Malicious
Malicious

9f21fda4eace55e9f759bbfb4d5799b0

Share on LinkedIn Add to favorites
Re-Scan
Delete
PE Executable
MD5: 9f21fda4eace55e9f759bbfb4d5799b0
Size: 66.05 KB
application/x-dosexec
Summary by MalvaGPT
Characteristics

Symbol Obfuscation Score

Very high

Hash
 Hash Value
MD5
9f21fda4eace55e9f759bbfb4d5799b0
Sha1
401901a30cbe4578341ade9e3f4f992bc8c6a7f1
Sha256
3f55e9b6542684cbe6ad853fc7a0c1df1b0e8de0a7c69fef131e93c82f3712ac
Sha384
6eccba51776a4155ba8a6e0400179ba4941f2533601057565fa500799981edd529272febca2774f9bf6f1b2788ad369f
Sha512
ed61a0d7f8ce49386fad7c35179a8f7aff08f1a228f8ea99e0ef63a76327842505a3d0ca3704060129a5c7df7191db0976bb3be5e1de90d855aefba5cfb52273
SSDeep
1536:v8tTyZUF9iVOWfFqOHGd9bob3RvZ7IZljjiz+:WTqQaOj6GdVob3RxUSC
TLSH
11535C003BF9C129F2FE4F7498F1225586BAF2676913E64D1DD810D60A23BC5DA426FE

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
9f21fda4eace55e9f759bbfb4d5799b0
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Malware Configuration - AsyncRAT config.
Config. Field
 Value
Key (AES_256)

bEl2azRJWTRNVmlseFB4V1UzaDhtZ3dFcFRkNklBN2Q=
Pastebin

-
Certificate

MIIE8DCCAtigAwIBAgIQAKqkWTVTi0XdG8zQHEAyETANBgkqhkiG9w0BAQ0FADAZMRcwFQYDVQQDDA5BbW5lc2lhIFNlcnZlcjAgFw0yNjA2MjAxNDI4MjVaGA85OTk5MTIzMTIzNTk1OVowGTEXMBUGA1UEAwwOQW1uZXNpYSBTZXJ2ZXIwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCheB785T9G5CJYQ3W0v+jKlIVEEW4KUv3BSbm+NgBcK4VJUVdCKYc+ZWaQHXf3kTKeWz+u+5RjQyqB4Z5fCMaRylLe4L3B1zOozAOAt69u//cYoa64Yv6KjHo6vyRP4alHgP10ENf8IIOSlZhlGDwgdbh9NLNR3hS84hFmMSxsqS8yiO+nOk39gXSyhW1rDkbcO9BiOnfT9WNdkX8BJcSvxMD2lZfpbkzBcNQk1YgOn1PTdXxlJwBUivf9DsWliC31kNgwLzCcwm4FW0hhaw2owbg6PheifGJX9bLoFnCaLIEznZ+3hHlUDpzuWASLR5UlMJ/RplwRBckq3+fI3Cv+a8gwFkOgPAATiD0QhFUxaf+bYOsX3jK5I/UKx64F0J+a2fN0zpx/BAzLTF2xeMhMFHOHdS40mMXiWq8ohc1TtI1rLe+AD9Jk1OoT1WcBA7NK1QCo+0sZ2Q0I/chtFhvpL8eVNX2zY0zzI3Lx66n2l9PRINo2BvxRhirqRwNgGmKQm5h7+nabVcYhOn7R8ZsJNviDK+sHAjAneDgvA84/UK802LuzN2jcTbmYugGghaRBgg/71hyQwvSsELLoKnOcDprX02aqd3tKSn8wI2+RUmoeu1EcgJxRQnbIPLVyVoiQHo0MCXu7KCGp5e1sZEr8rBNUrx8i70t5OLBcdtOa4wIDAQABozIwMDAdBgNVHQ4EFgQUc0c2icSO3d/oAXh7tPoG0LuDaVYwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQ0FAAOCAgEAZjdIajsIVmkvS8JPEkUzE4g9oiW8mibmdQ+jISXrtMT4E1zT/iahUR30p9S01uxYj7z1GGUsrJ5wOFMcb3jZCo1Xn6BYIy++hawu03Z7IlMIsPhOkrSc5e5shiHFwAZo28YxRET/hXVptYaCVUhrBFvXN+OE+Uk5Ul6AOhRt75zgWvAOUVdXqTSd4S641XxIterrFeRiklcMzGA5SW/4ralnB7L7KZaRDr0ImfhAIVLzW1mZyiB0UNX0WHk+oBvN5a7oh4/bC66bNxM4lEf8K/uTCOBZHzLsPdhHtVLOzfQhUenGmXkbmqlS8eGmHH5iYuo0bK/ovhWj64NuZMmJCpKK1+yrDxkHxotCB8Rjeza6/Wp0/UNgPsIAvzkSKm2DgdULpQ2WTNal47gvWT7K1YOG3NWqLeX0QFTGTpDcKTclPJ8Zre/KMbI7kt1MQ64YLeAD1+J2c3+BBwI3/n8v5YlcwA4y38KJR54ccKNyWhB9HZZx0nzum1SGkJ+7NqavrUb5rZF+iicI5Z7XmNl3MeQOHFaLpbExmsZtNEehpU/rZncJditWhwTdlYFcP1HtMn5CWYaiKPB0o9CYkXRjzZK2cgoWJJ2/6AEeDy9oV0uiiwWNyFPYjamilgRQBziaYcLseTLwfdUfQ3JLMLMAlTsxqmb9Tv397qar4s4DZNM=
ServerSignature

UBmHRzV12+Flc2ADx4DZk8aOuEVDzcvnHMTOFMLdVsfmvHUTChbGZkSx5+JsHtNk3nqAIRy/qzrpz/GUO5ydIqMUKaLJXZrIhadWglh0gALB95Vmi7AljHplUhss6qIZy2L714GM93/Y9T8bWYxYB11nrddJyAserEUMmx8HhaWQVhbgkCFx+E8OVAtrLAFTiYw4PIU+2K+Q5zTzdAAj/rY0grHwirz/7I7AlbKZbMLIX7E2mPvlFi/vDzconevS9khmFNIDOYSeUdWs8EZXd30veFweWfCcNNv9XvDAIOWsv7DRQw9zrF263IWMwzWOo5rH4T9Ko1bFwulGwWnlDMSyAyE+2Yi5BSU4pXuOAfxIRVgo72Km5TmRkJx37lHufd+umBhDPLHjq/dxkXrTkxK/KtT7TNPZh3jnpXIaIJAEbUennR2my3bz2Tytb+xmaRxN4r15rUK6HTPnv2dEsiBAZmpsJhd7eFF/XbZSnDzFV/Asj1Kf4WpdaFks4dGuPvZdLNqVzxu2ADnaQZgQplOH4vr0lKTWewKzHjLxpI08oWs/kjJLDekWD0eARXbpiwaMikKpTM777tGvmJe9C/ezFHMWaoElE7K0L/L29dfz7WqsTmDvUxErceB9V3Pw+6w76pr2nAyYAnUPgvtf0N8xo8EUeQDRwBxGjbydHwc=
Install

true
BDOS

false
Anti-VM

false
Install File

66lottery.exe
Install-Folder

%AppData%
Hosts

66lottery.uk.com,www.66lottery.uk.com,email.66lottery.uk.com
Ports

443,6606,8808
Mutex

Amnesia 0.7.2
Delay

3
Group

zWiufBHY724z
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

YRBFGFqdpHHhr
Full Name

YRBFGFqdpHHhr
EntryPoint

System.Void UhthQIegzet.OSkYYRAjzu::Main()
Scope Name

YRBFGFqdpHHhr
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Client
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.6.1
Total Strings

316
Main Method

System.Void UhthQIegzet.OSkYYRAjzu::Main()
Main IL Instruction Count

66
Main IL

ldc.i4.0 <null> stloc.0 <null> br.s IL_0012: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String UhthQIegzet.SDmROuznwser::vrpAWLkNVvrL call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0004: ldc.i4 1000 call System.Boolean UhthQIegzet.SDmROuznwser::nWUEIDjkVABnw() brtrue.s IL_002C: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean ZxgPqaWIUYVhGeab.aVAOWtUsoJOZjY::VdehjJiToGi() brtrue.s IL_003A: ldsfld System.String UhthQIegzet.SDmROuznwser::eYQlMzwscJmdA ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String UhthQIegzet.SDmROuznwser::eYQlMzwscJmdA call System.Boolean System.Convert::ToBoolean(System.String) brfalse.s IL_004B: ldsfld System.String UhthQIegzet.SDmROuznwser::JbIbOMirWVbW call System.Void ZxgPqaWIUYVhGeab.MtEFFzuziafLHNx::DTRydGcUBtlpro() ldsfld System.String UhthQIegzet.SDmROuznwser::JbIbOMirWVbW call System.Boolean System.Convert::ToBoolean(System.String) brfalse.s IL_005C: ldsfld System.String UhthQIegzet.SDmROuznwser::WUjSBefrCscb call System.Void KrsruVRjjQT.CztSeUNEsj::YPsuPwoTSqp() ldsfld System.String UhthQIegzet.SDmROuznwser::WUjSBefrCscb call System.Boolean System.Convert::ToBoolean(System.String) brfalse.s IL_0074: call System.Void ZxgPqaWIUYVhGeab.dgUmnDYoDlVOM::rhenGToHLZvFok() call System.Boolean ZxgPqaWIUYVhGeab.dgUmnDYoDlVOM::EOqMjVwYEw() brfalse.s IL_0074: call System.Void ZxgPqaWIUYVhGeab.dgUmnDYoDlVOM::rhenGToHLZvFok() call System.Void ZxgPqaWIUYVhGeab.kBrDjOUzALeUd::aWflFbiZpXX() call System.Void ZxgPqaWIUYVhGeab.dgUmnDYoDlVOM::rhenGToHLZvFok() call System.Void ZxgPqaWIUYVhGeab.dgUmnDYoDlVOM::sIvfwvOaXLnI() call System.Void ZxgPqaWIUYVhGeab.DJbNDNfCbdDm::DUBvnMCwWsFFZd() ldnull <null> ldftn System.Void ZxgPqaWIUYVhGeab.dgUmnDYoDlVOM::HTpPzobEMyo() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) call System.Void System.Threading.Thread::Start() ldsfld System.String UhthQIegzet.SDmROuznwser::ofHnkMmVMJuUDSmCK call System.Boolean System.Convert::ToBoolean(System.String) brfalse.s IL_00BB: leave.s IL_00C0 ldnull <null> ldftn System.Void MLdhImEfkSETs::rqUrClZAwRHgx() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) call System.Void System.Threading.Thread::Start() leave.s IL_00C0: nop pop <null> leave.s IL_00C0: nop nop <null> call System.Boolean bwpDxrHOnChXtrp.lrRaLXPkJM::get_IsConnected() brtrue.s IL_00D2: leave.s IL_00D7 call System.Void bwpDxrHOnChXtrp.lrRaLXPkJM::dUddtPifiWKpaS() call System.Void bwpDxrHOnChXtrp.lrRaLXPkJM::AAOoNuuntgM() leave.s IL_00D7: ldc.i4 5000 pop <null> leave.s IL_00D7: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_00C0: nop
Module Name

YRBFGFqdpHHhr
Full Name

YRBFGFqdpHHhr
EntryPoint

System.Void UhthQIegzet.OSkYYRAjzu::Main()
Scope Name

YRBFGFqdpHHhr
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Client
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.6.1
Total Strings

316
Main Method

System.Void UhthQIegzet.OSkYYRAjzu::Main()
Main IL Instruction Count

66
Main IL

ldc.i4.0 <null> stloc.0 <null> br.s IL_0012: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String UhthQIegzet.SDmROuznwser::vrpAWLkNVvrL call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0004: ldc.i4 1000 call System.Boolean UhthQIegzet.SDmROuznwser::nWUEIDjkVABnw() brtrue.s IL_002C: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean ZxgPqaWIUYVhGeab.aVAOWtUsoJOZjY::VdehjJiToGi() brtrue.s IL_003A: ldsfld System.String UhthQIegzet.SDmROuznwser::eYQlMzwscJmdA ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String UhthQIegzet.SDmROuznwser::eYQlMzwscJmdA call System.Boolean System.Convert::ToBoolean(System.String) brfalse.s IL_004B: ldsfld System.String UhthQIegzet.SDmROuznwser::JbIbOMirWVbW call System.Void ZxgPqaWIUYVhGeab.MtEFFzuziafLHNx::DTRydGcUBtlpro() ldsfld System.String UhthQIegzet.SDmROuznwser::JbIbOMirWVbW call System.Boolean System.Convert::ToBoolean(System.String) brfalse.s IL_005C: ldsfld System.String UhthQIegzet.SDmROuznwser::WUjSBefrCscb call System.Void KrsruVRjjQT.CztSeUNEsj::YPsuPwoTSqp() ldsfld System.String UhthQIegzet.SDmROuznwser::WUjSBefrCscb call System.Boolean System.Convert::ToBoolean(System.String) brfalse.s IL_0074: call System.Void ZxgPqaWIUYVhGeab.dgUmnDYoDlVOM::rhenGToHLZvFok() call System.Boolean ZxgPqaWIUYVhGeab.dgUmnDYoDlVOM::EOqMjVwYEw() brfalse.s IL_0074: call System.Void ZxgPqaWIUYVhGeab.dgUmnDYoDlVOM::rhenGToHLZvFok() call System.Void ZxgPqaWIUYVhGeab.kBrDjOUzALeUd::aWflFbiZpXX() call System.Void ZxgPqaWIUYVhGeab.dgUmnDYoDlVOM::rhenGToHLZvFok() call System.Void ZxgPqaWIUYVhGeab.dgUmnDYoDlVOM::sIvfwvOaXLnI() call System.Void ZxgPqaWIUYVhGeab.DJbNDNfCbdDm::DUBvnMCwWsFFZd() ldnull <null> ldftn System.Void ZxgPqaWIUYVhGeab.dgUmnDYoDlVOM::HTpPzobEMyo() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) call System.Void System.Threading.Thread::Start() ldsfld System.String UhthQIegzet.SDmROuznwser::ofHnkMmVMJuUDSmCK call System.Boolean System.Convert::ToBoolean(System.String) brfalse.s IL_00BB: leave.s IL_00C0 ldnull <null> ldftn System.Void MLdhImEfkSETs::rqUrClZAwRHgx() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) call System.Void System.Threading.Thread::Start() leave.s IL_00C0: nop pop <null> leave.s IL_00C0: nop nop <null> call System.Boolean bwpDxrHOnChXtrp.lrRaLXPkJM::get_IsConnected() brtrue.s IL_00D2: leave.s IL_00D7 call System.Void bwpDxrHOnChXtrp.lrRaLXPkJM::dUddtPifiWKpaS() call System.Void bwpDxrHOnChXtrp.lrRaLXPkJM::AAOoNuuntgM() leave.s IL_00D7: ldc.i4 5000 pop <null> leave.s IL_00D7: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_00C0: nop
Artefacts
Name
 Value
Key (AES_256)

bEl2azRJWTRNVmlseFB4V1UzaDhtZ3dFcFRkNklBN2Q=
CnC

66lottery.uk.com
CnC

www.66lottery.uk.com
CnC

email.66lottery.uk.com
Ports

443
Ports

6606
Ports

8808
Mutex

Amnesia 0.7.2
9f21fda4eace55e9f759bbfb4d5799b0 (66.05 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙