b5e3118a07a3fd122db41c7abafd257a

PE Executable
|
MD5: b5e3118a07a3fd122db41c7abafd257a
|
Size: 114.69 KB
|
application/x-dosexec

Infection Chain

Summary by MalvaGPT

Characteristics

Hash	Hash Value
MD5	b5e3118a07a3fd122db41c7abafd257a
Sha1	7eafd3cf387792e0f0f8dc3b7111bc89e4a542b0
Sha256	94a0fd7835576e648601a4f7238d78c8883097468b889244cef9f9bf6f6eaeba
Sha384	a1cbf39ba53454cb3d895710e2b8fe1a281bdf2172d6f736e1262fba48423758b1a7e7983e4368590818a6c698a1df4c
Sha512	e1a83f3eab1e580e02c293339d62e6493fe762c0a8ac312087741cf55cc589f641716387bee4f3b9621388e622608fca606e435f41efe40739d89e6207fcb926
SSDeep	1536:eu/S1T1C12HwhXslZbpXSGB2edJmW7DB5NRlmMGCCl:eu/OT1C12o8lZbpTBHLd2l
TLSH	B3B32109E919485DE82C0E7C6CF3A4560695BF37E508ABC90DDCF8CF6A33A860EC5759

PeID

.NET executable

Microsoft Visual C# / Basic .NET

Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL

Microsoft Visual C# v7.0 / Basic .NET

Microsoft Visual Studio .NET

File Structure

Malware Configuration - AsyncRAT config.

Config. Field0	Value
Key (AES_256)	YVNhYmU2Rkhma09TVVg5dmwxSTYwc2NDYWNDTmVFWmY=
Pastebin	-
Certificate	MIIE8jCCAtqgAwIBAgIQAKVftBHhqqUdcMK3c1LUQTANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjYwNTA1MjI1OTMzWhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALSCt94AtQhLG8af3dtv0P+9GwwD3m0u/MwmPomfcdSb/bNV12kRkw5ovGQBq1XMo1VAoBvNv2225Ch4tc/Z47hsxcIG09TJRL3pVazPn0ax6ax7ERqznDQXYgqk7nArCUcs51fWekUucNPCqKnscSijDMLCTt7IQCtClTuCkByJJsP9f0wG3IFRwV49X/Us0wcRDU3HDJ+GxKMdWw0y5pawRrXmDOGuTRIExksDWBnhDh7akQ1RDmtWFEGwGNi+wBD5vtAxCZ6UnPF/LWerUqbQzqMf5TECCXrl6DnVijffvcDYwGFi2aXm5wamVXc/qILNWRzuMZdtQzskdBWkCpOdqyZ9V2YqLZjmux2l312yx7Jmw6jPn9jIKJ73JKYL9cUXa2Edm/rMtEJfemAVtxF76tn+U3XkhW8e1sLMvCe/4tB2BKtX0a8h8NKBf2VYWnbj70eQwa+ToV+cCqp/d5SSmO4NuVvyekuYjnmQO+ADTd9TgVC/iO9k7UJxu8+ZBjBC17XIKcvPszOhm5XmdRixGfN55Y6bIIVOsC4xrV9ZElJzMed7ZXPwHcLtjS6OZCccl4RNqDKFnRAFTA4f3PWC7+0xYbpx5kCm1XzGzXVImikch5uVvb2rzhyivC9XbKksffvzXEVr8oulgJaJXDDEz5B8C2I2jam/xraisRBXAgMBAAGjMjAwMB0GA1UdDgQWBBTI/ofcyXL2Qz4Re84MP7dhioYazzAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQAMbLSWC0mVgwSx+hTIB1g7Vg7qFdYUuF4fagRJV0DLuDeeV8imeS5/YGMyY4mFEXGDYPWCu123gpnOgpiLT7QdxV0dIJfedcDoluzreDLpUIwLYIe5xVuk2g2VsqOvajvRcEt1O2ajA/KQS0oKv95ercHggRB5iCQg3IykUEEYev/t7mgoGWBA+V6/22tJ1HQUo4c1u1DHG3tp7b1DD2Kz0/2IkRyjCtF0GWT/GBNSxkxdaSwlLGYc0RZXLlLGkk0FpOvcJDWh8BqSCjt+0isqO11lbVBuMGS6Vd/H28FujzdUhhf9ldvpUwiuignHf8Ww+mq2/t+v9xiqGHmM/vdGSLvbiJGvV+TlIYiEk5Yq10G4aGmbB36SRQuWnGuaizyVBtCj71emstYkGpZFBmI6hAIDZi5uqrxrgMWx/qxiMAMUPJ9fKyqYLJqao1upkvOIw44hOG+XDgu3lt+fhbxLpAtIGZlXG46kQ//EU2qDyO/dHWEHFn8YUDSGkso2qJwH6NFs5cbk5orpPDShPkyKPx/glq9+EcZoVtqxYfIvIEsEF6soJHQ9nLGgb/yI1QFdDaJ0hvwCKzc8fVHOcKyF7WcbXn2IUChNMKry7QzZXh1+yI/+u5mvVeWEksgeK5XnuWVxl+LnItOzYuGmnShTuH5BBiPzPgc7msZWHle3Mg==
ServerSignature	Agw3fA61U1CpxMYBV9UWU0d2XFJarhfLv9v/PXnSpDsyNQr/qOKxMrD8KHOkYg+ZEK9KZWL0mEaKa83PWlxBNPbjfVpBz0UJIxfsyUVFrF0RczCZ8g/nJUo07/i99AdZzDigATKXuLxG1xAt+Vwvy0LnP3DTKa+WEMZ1seq7rHchJYe0lQi4I+csa15+K5WHfhdygf6ieI7jjT9n26a5549PWQpJUrRmvVj8CekYiEerjw54RKi4w4zqNnXjNL+QYyeouwO5u9JUKgg6OXAy7vnLqOZR/7gjJfu/NNNAK5bOf34mOqDzZ68MxagwxLNbglEtnjE8D3wWpFeXa9gFSlzsWKIvmzrBH6b8bw8IXzLhLgGZjGA46pdh19yJxrC4Fc9TJg+keYvCkoYQZQ3WS/boLhIorfqKZKBKcV1qxBaTZ/uZznc9+aQHED5D2BzF2I1vohkANMg/JQPLdqtRzhdA25ii2XWXYcoK2xjpAYUHRNUt7ZxSYl/K3ERSalIqMzdc3EhBtGcWqfkEhP2dzCniaiWIHR3gG7y5GcT0B5WIoeVkZhRZhba1IG8/3YfL65KZ5JE/M6XAniYdiDpBEXvN2OKqjzLnqS6QMUm6AClDaSqVjBDvZ6eldqJn0PxWwLTKEFVzmz7hiTul1/JE24x6nEnzw8Ei4r6Cc2SVOBI=
Install	true
BDOS	false
Anti-VM	false
Install File	Telegram Portable.exe
Install-Folder	%AppData%
Ports	80,443,6606,7707,8080,8808
Mutex	H5ynOKdDigjb
Version	0.5.8
Delay	3
Group	Default

Informations

Name0	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	Telegram Portable.exe
Full Name	Telegram Portable.exe
EntryPoint	System.Void Client.Program::Main()
Scope Name	Telegram Portable.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Telegram Portable
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	120
Main Method	System.Void Client.Program::Main()
Main IL Instruction Count	51
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0043: ldsfld System.String Client.Settings::Anti ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String Client.Settings::Install call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() ldsfld System.String Client.Settings::Install call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BDOS call System.Void Client.Install.NormalStartup::Install() ldsfld System.String Client.Settings::BDOS call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.ProcessCritical::Set() call System.Void Client.Helper.Methods::PreventSleep() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Module Name	Telegram Portable.exe
Full Name	Telegram Portable.exe
EntryPoint	System.Void Client.Program::Main()
Scope Name	Telegram Portable.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Telegram Portable
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	120
Main Method	System.Void Client.Program::Main()
Main IL Instruction Count	51
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0043: ldsfld System.String Client.Settings::Anti ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String Client.Settings::Install call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() ldsfld System.String Client.Settings::Install call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BDOS call System.Void Client.Install.NormalStartup::Install() ldsfld System.String Client.Settings::BDOS call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.ProcessCritical::Set() call System.Void Client.Helper.Methods::PreventSleep() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop

Artefacts

Name0	Value
Key (AES_256)	YVNhYmU2Rkhma09TVVg5dmwxSTYwc2NDYWNDTmVFWmY=
Ports	80
Ports	443
Ports	6606
Ports	7707
Ports	8080
Ports	8808
Mutex	H5ynOKdDigjb

b5e3118a07a3fd122db41c7abafd257a (114.69 KB)