Malicious
Malicious

c03fb17289cf4b7065234e89830998a2

PE Executable
|
MD5: c03fb17289cf4b7065234e89830998a2
|
Size: 48.64 KB
|
application/x-dosexec

Print
Infection Chain
Summary by MalvaGPT
Characteristics

Symbol Obfuscation Score

Very high

Hash
 Hash Value
MD5
c03fb17289cf4b7065234e89830998a2
Sha1
43f65cef14d5d3339cfafd4196b839d7f7936f98
Sha256
b2abe1af5fe4b3891a3dc402af96d3ea32ac5e002370fc263060ff4ce8675332
Sha384
644ad1e4cf05fd8456c4c6108fbf44506df567ebc7d91fc0deceb89f73e19d631fe09e45d0e753973bfa2d8ccd0b3b5a
Sha512
28d0ed644c5755b552dbf27ca2cab481aa07a6c024701208b457d468aebf03604558557b131cf1227b3d1dc248daa271b1f90c6a7155910dbfea6f0173c3ee04
SSDeep
768:0u42BT3v1gbWUnUa6mo2qRbdxasQmoItaPI48oj0bdHakDHnSmyCngBk8UMjku1J:0u42BT3Nj2+TQm/j47IbdHRSmu5bd/x
TLSH
B9234C007BE9C227F2BE4F786DF22245867BB2673503D54E1CC4519B5623BC296426FE

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
c03fb17289cf4b7065234e89830998a2
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Malware Configuration - AsyncRAT config.
Config. Field
 Value
Key (AES_256)

WWRwYk9uNWdJMnRhTTZ0Yk1Vcmg5Y0o2enB0OFVqcEk=
Pastebin

-
Certificate

MIIE2jCCAsKgAwIBAgIQAMqeZaD0x27J8/VsAoMpQzANBgkqhkiG9w0BAQ0FADAOMQwwCgYDVQQDDANkZGQwIBcNMjUxMTI2MjEwODU1WhgPOTk5OTEyMzEyMzU5NTlaMA4xDDAKBgNVBAMMA2RkZDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALDNjLMJlbPTcGv1q8Ebo2imXhuLyjycIH3IBBhdJvrkGL3BjhLj1AOSn9dT0lOw00aKfjogZwHJ9Q7P3QUIeT41dkuM+UWp4YSOiIWQvM8foEojwFwbmM3OSVEEqc7w1Rr8Lerjd2uy5Q8pmUCO3O09TIUqlnRFbyIF++hUx8OYwa/HvvW0cTEfTyj/le9kgqIjghfO0iHLyjr+rWE0JFXneGfdbtQFSP+VZmyvc5Orqg0gvLxvAPG3Zg42Ry6bNoWboVyMJWQi3f6TomJIUfvZM2xUPM+DrOYw9hXQticjOfcNREIbYtfXuWhHUViRKZjw74XiLEB+jtSHUC8xDVA/BW8H549B4nB3FwLZrWtEGMSzuGeLoNoel7XjmfAQC6hDO6o2KGUEaQ0EhwvGxK4A1Ukk9oVOiOl6ZrOF8mLkXpR89CYu5VHlZnf/0e0LLCtuxetOfLiKBIWQQIOz1bESfRqotkvjoRF1MzV8V4px3wCZb7jEJ7I2xiuZ49Y+lbhsahGCc6LjjlvtLa1EBgSUrZFmuE6JNMmiVZkQgokS1lwU7VadIzJVdwFGSOcA6F8ioFMFAAD5C16cbp5re6HglxXzJKPLmO04xh4zxGM0roCpnG/laR6vZBZ7onGAuL4YTy87qnFjQJ6HkBZr84Fj7ssElejWt/t77+N69gXLAgMBAAGjMjAwMB0GA1UdDgQWBBTm9JSg7sJtXf1zqFP3yxqDutaLazAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQBy84DOygF++d6LD6va972l6NEJqgPCzQP8v1Iyz35zrHslqw2qU3FqpADiAIwCM4V7AlgB0VAQSMYlvnZkIRQ05ChGdnK85vZMye15LjektKuDJzESmE8/oUZrXs0JjMAIyicbq1afDbjiUKo+mnBhyGQlH5WRVWI8ryeUrxYxw/GbZDNt/Cmjq9+Ujcnur/DnY1Z+bZZMz93MECRYZBzBka1o331mKqlG5UD55ROQSZNXbE++Yvz1IxROw/7fK/Y+ZJnoVNAuGwwK5MvheT/uqPE6KsCEnr/fHhBCrlxYNe526zt0yiRJOfC7BA8nKu39GjLZqszbPkeERD1VfTZw9Xj4nJ1xMzyC7FCoIBm8l+HreOtNBvHDfrH5+kWDBbD7Y/rTmnaEpoNnu7WnHUJWZR1CFH7uFKirXF+C9IcMDPj/CG+RKQ2MoT9TBtXtsnfmNeiVWjhi9Zt86vcN+MbJKf7YjUlYqUqPUDONSl8/xuC1gcAR4hTjWtGdgDCtNl3bppcQpJlanHygKETAynsj5ayzn+lE4ebirktfUqX3pUz9GMxrG5NRVu5FDfEpvfyO7oHIkgKWuou7Y4OxHVQ1jAeLqh93dlSPFUQ8WJZpEhc4s+Yc3VoKlnbz1OWHrCb8xn1UuBOFQWQGonjKxDqI/+kMgk2S8Ydf+RyNSt6sRg==
ServerSignature

esCk/VZMrbAiv0wNSf1dOrSyBuHomrmnrZMyVPd64+xn7hEdGV1Bx66RA6wwLc6I0LUZK/pfj33XmgyBh9Kr9VEvsIKMrQHiVG8OOJhUQllPRUajIpcPyUpmB0gHFnRUI370MhctPZtdklZErTxfHzVIGTzy5bwNon/rjFkZbELA0keG7HIeaz1G3BPnHkBdUeh8ODGFR+Dc5if0ZoiNB0w31Iz4VbIQ6D7noDW2Zt1BVWQdLK/Sh40JOUzScV2aMJ09iVWsdreFRcAU3Wxkl3Lo3iiED3brN9KSdLbp+sdop7MpuNx674CRLYGyNT1rLmST9llCDMp3PDZPNXIkox+mZ7O5SMq3tonsTk937rz9xfYK4pxODGV6o5THAA8nCFL4L02bVjUWotB+NWO+/x0+Cp9FtGK6U9bABBVYqv2+o3UqC+7BErqvwbm9qmuJA3EnG8SBnGWt35phZCy8LD1CKL9grKhxrmup3rRvk38AhtW9msyklQhiEH2hPjXJuqo8fwSBQSv6fiD+Rh2NZXo6SITUyJsyO4J4OZER1XdetNrsfPbRfGdubprEffm+H8ay4Op63V4Jn5TnBbfCDmUUePjiU5+699idUgKS7rU9FkCZFYU7cQDuEJeFFHPz6s4gOcwuxvzwnJx94nbtWdLj4zD86KgR
Install

false
BDOS

false
Anti-VM

false
Install-Folder

%AppData%
Hosts

16.171.20.89
Ports

1337
Mutex

wii1dn2z6eWX
Version

0.5.8
Delay

3
Group

Default
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

qWBAlcHpuGRaM
Full Name

qWBAlcHpuGRaM
EntryPoint

System.Void IbzxQcRQZEu.SxSAgEmYamL::Main()
Scope Name

qWBAlcHpuGRaM
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

McFarmet
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

120
Main Method

System.Void IbzxQcRQZEu.SxSAgEmYamL::Main()
Main IL Instruction Count

51
Main IL

ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String IbzxQcRQZEu.nhcflGByUiPmItP::GnUoMLpInPqIYG call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean IbzxQcRQZEu.nhcflGByUiPmItP::BcDgdStTZHiwDJ() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean UxZjBzBcqZkGYP.QsoeGacLEbcY::mqVjraeWxSQ() brtrue IL_0043: ldsfld System.String IbzxQcRQZEu.nhcflGByUiPmItP::HsRNdUvUKL ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String IbzxQcRQZEu.nhcflGByUiPmItP::HsRNdUvUKL call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String IbzxQcRQZEu.nhcflGByUiPmItP::yzZMhCwXnWa call System.Void UxZjBzBcqZkGYP.gECvAITNkXYeFi::MFQVfwopVfLK() ldsfld System.String IbzxQcRQZEu.nhcflGByUiPmItP::yzZMhCwXnWa call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String IbzxQcRQZEu.nhcflGByUiPmItP::GwGOiRuXMDJwG call System.Void rkbspnehjjOLJ.zrxrZhUMoOROvR::vYtaipXqYVFLCq() ldsfld System.String IbzxQcRQZEu.nhcflGByUiPmItP::GwGOiRuXMDJwG call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void UxZjBzBcqZkGYP.mQOCubLDdufoZ::JbfsXJpoZuQionXqG() call System.Boolean UxZjBzBcqZkGYP.mQOCubLDdufoZ::SFxWIVBXHiwhTA() brfalse IL_0089: call System.Void UxZjBzBcqZkGYP.mQOCubLDdufoZ::JbfsXJpoZuQionXqG() call System.Void UxZjBzBcqZkGYP.rYtOvnmOyNze::BRfaavprHUVyaiA() call System.Void UxZjBzBcqZkGYP.mQOCubLDdufoZ::JbfsXJpoZuQionXqG() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean EakUhwUXoQOG.aXdQpUcOcZtSWHc::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void EakUhwUXoQOG.aXdQpUcOcZtSWHc::FxwuoVHSnpONpc() call System.Void EakUhwUXoQOG.aXdQpUcOcZtSWHc::iZfPWjtHMAqTtX() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Module Name

qWBAlcHpuGRaM
Full Name

qWBAlcHpuGRaM
EntryPoint

System.Void IbzxQcRQZEu.SxSAgEmYamL::Main()
Scope Name

qWBAlcHpuGRaM
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

McFarmet
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

120
Main Method

System.Void IbzxQcRQZEu.SxSAgEmYamL::Main()
Main IL Instruction Count

51
Main IL

ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String IbzxQcRQZEu.nhcflGByUiPmItP::GnUoMLpInPqIYG call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean IbzxQcRQZEu.nhcflGByUiPmItP::BcDgdStTZHiwDJ() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean UxZjBzBcqZkGYP.QsoeGacLEbcY::mqVjraeWxSQ() brtrue IL_0043: ldsfld System.String IbzxQcRQZEu.nhcflGByUiPmItP::HsRNdUvUKL ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String IbzxQcRQZEu.nhcflGByUiPmItP::HsRNdUvUKL call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String IbzxQcRQZEu.nhcflGByUiPmItP::yzZMhCwXnWa call System.Void UxZjBzBcqZkGYP.gECvAITNkXYeFi::MFQVfwopVfLK() ldsfld System.String IbzxQcRQZEu.nhcflGByUiPmItP::yzZMhCwXnWa call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String IbzxQcRQZEu.nhcflGByUiPmItP::GwGOiRuXMDJwG call System.Void rkbspnehjjOLJ.zrxrZhUMoOROvR::vYtaipXqYVFLCq() ldsfld System.String IbzxQcRQZEu.nhcflGByUiPmItP::GwGOiRuXMDJwG call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void UxZjBzBcqZkGYP.mQOCubLDdufoZ::JbfsXJpoZuQionXqG() call System.Boolean UxZjBzBcqZkGYP.mQOCubLDdufoZ::SFxWIVBXHiwhTA() brfalse IL_0089: call System.Void UxZjBzBcqZkGYP.mQOCubLDdufoZ::JbfsXJpoZuQionXqG() call System.Void UxZjBzBcqZkGYP.rYtOvnmOyNze::BRfaavprHUVyaiA() call System.Void UxZjBzBcqZkGYP.mQOCubLDdufoZ::JbfsXJpoZuQionXqG() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean EakUhwUXoQOG.aXdQpUcOcZtSWHc::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void EakUhwUXoQOG.aXdQpUcOcZtSWHc::FxwuoVHSnpONpc() call System.Void EakUhwUXoQOG.aXdQpUcOcZtSWHc::iZfPWjtHMAqTtX() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Artefacts
Name
 Value
Key (AES_256)

WWRwYk9uNWdJMnRhTTZ0Yk1Vcmg5Y0o2enB0OFVqcEk=
CnC

16.171.20.89
Ports

1337
Mutex

wii1dn2z6eWX
c03fb17289cf4b7065234e89830998a2 (48.64 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙