023f6710dfe12fb7ed66ba7a18cf96e9cbe
|
| SSDeep | 768:3u4dug2JTbXcZz1WUBHCjmo2qrzmFowdWz7h8xPIg2zjbAgX3ijETmc0JHRgOBDY:3u4dug2JTjOK2HoLXz3bnXSgTmNgAdkh
|
| TLSH | 27232B003BEDC12BF2BF5F74A9F26145467AF6672A02D54E1CC4019B1613FC68A42AFE
|
PeID
|
Config. Field0 | Value |
|---|---|
| Key (AES_256) | eFhGYWVFZVFLUWdGbFNZQlBoQWgzdmY1ZlFGMXcxT2Y= |
| Pastebin | - |
| Certificate | MIIE8jCCAtqgAwIBAgIQAKYcHhywGGUI7zsI52X33zANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjYwMTA5MTQwOTQxWhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALLQZ2j5/rFi4J33YCqbK7w2so7ZNUuWu1DnCEppESTA3fChXi8O7SL0OEH6qJgL8hlpR02i/NevdFjd3fMgQSaIs/HslP2kqveuO9ZaA8pWiDqkW4XKZyYOQBLGXFnM7v1qgHrkIE6s9nSN28X5UBIBdVRX0xWPW6ZNTb7PglMY8krMhV2ZhMQGJfMt32F5ReWbjVMjSbidVMHzCcPGeOsN0PPUHudCP5AMd1RmePLtgt1G60jJosKG2wjBMCIUYX7QmZ0bWsvapNTtPJ1hmN6hV+l/LLMp2IroA9oANqY1pUVlgpqNRTi4hXcXymN+Up4pYmmYNT0qyJAegYzRbFaSZtSRPZ1FOUuHu9glsn0/T7C/1yN2M8LMUuSAShOTY/mxIdywbFUHSlen976q4ee2soGtkwMQMFfd9pkSRXNPLLfPXBDty9+7U93NNepz3AtF/hPPUUdDjM9JiRaZBn4wTBrveLsAtek1xXnQpp6a6w3gfLUvAh6CM9MiSxzwi8o81iMSbdsskH/urDxoQQI+09W0kYSpom5naDSIJSYa3zDJ3Ug91uycZAPdHZ1+kxGCrCl6aUBaKsSLsyXhXF9A7RfzdUD4ROF9M+zVlMRHYnpQ78WHFQBEOhU6clKeWusVVI8YEkjRBKh3HtLbHjjjkFk2AZQ1aaF/sp+pMR7XAgMBAAGjMjAwMB0GA1UdDgQWBBSmNvCzqQmbV6fBeMIZzpZmenxn7zAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQAP9P0Lq/KqHcuDmT5LuEd0rWfB4Mgeivc+Hu62RxLGxYkewJnl7yaxlL+uK2LjIYObXyZLPdwZcX3u1ea2505PIXEpdydUu254xUrPDDEsBEJI9sbzfgGnCh7ZoPxt9YSJ8KuFKu7abbuSUYFo9MGv4dmpCEDziASTj6g7OBp3kffPftKY4EAPBodPbKeKVtrjqOIOos2CcfVXxZtWoDPMCZl7eYJO0qf5rPsAWUfNn87rkG3PDp33bedZgtZauKAWeh3iJfgxD04qIBilQw9IO1YD8nfa23GteM7QZHZWToJVXKEY1F1bT2WdS42h8PMtBLbvlmV9Gy2QIVjC0wX3zXA3bgWEN/M+A9J/7Mz8hJ8Uy/hBjMyVI7epH7UIgWicar3rtMsIvVg97PYe6yw6R9BjSZdVQZ0F7FRJPuETACAeH90EAmtatTnBIjQlpF7lU+NXFPC4WfmYo7zIVKcVc4AKKlrvG8NW2B6hLxYmZ5QgkGQucNAAgiBkm9cgo2ffq1FE4G8jjipahr8g8KCIKULONvRLdhOt6RMOTPnOeOzz7gPTjFQ/Ey1vC44IV5iroIJd9L82vsMb0mZSg70iQpQXzKixf8YRTbENqtCnDyyl61dpPyuTFw0JmxQ7HCGdREe71s5rhWqDtmm+6+tTaJK89iy9GwLw6ONNl4ZBEA== |
| ServerSignature | rG/KAS+Yn529o/0HRNUC9ytEk0LI2qCPrwKIMNXk3g9b2VPLgPFBiJrSnmeH5lmI9SNB21HaTpeIm4wnmCICFbOHjt7DLYBXk2U4XSiiLjXUO5dMm/qxiR3NzI+0/Nqkeri8pOc93ZSAilW3DZq5MxfIzzOewqQxqmJKTq1mwA/vDtKc6L5B91Ykrzw7LjjaFT1Gp7aQiyVZ+LaSAjARa1vLSAridTCM3zDjDLpUYpRe76sWDD+3jhpmgIM+qyAYImXM/THfKcrx/9Of+HzHNGBZWkit5K4YtwqX9IPaXuNsZY3b8d7+lhf9EiQZhqpJHI5fMi0eBJrk+NumYr2/EDCLsmWkQfJVa326T65zxBHCynoxDA6fJ98VXl5pV1u+uhUpeXFd1HEgL9+fhmtqbTVbUm7aWoZ5udNdKpQNWrexwPhEEBqMdDX5rUUecrxUdwtSE9YHcMVuc6yWOYceLoPOMTy5rtE1UMFGXIyoHIVZmPsFVdmBDOP9GW4t2S0z4Pk3GhrQml/NIkNX4YSyiFxWB9o7XE03H9Y8eTTFpy8JHWIrZpaESAyBD82k3oCejm8VSTIYoe5dQVuUuKxLJmp17Ib8QPXNBdksC8uUv9EvhJ8mHCfY7Qsoh/gkq1HOVXSOeeWBRgUgR8YmRc3u5cY+5cyOlIfB77JinZ0pHJo= |
| Install | true |
| BDOS | false |
| Anti-VM | false |
| Install File | VSDC Vanguard Prime Sentinel.exe |
| Install-Folder | %AppData% |
| Hosts | xar.uk.com,www.xar.uk.com,crwqin.ru.com,www.crwqin.ru.com,www.bacan4d.jp.net,bacan4d.jp.net,mdf.uk.com,www.mdf.uk.com |
| Ports | 80,443,4444,4782,5555,6060,6606,6666,7707,8080,8808,8848 |
| Mutex | VSDC_PrimeSentinel_VanguardLock_7a8b9c0d |
| Version | 0.5.8 |
| Delay | 3 |
| Group | AGCCA_PrimeEndpoint |
|
Name0 | Value |
|---|---|
| Info | PE Detect: PeReader OK (file layout) |
| Module Name | VSDCVanguardPrime.exe |
| Full Name | VSDCVanguardPrime.exe |
| EntryPoint | System.Void Client.Program::Main() |
| Scope Name | VSDCVanguardPrime.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v4.0.30319 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | VSDCVanguardPrime |
| Assembly Version | 1.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | .NETFramework,Version=v4.0,Profile=Client |
| Total Strings | 120 |
| Main Method | System.Void Client.Program::Main() |
| Main IL Instruction Count | 51 |
| Main IL | ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0043: ldsfld System.String Client.Settings::Anti ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String Client.Settings::Install call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() ldsfld System.String Client.Settings::Install call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BDOS call System.Void Client.Install.NormalStartup::Install() ldsfld System.String Client.Settings::BDOS call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.ProcessCritical::Set() call System.Void Client.Helper.Methods::PreventSleep() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop |
| Module Name | VSDCVanguardPrime.exe |
| Full Name | VSDCVanguardPrime.exe |
| EntryPoint | System.Void Client.Program::Main() |
| Scope Name | VSDCVanguardPrime.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v4.0.30319 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | VSDCVanguardPrime |
| Assembly Version | 1.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | .NETFramework,Version=v4.0,Profile=Client |
| Total Strings | 120 |
| Main Method | System.Void Client.Program::Main() |
| Main IL Instruction Count | 51 |
| Main IL | ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0043: ldsfld System.String Client.Settings::Anti ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String Client.Settings::Install call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() ldsfld System.String Client.Settings::Install call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BDOS call System.Void Client.Install.NormalStartup::Install() ldsfld System.String Client.Settings::BDOS call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.ProcessCritical::Set() call System.Void Client.Helper.Methods::PreventSleep() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop |
|
Name0 | Value |
|---|---|
| Key (AES_256) | eFhGYWVFZVFLUWdGbFNZQlBoQWgzdmY1ZlFGMXcxT2Y= |
| CnC | xar.uk.com |
| CnC | www.xar.uk.com |
| CnC | crwqin.ru.com |
| CnC | www.crwqin.ru.com |
| CnC | www.bacan4d.jp.net |
| CnC | bacan4d.jp.net |
| CnC | mdf.uk.com |
| CnC | www.mdf.uk.com |
| Ports | 80 |
| Ports | 443 |
| Ports | 4444 |
| Ports | 4782 |
| Ports | 5555 |
| Ports | 6060 |
| Ports | 6606 |
| Ports | 6666 |
| Ports | 7707 |
| Ports | 8080 |
| Ports | 8808 |
| Ports | 8848 |
| Mutex | VSDC_PrimeSentinel_VanguardLock_7a8b9c0d |
|
Config. Field0 | Value |
|---|---|
| Key (AES_256) | eFhGYWVFZVFLUWdGbFNZQlBoQWgzdmY1ZlFGMXcxT2Y= |
| Pastebin | - |
| Certificate | MIIE8jCCAtqgAwIBAgIQAKYcHhywGGUI7zsI52X33zANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjYwMTA5MTQwOTQxWhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALLQZ2j5/rFi4J33YCqbK7w2so7ZNUuWu1DnCEppESTA3fChXi8O7SL0OEH6qJgL8hlpR02i/NevdFjd3fMgQSaIs/HslP2kqveuO9ZaA8pWiDqkW4XKZyYOQBLGXFnM7v1qgHrkIE6s9nSN28X5UBIBdVRX0xWPW6ZNTb7PglMY8krMhV2ZhMQGJfMt32F5ReWbjVMjSbidVMHzCcPGeOsN0PPUHudCP5AMd1RmePLtgt1G60jJosKG2wjBMCIUYX7QmZ0bWsvapNTtPJ1hmN6hV+l/LLMp2IroA9oANqY1pUVlgpqNRTi4hXcXymN+Up4pYmmYNT0qyJAegYzRbFaSZtSRPZ1FOUuHu9glsn0/T7C/1yN2M8LMUuSAShOTY/mxIdywbFUHSlen976q4ee2soGtkwMQMFfd9pkSRXNPLLfPXBDty9+7U93NNepz3AtF/hPPUUdDjM9JiRaZBn4wTBrveLsAtek1xXnQpp6a6w3gfLUvAh6CM9MiSxzwi8o81iMSbdsskH/urDxoQQI+09W0kYSpom5naDSIJSYa3zDJ3Ug91uycZAPdHZ1+kxGCrCl6aUBaKsSLsyXhXF9A7RfzdUD4ROF9M+zVlMRHYnpQ78WHFQBEOhU6clKeWusVVI8YEkjRBKh3HtLbHjjjkFk2AZQ1aaF/sp+pMR7XAgMBAAGjMjAwMB0GA1UdDgQWBBSmNvCzqQmbV6fBeMIZzpZmenxn7zAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQAP9P0Lq/KqHcuDmT5LuEd0rWfB4Mgeivc+Hu62RxLGxYkewJnl7yaxlL+uK2LjIYObXyZLPdwZcX3u1ea2505PIXEpdydUu254xUrPDDEsBEJI9sbzfgGnCh7ZoPxt9YSJ8KuFKu7abbuSUYFo9MGv4dmpCEDziASTj6g7OBp3kffPftKY4EAPBodPbKeKVtrjqOIOos2CcfVXxZtWoDPMCZl7eYJO0qf5rPsAWUfNn87rkG3PDp33bedZgtZauKAWeh3iJfgxD04qIBilQw9IO1YD8nfa23GteM7QZHZWToJVXKEY1F1bT2WdS42h8PMtBLbvlmV9Gy2QIVjC0wX3zXA3bgWEN/M+A9J/7Mz8hJ8Uy/hBjMyVI7epH7UIgWicar3rtMsIvVg97PYe6yw6R9BjSZdVQZ0F7FRJPuETACAeH90EAmtatTnBIjQlpF7lU+NXFPC4WfmYo7zIVKcVc4AKKlrvG8NW2B6hLxYmZ5QgkGQucNAAgiBkm9cgo2ffq1FE4G8jjipahr8g8KCIKULONvRLdhOt6RMOTPnOeOzz7gPTjFQ/Ey1vC44IV5iroIJd9L82vsMb0mZSg70iQpQXzKixf8YRTbENqtCnDyyl61dpPyuTFw0JmxQ7HCGdREe71s5rhWqDtmm+6+tTaJK89iy9GwLw6ONNl4ZBEA== |
| ServerSignature | rG/KAS+Yn529o/0HRNUC9ytEk0LI2qCPrwKIMNXk3g9b2VPLgPFBiJrSnmeH5lmI9SNB21HaTpeIm4wnmCICFbOHjt7DLYBXk2U4XSiiLjXUO5dMm/qxiR3NzI+0/Nqkeri8pOc93ZSAilW3DZq5MxfIzzOewqQxqmJKTq1mwA/vDtKc6L5B91Ykrzw7LjjaFT1Gp7aQiyVZ+LaSAjARa1vLSAridTCM3zDjDLpUYpRe76sWDD+3jhpmgIM+qyAYImXM/THfKcrx/9Of+HzHNGBZWkit5K4YtwqX9IPaXuNsZY3b8d7+lhf9EiQZhqpJHI5fMi0eBJrk+NumYr2/EDCLsmWkQfJVa326T65zxBHCynoxDA6fJ98VXl5pV1u+uhUpeXFd1HEgL9+fhmtqbTVbUm7aWoZ5udNdKpQNWrexwPhEEBqMdDX5rUUecrxUdwtSE9YHcMVuc6yWOYceLoPOMTy5rtE1UMFGXIyoHIVZmPsFVdmBDOP9GW4t2S0z4Pk3GhrQml/NIkNX4YSyiFxWB9o7XE03H9Y8eTTFpy8JHWIrZpaESAyBD82k3oCejm8VSTIYoe5dQVuUuKxLJmp17Ib8QPXNBdksC8uUv9EvhJ8mHCfY7Qsoh/gkq1HOVXSOeeWBRgUgR8YmRc3u5cY+5cyOlIfB77JinZ0pHJo= |
| Install | true |
| BDOS | false |
| Anti-VM | false |
| Install File | VSDC Vanguard Prime Sentinel.exe |
| Install-Folder | %AppData% |
| Hosts | xar.uk.com,www.xar.uk.com,crwqin.ru.com,www.crwqin.ru.com,www.bacan4d.jp.net,bacan4d.jp.net,mdf.uk.com,www.mdf.uk.com |
| Ports | 80,443,4444,4782,5555,6060,6606,6666,7707,8080,8808,8848 |
| Mutex | VSDC_PrimeSentinel_VanguardLock_7a8b9c0d |
| Version | 0.5.8 |
| Delay | 3 |
| Group | AGCCA_PrimeEndpoint |
|
Name0 | Value | Location |
|---|---|---|
| Key (AES_256) | eFhGYWVFZVFLUWdGbFNZQlBoQWgzdmY1ZlFGMXcxT2Y= Malicious |
92528bef32ecca33e1d5b133de0cc851 |
| CnC | xar.uk.com Malicious |
92528bef32ecca33e1d5b133de0cc851 |
| CnC | www.xar.uk.com Malicious |
92528bef32ecca33e1d5b133de0cc851 |
| CnC | crwqin.ru.com Malicious |
92528bef32ecca33e1d5b133de0cc851 |
| CnC | www.crwqin.ru.com Malicious |
92528bef32ecca33e1d5b133de0cc851 |
| CnC | www.bacan4d.jp.net Malicious |
92528bef32ecca33e1d5b133de0cc851 |
| CnC | bacan4d.jp.net Malicious |
92528bef32ecca33e1d5b133de0cc851 |
| CnC | mdf.uk.com Malicious |
92528bef32ecca33e1d5b133de0cc851 |
| CnC | www.mdf.uk.com Malicious |
92528bef32ecca33e1d5b133de0cc851 |
| Ports | 80 Malicious |
92528bef32ecca33e1d5b133de0cc851 |
| Ports | 443 Malicious |
92528bef32ecca33e1d5b133de0cc851 |
| Ports | 4444 Malicious |
92528bef32ecca33e1d5b133de0cc851 |
| Ports | 4782 Malicious |
92528bef32ecca33e1d5b133de0cc851 |
| Ports | 5555 Malicious |
92528bef32ecca33e1d5b133de0cc851 |
| Ports | 6060 Malicious |
92528bef32ecca33e1d5b133de0cc851 |
| Ports | 6606 Malicious |
92528bef32ecca33e1d5b133de0cc851 |
| Ports | 6666 Malicious |
92528bef32ecca33e1d5b133de0cc851 |
| Ports | 7707 Malicious |
92528bef32ecca33e1d5b133de0cc851 |
| Ports | 8080 Malicious |
92528bef32ecca33e1d5b133de0cc851 |
| Ports | 8808 Malicious |
92528bef32ecca33e1d5b133de0cc851 |
| Ports | 8848 Malicious |
92528bef32ecca33e1d5b133de0cc851 |
| Mutex | VSDC_PrimeSentinel_VanguardLock_7a8b9c0d Malicious |
92528bef32ecca33e1d5b133de0cc851 |