ac30acdc79934b62bd576641833a3911

PE Executable
|
MD5: ac30acdc79934b62bd576641833a3911
|
Size: 46.08 KB
|
application/x-dosexec

Infection Chain

Summary by MalvaGPT

Characteristics

Hash	Hash Value
MD5	ac30acdc79934b62bd576641833a3911
Sha1	b7d64c1cff9813a22bc7a84043f8a5693e2cb97b
Sha256	7e820c725b6d0166a2fc708f04fde89c82ae947129b32ac8db0c4eac709bef00
Sha384	54c1bcf83be44968e5d0b16d5455f704e778503b295cc04c6d10a17d4bdfb103a5e9188dd36e7f92b50d8f757a15fccb
Sha512	2ee74f7de063a15eb62188bfb020c08f6bee8c7359c9e704df3b3fbf0dd85d9509c714d803143567ca4f5704051535843f6cffd2944944d672dd72c1934bd55e
SSDeep	768:Wu/dRTUo0HQbWUnmjSmo2qMPS4sl83lbbb4dNK4cPIm3zjbwgX3iQP6N9VTnkZDX:Wu/dRTUPE2OkGTKOm33b3XSZ3VTnKWdg
TLSH	51233C003BE8C12AF2BF4F7859F26215867AF2633603D59A1CC451DB5B13BC696426FE

PeID

.NET executable

Microsoft Visual C# / Basic .NET

Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL

Microsoft Visual C# v7.0 / Basic .NET

Microsoft Visual Studio .NET

File Structure

Malware Configuration - AsyncRAT config.

Config. Field0	Value
Key (AES_256)	a2N2SlBKNW9lYWJLWHZPcXpsV0JIMk9pd3VxTm91TzM=
Pastebin	-
Certificate	MIIE8jCCAtqgAwIBAgIQAPgypkOw0/BGuUUkf6jHazANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjYwMTE2MTY0MjAzWhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAIqyq7+26F1VQARdXP5vDFzfvZi0nhWGO/Awx3CGZ7kkUGHveyVdAx4jOhUQjDd1CyVvO8/E2+vInfZNyGfgpomCY3obQLQORoz0YloFKFkSzc0HzjZ4zTPk4DkgXWq+F9CvCeiJnbAiQnZuAgTvM4iNfwaLTWyairUzkaoFRbM/kOTKb4XPt0HbpoptUnIRkrUGu0h1HjDlq1DuteodPaRJSyrujdJAkPZzmlx4mU6AAhfwpVeUjxGxowoXcqo8/jXqwoS3BZrOlk5RIcXCEeaou/qbdQ8rSzrUflhB/4niKDe4QWGJNP1FtAuIhHm4fuuBztUY9JjpL3GxvTd1rHg8KEhQS1LG36xQl4Z4NjtPYEtcM9xKRNBoT2Y05GUdQk+hfdm4sB4dawdMKKtv1FwdBCPiZ+XLHdNCUNA1HA2WxbZzNVrUiIBJKlocdXEP1sd+6jQxZQShNnnZYozDQBqGZvg+CN6mubbwVaCZfVcuSFJIICUy4ZpC4tXmjlwqXlZqQTVuXV4PB7/xH9AGRlsjH9W7K6gYgIPsvgwAh8o2eVqOiMYccvrjIErTtbZybLKOuY7Jd70+mpM2Y4xp2nrILJ1Xnhfjm2tDTBimh00piqEqkuXIuvF5ByvlnpjUAZm/WHlBSCZNaKgwlDsktjpQHN0XIXOWb2oJnON0SIANAgMBAAGjMjAwMB0GA1UdDgQWBBTNSX+QS7zH91+EC9EdbOW1CcPnLjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQAOi1rVt5+ccSZQeR/eJ4c5ub90bYfDabZm7idVdh57bWmbChwRJvYFVCKLpY7waqKkbky1cgqJBNXUuGPVkikZLvvjz2Dwwy2gNLahSQD1JRr5145PnGfaTlYyQDoUAsjwpmauQQYmmpKYXTzSl3lKyvHGBypo7jOpmm2q7WfxvgUooa7WTfkWj3Ohc6x+7pe7rujxmL4yBF1uYNjv4p5UiUgy50fOEerJ8sutHZc/EUilSIWC3SXCdsIeSrnvO4WEfoT7t67aqb/J6b3HyoP7VTJrQfZgkpxAh6iPc4Y0rR5mxrDT54RDtGz7fesUsel21o0l2HkgMxUhmOlyeMnTKJSdbI0iZv+hIID19nULzsofwzr8TZMe7DpSkAKE/40VqiQ3AjHgSiaE0JsKRgyN+VoMzFlfV0905svCHp4O/5+9qBx+wwq23jFzNeCzH2RzovkmJIxghobMhMvivOdvYIxoN0l2dkoBVn/7k0kpLtudRAYhWWAlKp9xszkTDvOrAE/SYYxR7HzvAgUghwjpQM+x0bD3qBXbjP9VaLWKJWJq3z86Vgw2wuFP7IEke4DwWstoKuqwBUccFm8oY8UyYhN4raGMK8+CSFp6RjjUJbYiznitCypVxhf3ycpb62Vi1T3q626Cn2F55THNl9XWXbyiVOsRQ5kORZggZKURFQ==
ServerSignature	V29rCwoT8Ga2J1Wd19s7C1vkB2l5d8PY2uCdSLUy80PiMiQKayyYYcR/RoGl2lGOkFj1nALWTP8GjSSubnnh7HYmwgEbSfBne6CzbJnQ9cL2zptbLDy0VVlrxtEHlwwbnGnxBePMnoV4/vgTaFuchvte8mBBYE3bZrtF3vPV4xxST57F+rvSmx59KAGJXa72blDbUJmFMT4lYgJnAHYqrDRWHDmbx7016R818IPs5GbjYLLGUSkL6EQQnpR6c0ZYlGOTvAFzsGFdxvpYzaTWgxJx0Am/Ziby7IS311ZAyBpvF9l+GIBXXSh9mO37Hz1KT/8PQ7+0TGOiJ/NQL6pPcmWg3FbYeX2GcKwp/fFPNd7EmJoJ+z/lepGeWNq2pwh7iU7ngMKfihwIphWrqOF5BsrrY+fs45NFR7DHIWAa6zsA8ExhMgcXt3C1XFXQVovrfXUHu99SRdb+CK4Q5gqnCydNzA76L1tbx0OsSJ1gIWxAdsuuTeJ/qkY7TczZDhPixC38zbs9m5Yc9Ex3lqbhsI8DaSwJg4jfm14Qi6w8EcYp4VRdKTC72KohuYPWJHVd6BR9UBcjfiIm66DHZX6wEMtPUet7RnZFILEj8MzClmiaQ0qRtZMTrTha5Ofsk+O7DRD+h7rMD7CcqIry6BBFS202RQmXysunAeG6emPfysY=
Install	false
BDOS	false
Anti-VM	false
Install-Folder	%AppData%
Hosts	130.12.182.209
Ports	1525
Mutex	iAgMlMunP6p5
Version	0.5.8
Delay	3
Group	R

Informations

Name0	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	31.exe
Full Name	31.exe
EntryPoint	System.Void Client.Program::Main()
Scope Name	31.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	31
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	120
Main Method	System.Void Client.Program::Main()
Main IL Instruction Count	51
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0043: ldsfld System.String Client.Settings::Anti ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String Client.Settings::Install call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() ldsfld System.String Client.Settings::Install call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BDOS call System.Void Client.Install.NormalStartup::Install() ldsfld System.String Client.Settings::BDOS call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.ProcessCritical::Set() call System.Void Client.Helper.Methods::PreventSleep() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Module Name	31.exe
Full Name	31.exe
EntryPoint	System.Void Client.Program::Main()
Scope Name	31.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	31
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	120
Main Method	System.Void Client.Program::Main()
Main IL Instruction Count	51
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0043: ldsfld System.String Client.Settings::Anti ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String Client.Settings::Install call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() ldsfld System.String Client.Settings::Install call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BDOS call System.Void Client.Install.NormalStartup::Install() ldsfld System.String Client.Settings::BDOS call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.ProcessCritical::Set() call System.Void Client.Helper.Methods::PreventSleep() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop

Artefacts

Name0	Value
Key (AES_256)	a2N2SlBKNW9lYWJLWHZPcXpsV0JIMk9pd3VxTm91TzM=
CnC	130.12.182.209
Ports	1525
Mutex	iAgMlMunP6p5

ac30acdc79934b62bd576641833a3911 (46.08 KB)