94a2b5d2b5e957f9ece281b51656736b

PE Executable
|
MD5: 94a2b5d2b5e957f9ece281b51656736b
|
Size: 46.59 KB
|
application/x-dosexec

Infection Chain

Summary by MalvaGPT

Characteristics

Hash	Hash Value
MD5	94a2b5d2b5e957f9ece281b51656736b
Sha1	80266c5338920c0e006cc24832f0160f995f8746
Sha256	e0499a2722a4927e904f63aa6b9938fc8d087d233d8300f68ab7138e38ae0ca3
Sha384	5def4880a6615263ef68e8628b7276f74f73d09eee7dc30c31caf0055827c43b3dc0efca430010bba2b082658c6fbe05
Sha512	e513ba22ad1c43183f891fd5faf911d8e6d9057df2f8debcf2ef7f8ce69ff26c7bb34ec2283068d26182deabd9fac1586cd86f7022e6adf6eee3736e73fcc5aa
SSDeep	768:DuuF1TFQ3nFWUFy+/mo2qDyhsnJXncPIOzjbVgX3VMeBFI41d3w6EIBDZXx:DuuF1TFcJ2tiFhO3byXFMeDt1yqdXx
TLSH	7F232A0037E8812BF2BE4BB899F26145467AF6633603D64D1CD442DB5713FC69A42AFE

PeID

.NET executable

Microsoft Visual C# / Basic .NET

Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL

Microsoft Visual C# v7.0 / Basic .NET

Microsoft Visual Studio .NET

File Structure

Malware Configuration - AsyncRAT config.

Config. Field0	Value
Key (AES_256)	VWo0TXpsU3p5TVg1OHlXeHNCcG42NXhBMURldU5nSVA=
Pastebin	-
Certificate	MIIE5DCCAsygAwIBAgIQAOc250/jBXH7PusRfV4KKzANBgkqhkiG9w0BAQ0FADATMREwDwYDVQQDDAhBc3luY1JBVDAgFw0yNTEyMTQxNTM0MjFaGA85OTk5MTIzMTIzNTk1OVowEzERMA8GA1UEAwwIQXN5bmNSQVQwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC3hbrOJGE/Ncxr2hD4zwR5WwrlT40PQHZSYRdpnqR2/7/cw8e4m6IS/kPj2TSnF3yYhOkR08loqxZDE8g9vaF8pLg+pyFwXjs8+Tjb6rGW2uRjpX92Pyhjh8LBpkQ8ZVWmHgnrg6rG0F60rBKz4ew8WXbKcUo3Q+oz/td4gqFQDlhw1kKoLeUmr+9QKyInnm/2UOlpU4DY3Vpgw9RKXcNYyUemiFybYORXhX5itphsOy7VNGbmDGcokwXemsR8Dxtx/fxqxdTSIJt2+bnMbPPCL05l7xkOyVQMnLIGcsDBoQXotDfeKlpluqyut2YjHGluh/uIUb/c37ZW17RCI+CtrNRGQjB8ErSBSWGtlxKh6a7DtgUD3Ixy87tueEKyeiHIjKNGM2DeeYpPp94vQ1L9omOqV6XBPRIlE8dZG2wIEh9U7nAbyILI5CsDNK3ZKIo9rFYVDCqRpjSpDW6EE3X+megquYTgBmYwz0wc3Nm7DyXpYWw9M6ubgwJOY4IuNEV3JNHsxHdX457CHJ1B3pvyDSRoD4GGQWzFrod/rSdbc6h0Znk520NtZ7qkP+AA3KumXQoREuIENMqFyEeb4jAL/o+NLZJ2s25y37AhIULalSXUWRpFFN4afCogVBX2Lq5fTnARunBy+iM0cTCITKg1PzdagOzpIYZ1301QYewT1wIDAQABozIwMDAdBgNVHQ4EFgQUwIO7jdsbGYhuyUURLCnL8u8aCiswDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQ0FAAOCAgEAPXoIXK5CvTxz3g1MuFheFwcA6CSzDoKFPW4zVdDtZTjVtAd9wnPaH7HpQXLwpPUb3WM8iEX/zgdze8q36+IWIv7LOpMKCDr3+dyeR5dyuSF0HNggANxw64nb8ggfquNYXofQDR8B2fp/c1iXT3NQcZ4CsM37nMLyvKC7n2hWWArrhshFMKZ/AnT+3r996JaT0BopXowQsSIzBNFez3KrBQ2fKj8HuJPZ3VJKnAH+sUBvTup/5qk5+aijalDJU/APvTFLKBom0ifAqZoYgwI/B9H0mEO7qYXokEVtEPX9LS41ALFQl/naWldHpnhmMgpN3Y30HgI+CJIyUxR9k7f0AIYXdGHdXeqc+MhZa25H+ESwSwI7N7FMyxkdzkikWAXIYoKK3o1mdb9+0s1/CstbjWs8QAzUYmZTb1vUAg9tUMhL2LqaWlpnzOOXdQUhRqk1JuYoBAvlesZ5qsgrZxzaQtDZ7hq6oWsqdDScXGUt7SrPvtXFjFXHjdCrfVHISH0RcEsmaSSV6+cjvcSZe3gb/t5lfjmaDMgWvlIHtKONjneUbCKzoYY2OHU/gy4DkWdt4q8SX1a0jLYXkYr7KPKFaDR/oc85PRUsCKg/vhCtRIbTAJ1CCf0RCk61CuONfs18uIvo08JwHJgWVwN/1lq94mdsEzo1SPA5
ServerSignature	SQObYywy5nRToi//XJ5jI0ugmaGzXQTd9Sj8cbI30RROWtov1d5NR+oCwVLMC/4DQsjHuwmGY4iPje/lOt/EymeuoPywx7u1a+l+pZ5uyTWDnuwin4KBZwOnd9RgQfBFnbWyEQMEkDK3wP7tcVd+uqEZlD1aaVGQeFXt41+eqpj1DvDWCfeSOhMN558sPZyVZo3MSGgMdVTGXFfTmoZFfzpyuY5Rcbp2NVVaG2ybk0Q7TzyNhX8kHt2MMR/LUb5pe0+vuJ1P+VPMzfDzkftPu5KamBxHyZdFnLrqZbvn0c2YppSBJ2Q1W57qRZy39zJZeIwuWB2v75NYsP47OqNyrwXp4wLG8+JdGIj8jHihcn2JlHpAVPtfHYEUH3JbSd8pB3rq4xt/yVesr+yTM8mhK1A0PIhc+Ao8D6Ial4WPZkwOYaokIc9vhFOQPvoHdQBQpEn9qEZgwGPCxWgfhiHm8G9ZBcd3ks+8fD+w0tPVQLmb0ZiPOpEfKovInpwBExGtVyAFNRxpb7SJm5i9uv/cKa9NI24mfR7oXl99RQ6xqEjFAen0LJP39q+OjkavalGbQ0ij5NUMGi2mElVH+68Ql+aynnlasMu4IaX/cIKciYYVyRyReLxTfMsXQUdqx2OlcxYD7ylCc8+Mntwtz8wBFCqvpBbZRYwM
Install	true
BDOS	false
Anti-VM	false
Install File	Top10BettingPlatforms.exe
Install-Folder	%AppData%
Ports	80,443,5555,6606,8000,8080,8443
Mutex	4pAuVwEnuBFw
Version	0.5.8
Delay	3
Group	Default

Informations

Name0	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	Top10BettingPlatforms.exe
Full Name	Top10BettingPlatforms.exe
EntryPoint	System.Void Client.Program::Main()
Scope Name	Top10BettingPlatforms.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Top10BettingPlatforms
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	120
Main Method	System.Void Client.Program::Main()
Main IL Instruction Count	51
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0043: ldsfld System.String Client.Settings::Anti ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String Client.Settings::Install call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() ldsfld System.String Client.Settings::Install call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BDOS call System.Void Client.Install.NormalStartup::Install() ldsfld System.String Client.Settings::BDOS call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.ProcessCritical::Set() call System.Void Client.Helper.Methods::PreventSleep() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Module Name	Top10BettingPlatforms.exe
Full Name	Top10BettingPlatforms.exe
EntryPoint	System.Void Client.Program::Main()
Scope Name	Top10BettingPlatforms.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Top10BettingPlatforms
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	120
Main Method	System.Void Client.Program::Main()
Main IL Instruction Count	51
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0043: ldsfld System.String Client.Settings::Anti ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String Client.Settings::Install call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() ldsfld System.String Client.Settings::Install call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BDOS call System.Void Client.Install.NormalStartup::Install() ldsfld System.String Client.Settings::BDOS call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.ProcessCritical::Set() call System.Void Client.Helper.Methods::PreventSleep() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop

Artefacts

Name0	Value
Key (AES_256)	VWo0TXpsU3p5TVg1OHlXeHNCcG42NXhBMURldU5nSVA=
Ports	80
Ports	443
Ports	5555
Ports	6606
Ports	8000
Ports	8080
Ports	8443
Mutex	4pAuVwEnuBFw

94a2b5d2b5e957f9ece281b51656736b (46.59 KB)