Malicious
Malicious

b5e3118a07a3fd122db41c7abafd257a

PE Executable
|
MD5: b5e3118a07a3fd122db41c7abafd257a
|
Size: 114.69 KB
|
application/x-dosexec

Print
Infection Chain
Summary by MalvaGPT
Characteristics

Symbol Obfuscation Score

Low

Hash
 Hash Value
MD5
b5e3118a07a3fd122db41c7abafd257a
Sha1
7eafd3cf387792e0f0f8dc3b7111bc89e4a542b0
Sha256
94a0fd7835576e648601a4f7238d78c8883097468b889244cef9f9bf6f6eaeba
Sha384
a1cbf39ba53454cb3d895710e2b8fe1a281bdf2172d6f736e1262fba48423758b1a7e7983e4368590818a6c698a1df4c
Sha512
e1a83f3eab1e580e02c293339d62e6493fe762c0a8ac312087741cf55cc589f641716387bee4f3b9621388e622608fca606e435f41efe40739d89e6207fcb926
SSDeep
1536:eu/S1T1C12HwhXslZbpXSGB2edJmW7DB5NRlmMGCCl:eu/OT1C12o8lZbpTBHLd2l
TLSH
B3B32109E919485DE82C0E7C6CF3A4560695BF37E508ABC90DDCF8CF6A33A860EC5759

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
b5e3118a07a3fd122db41c7abafd257a
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Malware Configuration - AsyncRAT config.
Config. Field
 Value
Key (AES_256)

YVNhYmU2Rkhma09TVVg5dmwxSTYwc2NDYWNDTmVFWmY=
Pastebin

-
Certificate

MIIE8jCCAtqgAwIBAgIQAKVftBHhqqUdcMK3c1LUQTANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjYwNTA1MjI1OTMzWhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALSCt94AtQhLG8af3dtv0P+9GwwD3m0u/MwmPomfcdSb/bNV12kRkw5ovGQBq1XMo1VAoBvNv2225Ch4tc/Z47hsxcIG09TJRL3pVazPn0ax6ax7ERqznDQXYgqk7nArCUcs51fWekUucNPCqKnscSijDMLCTt7IQCtClTuCkByJJsP9f0wG3IFRwV49X/Us0wcRDU3HDJ+GxKMdWw0y5pawRrXmDOGuTRIExksDWBnhDh7akQ1RDmtWFEGwGNi+wBD5vtAxCZ6UnPF/LWerUqbQzqMf5TECCXrl6DnVijffvcDYwGFi2aXm5wamVXc/qILNWRzuMZdtQzskdBWkCpOdqyZ9V2YqLZjmux2l312yx7Jmw6jPn9jIKJ73JKYL9cUXa2Edm/rMtEJfemAVtxF76tn+U3XkhW8e1sLMvCe/4tB2BKtX0a8h8NKBf2VYWnbj70eQwa+ToV+cCqp/d5SSmO4NuVvyekuYjnmQO+ADTd9TgVC/iO9k7UJxu8+ZBjBC17XIKcvPszOhm5XmdRixGfN55Y6bIIVOsC4xrV9ZElJzMed7ZXPwHcLtjS6OZCccl4RNqDKFnRAFTA4f3PWC7+0xYbpx5kCm1XzGzXVImikch5uVvb2rzhyivC9XbKksffvzXEVr8oulgJaJXDDEz5B8C2I2jam/xraisRBXAgMBAAGjMjAwMB0GA1UdDgQWBBTI/ofcyXL2Qz4Re84MP7dhioYazzAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQAMbLSWC0mVgwSx+hTIB1g7Vg7qFdYUuF4fagRJV0DLuDeeV8imeS5/YGMyY4mFEXGDYPWCu123gpnOgpiLT7QdxV0dIJfedcDoluzreDLpUIwLYIe5xVuk2g2VsqOvajvRcEt1O2ajA/KQS0oKv95ercHggRB5iCQg3IykUEEYev/t7mgoGWBA+V6/22tJ1HQUo4c1u1DHG3tp7b1DD2Kz0/2IkRyjCtF0GWT/GBNSxkxdaSwlLGYc0RZXLlLGkk0FpOvcJDWh8BqSCjt+0isqO11lbVBuMGS6Vd/H28FujzdUhhf9ldvpUwiuignHf8Ww+mq2/t+v9xiqGHmM/vdGSLvbiJGvV+TlIYiEk5Yq10G4aGmbB36SRQuWnGuaizyVBtCj71emstYkGpZFBmI6hAIDZi5uqrxrgMWx/qxiMAMUPJ9fKyqYLJqao1upkvOIw44hOG+XDgu3lt+fhbxLpAtIGZlXG46kQ//EU2qDyO/dHWEHFn8YUDSGkso2qJwH6NFs5cbk5orpPDShPkyKPx/glq9+EcZoVtqxYfIvIEsEF6soJHQ9nLGgb/yI1QFdDaJ0hvwCKzc8fVHOcKyF7WcbXn2IUChNMKry7QzZXh1+yI/+u5mvVeWEksgeK5XnuWVxl+LnItOzYuGmnShTuH5BBiPzPgc7msZWHle3Mg==
ServerSignature

Agw3fA61U1CpxMYBV9UWU0d2XFJarhfLv9v/PXnSpDsyNQr/qOKxMrD8KHOkYg+ZEK9KZWL0mEaKa83PWlxBNPbjfVpBz0UJIxfsyUVFrF0RczCZ8g/nJUo07/i99AdZzDigATKXuLxG1xAt+Vwvy0LnP3DTKa+WEMZ1seq7rHchJYe0lQi4I+csa15+K5WHfhdygf6ieI7jjT9n26a5549PWQpJUrRmvVj8CekYiEerjw54RKi4w4zqNnXjNL+QYyeouwO5u9JUKgg6OXAy7vnLqOZR/7gjJfu/NNNAK5bOf34mOqDzZ68MxagwxLNbglEtnjE8D3wWpFeXa9gFSlzsWKIvmzrBH6b8bw8IXzLhLgGZjGA46pdh19yJxrC4Fc9TJg+keYvCkoYQZQ3WS/boLhIorfqKZKBKcV1qxBaTZ/uZznc9+aQHED5D2BzF2I1vohkANMg/JQPLdqtRzhdA25ii2XWXYcoK2xjpAYUHRNUt7ZxSYl/K3ERSalIqMzdc3EhBtGcWqfkEhP2dzCniaiWIHR3gG7y5GcT0B5WIoeVkZhRZhba1IG8/3YfL65KZ5JE/M6XAniYdiDpBEXvN2OKqjzLnqS6QMUm6AClDaSqVjBDvZ6eldqJn0PxWwLTKEFVzmz7hiTul1/JE24x6nEnzw8Ei4r6Cc2SVOBI=
Install

true
BDOS

false
Anti-VM

false
Install File

Telegram Portable.exe
Install-Folder

%AppData%
Ports

80,443,6606,7707,8080,8808
Mutex

H5ynOKdDigjb
Version

0.5.8
Delay

3
Group

Default
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

Telegram Portable.exe
Full Name

Telegram Portable.exe
EntryPoint

System.Void Client.Program::Main()
Scope Name

Telegram Portable.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Telegram Portable
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

120
Main Method

System.Void Client.Program::Main()
Main IL Instruction Count

51
Main IL

ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0043: ldsfld System.String Client.Settings::Anti ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String Client.Settings::Install call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() ldsfld System.String Client.Settings::Install call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BDOS call System.Void Client.Install.NormalStartup::Install() ldsfld System.String Client.Settings::BDOS call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.ProcessCritical::Set() call System.Void Client.Helper.Methods::PreventSleep() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Module Name

Telegram Portable.exe
Full Name

Telegram Portable.exe
EntryPoint

System.Void Client.Program::Main()
Scope Name

Telegram Portable.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Telegram Portable
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

120
Main Method

System.Void Client.Program::Main()
Main IL Instruction Count

51
Main IL

ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0043: ldsfld System.String Client.Settings::Anti ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String Client.Settings::Install call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() ldsfld System.String Client.Settings::Install call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BDOS call System.Void Client.Install.NormalStartup::Install() ldsfld System.String Client.Settings::BDOS call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.ProcessCritical::Set() call System.Void Client.Helper.Methods::PreventSleep() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Artefacts
Name
 Value
Key (AES_256)

YVNhYmU2Rkhma09TVVg5dmwxSTYwc2NDYWNDTmVFWmY=
Ports

80
Ports

443
Ports

6606
Ports

7707
Ports

8080
Ports

8808
Mutex

H5ynOKdDigjb
b5e3118a07a3fd122db41c7abafd257a (114.69 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙