Malicious
Malicious

bfea6226bd69fedd169b72aff4fef114

PE Executable
|
MD5: bfea6226bd69fedd169b72aff4fef114
|
Size: 47.62 KB
|
application/x-dosexec

Print
Infection Chain
Summary by MalvaGPT
Characteristics

Symbol Obfuscation Score

Low

Hash
 Hash Value
MD5
bfea6226bd69fedd169b72aff4fef114
Sha1
0a8879eb2696933b3311dc3bff0d065d2ca4b21b
Sha256
fe57b1b7f4fa3b1f59eefcea180c45e1e1535b664107be15b40f0f1061f7f253
Sha384
fe4738b8f1fb79192180969a97e7b057f63dfd9ee8938d498b95f3570b083d05bfcecde3136b0a54f0642192042101eb
Sha512
69f7521aee137bd40fa09798c25daaeefa1b65a05249dee81ca6315999a4f9a18b4e8c97fd4a642320f263222af77935ea09482b831b41d42608f70f2c09428d
SSDeep
768:euG01THwoPNWUtmT1MHmo2qzf5h0tEjEPIgzjbagX3iEI0z1v2yF330ILdBDZ+Y:euG01THb01m2UZtg3bNXSP0hvVL/d+Y
TLSH
5C233C003BE9C12BF1BE4F74A9F26145467AF9633A03D94A2CC4619F1633BC696426FD

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
bfea6226bd69fedd169b72aff4fef114
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0002
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Malware Configuration - AsyncRAT config.
Config. Field
 Value
Key (AES_256)

SjRwVHNsZ25tSVJkdU1ZSGo5aFNHYVNGWlQyalN3UVc=
Pastebin

-
Certificate

MIIE8jCCAtqgAwIBAgIQALbFkWm6o99v3V5579wXezANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjYwNDEyMDc1NjQ1WhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAJMVtyo+JA0reXxeQQRlIAc1mHqNJdTims6CpmLwVXdkUH4YE4RVoJc4bQ8udUH7XEtq8/Y05W0LdkQzGPoW9I3fpe8LJdiE1tTwo8HrTe5uljJoSIL7/33Csaw9elkfEcE8vmlnMVa9P7V0srBrMFMw7vXDDNdIebZ3GWk5aArIqW3E9AgA1cMWE0IFut8A8BJZITySz5yKL9V8MmgqsktHb2+zZZ+x4XYET3Rol8u7cUsLKMTcMP2iZ12jjcdupASSTCKLf1z3lkkAmF1PAnoMkiyKZgZtie2VyHdswZ2ciMGGHMypPxz7LKc6TUi+yuCzX/7CLqXshaE0awyHzPaURP37Ia231sAgYuEnTi2cSpqTvyGz9fM8CeXck0AUlMgw+jm6RlvrUZRcHWRmUWKJo2vaTmsd1NsMbq7y0tY8PcsWd8uqTyooG9mfzGkj60sP7vJvZyHNNXttDP3CKdm5pBcfJKwACHQKAt/b34MwM9VvEcfclpGhFKJttk8phmFlC0S9cBcxH1beHRCTNQ8ujuNtK+v2kAMuGZIx8v4aCEUyj+vrhixXzEkiAmncZpnvsdKB2NYzHFEyXrnXXWA6wbcg9QwnXMwjCYRJFG8mySnTWyvUU1BpBI2eueFPMLGhl30PAfIEnaQec/TgOdj5AdFQ5nne3F6xStqwfT9lAgMBAAGjMjAwMB0GA1UdDgQWBBRySI7puURXXQFVAqVseBRk/f7xyzAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQARt2UMUgoVhWLGSppJZveidS5BuI2l5LGEemE8HfZ2mqR5gyES+WHRigElbCoKCxRdhAdgyShJUqN/qGrDfhXjHXvUnxqwrhZFkGUU8352v7LhAirh2MyOKPn5zjR0MO9mHD2dqpeI9s69p7G1Ew9wI3pEdq28EMWjgjNmbANe2hrdRb6mG8VTpgObce5HJl4wl5WSiwSxuHP9s5c4AxdTSV7TNQhQjrgYpLpyejpn/TG2c1/gORUau0rsNf1TYr4pRWHki0aA6refWsN648xovtodR4ubiPNpiMzTEbthTznxrL6G2izoeeo/MMjVnRIr4CIeTjpR6WyRA02boNgBCnSJWGIj5lpPTosE6vbjgwBqDs3jr6aaXsBPqLONg4Xo17LBV2rpTKT3iLUtLyBf0SBjKc2bxCmerv0bzdu6hwkffEMrSUF07YhnDdeAk0TOQ+/UnSp3Kw4pqXDWvmiCWTaNerHlm31RQcyoh0Hu9Q3fBN8iKs6hquDFuPUIoml8gpdOHBf1MbrKJKAH++WGctZI8i5l+hkcGe2d8pGaFB+AnlXVB2csspgJJdCLDIuarJuFsEtaL9yTgwTycnJcEmjJ2d4u7ezRtUTZfRsJ+CKuuV0dYfq9i22e+TnTuAgl/uj3vqmechy94FSrcN13CPSuIdTliOmc/gzmbt9pJQ==
ServerSignature

IjNzjx5d/RRs4UbxYbJy1laBz5w3A2VyYCm5vbDLLARAPVoVb9Mwyfhpk/I4TRfJqSi4ffycOF02mqUzX1W5z1+Fn2HIT4OwNQYxaB+EBqvnzyF2qU6uyHRJbA2CObXQG4+Xlwsqv1umfqv4fCjhnysEw1WVhmg9JqIqPfZcOBEsV+7il+CIp4b2QgCL0eL4ikn+aCtWNjwnlh5FOwLsUBNq+sCHuTUE3K26h454FvWkyTaPi1v+MDl3qhQfFjgxIyCEj4PIiNTet0h9uJ4+gUAppuUuYfp1uEd33sSTg1jqbKYyDYn7KqUE+Cw6iDxVPP9PeGcME1U+/DdaJsGEj7U+HWILvLdsx9skVSWT+9zT47aC0WM+E9LgPbou5XeFxGAzpfh7kQTL0cUe6JMps3v3H80tt/OpjZ/diF04e2Sf5ncUA08jq0/rvGGFKtGIcCqIkNraZlZoQ3rUoDDyfOcv1oDFm4OFcogCd7u9bws46CETmI4oZZxvu0fBbSpcsCxUFYvqgPZXJLoNXM5CI9S2yRx4Gv74y1ZhrDQsOlZF6m97ZXvYvWd7VaRZiC5BgZX9hiS4S0/9UQyq3HNbHLqO9sz+HG5rt/Tk4RDrIj1tqoOyVZbWcI/r8a86iozYMgGinHP26Qwg+6HZQxPHr63oahz6+/QfYoYvpatXn2A=
Install

true
BDOS

true
Anti-VM

true
Install File

venom.exe
Install-Folder

%AppData%
Version

0.5.7B
Hosts

mestizo.co.com
Ports

22,80,443,6606,7707,8808
Mutex

AsyncMutex_6SI8OkPnk
Delay

3
Group

C2
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

7zip-ver2.exe
Full Name

7zip-ver2.exe
EntryPoint

System.Void Client.Program::Main()
Scope Name

7zip-ver2.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

7zip-ver2
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

120
Main Method

System.Void Client.Program::Main()
Main IL Instruction Count

51
Main IL

ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0043: ldsfld System.String Client.Settings::Anti ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String Client.Settings::Install call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() ldsfld System.String Client.Settings::Install call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BDOS call System.Void Client.Install.NormalStartup::Install() ldsfld System.String Client.Settings::BDOS call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.ProcessCritical::Set() call System.Void Client.Helper.Methods::PreventSleep() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Module Name

7zip-ver2.exe
Full Name

7zip-ver2.exe
EntryPoint

System.Void Client.Program::Main()
Scope Name

7zip-ver2.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

7zip-ver2
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

120
Main Method

System.Void Client.Program::Main()
Main IL Instruction Count

51
Main IL

ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0043: ldsfld System.String Client.Settings::Anti ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String Client.Settings::Install call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() ldsfld System.String Client.Settings::Install call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BDOS call System.Void Client.Install.NormalStartup::Install() ldsfld System.String Client.Settings::BDOS call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.ProcessCritical::Set() call System.Void Client.Helper.Methods::PreventSleep() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Artefacts
Name
 Value
Key (AES_256)

SjRwVHNsZ25tSVJkdU1ZSGo5aFNHYVNGWlQyalN3UVc=
CnC

mestizo.co.com
Ports

22
Ports

80
Ports

443
Ports

6606
Ports

7707
Ports

8808
Mutex

AsyncMutex_6SI8OkPnk
bfea6226bd69fedd169b72aff4fef114 (47.62 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙