bba1a19f6d2c846b3d09505e5d9838be

PE Executable
|
MD5: bba1a19f6d2c846b3d09505e5d9838be
|
Size: 140.29 KB
|
application/x-dosexec

Infection Chain

Summary by MalvaGPT

Characteristics

Hash	Hash Value
MD5	bba1a19f6d2c846b3d09505e5d9838be
Sha1	27d76724dbb48bf181ee956d130ecdaa144ee33c
Sha256	851afa6f3343202f7cf017e1b4e7ada2063132ad3e726c26fc33e1d657e24586
Sha384	f45335653fc41b59dd1bceaed1e0426ae98c0fe80f6efe4b23bcf5e00a893755227752e2b88257bfca34b4f5a787beb4
Sha512	b54efff8dcbd8e608f04b1cb4b92d16de40b0aa22ca40bcd25e441b9d0fd5d1ac88fcda3a68f8fbdc0f2206249022c23e0a2f88925bfd7bcac938610c62d284c
SSDeep	3072:gQQxBU4Uxv1AVEeGbb//1U9BeF+YzB1hXeiYY0I26QqxqY:gOzwkb3wBeYA/mIBpk
TLSH	94D3C0052B48C8A1E2AD4AB8DDF2564046B5CDB32501DA0E7CC425CF67AEFC95A077FE

PeID

.NET executable

Microsoft Visual C# / Basic .NET

Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL

Microsoft Visual C# v7.0 / Basic .NET

Microsoft Visual Studio .NET

File Structure

Malware Configuration - DcRat config.

Config. Field0	Value
Key (AES_256)	Y2gxdWRVVVZCd1l0c25wVlh3MTJMMGNaejNoYW9xd0Y=
Pastebin	-
Certificate	MIICMDCCAZmgAwIBAgIVALbBdb6LDUU2WwnHY/fvjCGMzoafMA0GCSqGSIb3DQEBDQUAMGQxFTATBgNVBAMMDERjUmF0IFNlcnZlcjETMBEGA1UECwwKcXdxZGFuY2h1bjEcMBoGA1UECgwTRGNSYXQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTI1MDMyNzE3NTk1NFoXDTM2MDEwNDE3NTk1NFowEDEOMAwGA1UEAwwFRGNSYXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAK8G+Uq0gR6HABOh9eEQxB+hKueG/hdD4YbSukrx9RE77nmSZREteDYTeYxpH/I2Cid3N1gJhMJJf/0aL3Fh6jZLCMZYB1yqC8gPSVidoMKLu9RaKLm/RK5i0tWWYOytaU1ARvpR+qvMeTv1ZdwCubmjBcR+a3GMOHofnPNb++IbAgMBAAGjMjAwMB0GA1UdDgQWBBQKoF9qsseRqwlP+4yBRMk45UhpPTAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4GBADdGw7tmllkIN6exx6qhSxirAex5Z7Axg6TgaAh8j2sIHdkqNZUCBc1bJ7mlVdtnLC4BcbaoSj7EmE+sDHUP8fIc5vI5czUkFPFVp35aMcjS8sCFEOGErXR6mzLx3sPfRwdgrG9Sawmqi79fAIuuh5upOv/NlVjDb50+jBlWiHrt
ServerSignature	A1IuyS3Mm2fkEAybKLHcRxpGlyrYKYHKSllnsDo2E6WneLaee+aoXS2pcn09Tb2IrSDmEVfOZFFiXqqnn0qlfvvfe1l5QInxP+vxhocLevj+zMyBc8VEO/VOgPQIhJ8KgKDx7dZ1Hi5CrMgfieNr5vQQB8xHFVIhcoKJBEVcKzA=
Install	true
BDOS	false
Anti-VM	false
Install File	winrar.exe
Install-Folder	%AppData%
Hosts	motfim.com,1710.cn.com,8xx.de.com,vxe.uk.com,buybitcoin.us.com,777x.us.com,runafrica.us.org,n188.co.com,todayepisode.ru.com,exuberant.uk.com,735bet12.com,eihbgb.sa.com,gate.motfim.com,gate.1710.cn.com,gate.8xx.de.com,gate.vxe.uk.com,gate.buybitcoin.us.com,gate.777x.us.com,gate.runafrica.us.org,gate.n188.co.com,gate.todayepisode.ru.com,gate.exuberant.uk.com,gate.735bet12.com,gate.eihbgb.sa.com,www.motfim.com,www.1710.cn.com,www.8xx.de.com,www.vxe.uk.com,www.buybitcoin.us.com,www.777x.us.com,www.runafrica.us.org,www.n188.co.com,www.todayepisode.ru.com,www.exuberant.uk.com,www.735bet12.com,www.eihbgb.sa.com
Ports	80,443,2053,2083,2087,2096,4782,8080,8848,8888
Mutex	DcRatMutex_qwqdanchun
Version	1.0.7
Delay	1
Group	Horizon

Informations

Name0	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	winrar.exe
Full Name	winrar.exe
EntryPoint	System.Void Client.Program::Main()
Scope Name	winrar.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	winrar
Assembly Version	1.0.7.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	157
Main Method	System.Void Client.Program::Main()
Main IL Instruction Count	77
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::De_lay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> ldsfld System.String Client.Settings::An_ti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0047: leave IL_0052 call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() leave IL_0052: call System.Void Client.Helper.A::B() pop <null> leave IL_0052: call System.Void Client.Helper.A::B() call System.Void Client.Helper.A::B() call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0067: leave IL_0072 ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) leave IL_0072: nop pop <null> leave IL_0072: nop nop <null> ldsfld System.String Client.Settings::Anti_Process call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0087: leave IL_0092 call System.Void Client.Helper.AntiProcess::StartBlock() leave IL_0092: nop pop <null> leave IL_0092: nop nop <null> ldsfld System.String Client.Settings::BS_OD call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_00B1: leave IL_00BC call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_00B1: leave IL_00BC call System.Void Client.Helper.ProcessCritical::Set() leave IL_00BC: nop pop <null> leave IL_00BC: nop nop <null> ldsfld System.String Client.Settings::In_stall call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_00D1: leave IL_00DC call System.Void Client.Install.NormalStartup::Install() leave IL_00DC: call System.Void Client.Helper.Methods::PreventSleep() pop <null> leave IL_00DC: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_00F0: leave IL_00FB call System.Void Client.Helper.Methods::ClearSetting() leave IL_00FB: nop pop <null> leave IL_00FB: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_0110: leave IL_011B call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_011B: ldc.i4 5000 pop <null> leave IL_011B: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_00FB: nop
Module Name	winrar.exe
Full Name	winrar.exe
EntryPoint	System.Void Client.Program::Main()
Scope Name	winrar.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	winrar
Assembly Version	1.0.7.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	157
Main Method	System.Void Client.Program::Main()
Main IL Instruction Count	77
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::De_lay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> ldsfld System.String Client.Settings::An_ti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0047: leave IL_0052 call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() leave IL_0052: call System.Void Client.Helper.A::B() pop <null> leave IL_0052: call System.Void Client.Helper.A::B() call System.Void Client.Helper.A::B() call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0067: leave IL_0072 ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) leave IL_0072: nop pop <null> leave IL_0072: nop nop <null> ldsfld System.String Client.Settings::Anti_Process call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0087: leave IL_0092 call System.Void Client.Helper.AntiProcess::StartBlock() leave IL_0092: nop pop <null> leave IL_0092: nop nop <null> ldsfld System.String Client.Settings::BS_OD call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_00B1: leave IL_00BC call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_00B1: leave IL_00BC call System.Void Client.Helper.ProcessCritical::Set() leave IL_00BC: nop pop <null> leave IL_00BC: nop nop <null> ldsfld System.String Client.Settings::In_stall call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_00D1: leave IL_00DC call System.Void Client.Install.NormalStartup::Install() leave IL_00DC: call System.Void Client.Helper.Methods::PreventSleep() pop <null> leave IL_00DC: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_00F0: leave IL_00FB call System.Void Client.Helper.Methods::ClearSetting() leave IL_00FB: nop pop <null> leave IL_00FB: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_0110: leave IL_011B call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_011B: ldc.i4 5000 pop <null> leave IL_011B: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_00FB: nop

Artefacts

Name0	Value
Key (AES_256)	Y2gxdWRVVVZCd1l0c25wVlh3MTJMMGNaejNoYW9xd0Y=
CnC	motfim.com
CnC	1710.cn.com
CnC	8xx.de.com
CnC	vxe.uk.com
CnC	buybitcoin.us.com
CnC	777x.us.com
CnC	runafrica.us.org
CnC	n188.co.com
CnC	todayepisode.ru.com
CnC	exuberant.uk.com
CnC	735bet12.com
CnC	eihbgb.sa.com
CnC	gate.motfim.com
CnC	gate.1710.cn.com
CnC	gate.8xx.de.com
CnC	gate.vxe.uk.com
CnC	gate.buybitcoin.us.com
CnC	gate.777x.us.com
CnC	gate.runafrica.us.org
CnC	gate.n188.co.com
CnC	gate.todayepisode.ru.com
CnC	gate.exuberant.uk.com
CnC	gate.735bet12.com
CnC	gate.eihbgb.sa.com
CnC	www.motfim.com
CnC	www.1710.cn.com
CnC	www.8xx.de.com
CnC	www.vxe.uk.com
CnC	www.buybitcoin.us.com
CnC	www.777x.us.com
CnC	www.runafrica.us.org
CnC	www.n188.co.com
CnC	www.todayepisode.ru.com
CnC	www.exuberant.uk.com
CnC	www.735bet12.com
CnC	www.eihbgb.sa.com
Ports	80
Ports	443
Ports	2053
Ports	2083
Ports	2087
Ports	2096
Ports	4782
Ports	8080
Ports	8848
Ports	8888
Mutex	DcRatMutex_qwqdanchun

bba1a19f6d2c846b3d09505e5d9838be (140.29 KB)