Malicious
Malicious

c153de0ecc7626bcb2fd34a4944e79e7

PE Executable
|
MD5: c153de0ecc7626bcb2fd34a4944e79e7
|
Size: 274.94 KB
|
application/x-dosexec

Infection Chain
Summary by MalvaGPT
Characteristics

Symbol Obfuscation Score

Low

Hash
 Hash Value
MD5
c153de0ecc7626bcb2fd34a4944e79e7
Sha1
8cf7684286a14c836d88f5973b59eefbe68df222
Sha256
039cc3d021f34d2b7844e4cb4fa0fabd56853dd40dedae1c9cfd1699882bbf6f
Sha384
3ffac2d6de9f3dcb169992b166149184a61082664d4a2b39930be617b8d78683fda750e0aad8f8239eb9a9153353ebcc
Sha512
7b32cb51fcd44a1842169b54189e400574ad9830879ac9455770c6655fdce87ad605398412e04fb06315e9bd5427a8ab72ee52788484aef112c44aaf1e44c843
SSDeep
6144:uF2DkbbpspppppppRppUpppovppAaaaa8araBpBpIppUpqppppqpppAe5bpqppb1:uFuOpspppppppRppUpppovppAaaaa8aV
TLSH
F844AF03F548CAA6D87F8F39A87314650B36AEB7C0C1890D7ACC726E4E7A5514C1B5BB

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
c153de0ecc7626bcb2fd34a4944e79e7
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
ID:0-preview.png
ID:0006
ID:0
ID:0-preview.png
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Malware Configuration - DcRat config.
Config. Field
 Value
Key (AES_256)

Z3lOQk9WR2NicmRheERGVzZPY3VjRjBpWmt6Z2VRREc=
Pastebin

-
Certificate

MIICMDCCAZmgAwIBAgIVAKAAD/SurGzixOhqLGBOobqogcoTMA0GCSqGSIb3DQEBDQUAMGQxFTATBgNVBAMMDERjUmF0IFNlcnZlcjETMBEGA1UECwwKcXdxZGFuY2h1bjEcMBoGA1UECgwTRGNSYXQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTI1MDczMDE2MDAzNFoXDTM2MDUwODE2MDAzNFowEDEOMAwGA1UEAwwFRGNSYXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAJygeMMS0Eky6soRjVpJncMJvGjNgnGiKLCBDMTmZBPuqoKlp/FJSfO1tkK80BgDAR7JPAo4kUq0Q67UzlLrMBI55WSZ42FqNch/8syD+YJnb4l9BDCfsiVfn0gxPqNohKwohtejFsMyzT7bVXjx8+MF1yehWgqbpzQLE9fX+3K3AgMBAAGjMjAwMB0GA1UdDgQWBBTkZtw3jYmWNyJBHmhQKHdLTEkuVzAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4GBAFujYCRjoUzFA6XMARCuvELNJ+9JInrUWdGSDHSzd58SkReUeDmuAPYaZVfnzexYDQ9rxa/UT6CX/nkMnZjXGdkStbkdKRb5FDT8BkvjLdyrqP8ES8K2qXngvdkSmfWz+bGQShb7Pj+y7eHEReJUkTnxu3E1tGItlMMZWP1fYCX8
ServerSignature

a1KXCUSCL/w4sGdLeUMPYLKCIJVoTgXDkOt+bTWD7+P+Ko14HxxZbe6CrU527agK7l4l8xeq8t1v5q/PSXWGHaAmEX2Xcc0aBeVbw5UWZQ6UXMvkS7dKq/ainpFeB3s7dVQkoIDcd7Nukq2PAS8G/daMRlcyCClBUgc289Ymsf8=
Install

true
BDOS

true
Anti-VM

false
Install File

UrbanVpn.exe
Install-Folder

%AppData%
Hosts

104.21.87.11,172.67.139.34,188.114.97.0,188.114.96.0,108.162.193.193,108.162.192.120,kalyanonlinematkaapp.in.net,server.kalyanonlinematkaapp.in.net,api.kalyanonlinematkaapp.in.net,email.kalyanonlinematkaapp.in.net,screenshot.kalyanonlinematkaapp.in.net
Ports

53,80,443,1604,8080
Mutex

UrbanVpn-gf6-sfk-as3k238-j3-2fuj
Version

1.0.7
Delay

1
Group

Setup
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

Urban Vpn Updater.exe
Full Name

Urban Vpn Updater.exe
EntryPoint

System.Void Client.Program::Main()
Scope Name

Urban Vpn Updater.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Urban Vpn Updater
Assembly Version

1.0.7.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0
Total Strings

157
Main Method

System.Void Client.Program::Main()
Main IL Instruction Count

77
Main IL

ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::De_lay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> ldsfld System.String Client.Settings::An_ti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0047: leave IL_0052 call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() leave IL_0052: call System.Void Client.Helper.A::B() pop <null> leave IL_0052: call System.Void Client.Helper.A::B() call System.Void Client.Helper.A::B() call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0067: leave IL_0072 ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) leave IL_0072: nop pop <null> leave IL_0072: nop nop <null> ldsfld System.String Client.Settings::Anti_Process call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0087: leave IL_0092 call System.Void Client.Helper.AntiProcess::StartBlock() leave IL_0092: nop pop <null> leave IL_0092: nop nop <null> ldsfld System.String Client.Settings::BS_OD call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_00B1: leave IL_00BC call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_00B1: leave IL_00BC call System.Void Client.Helper.ProcessCritical::Set() leave IL_00BC: nop pop <null> leave IL_00BC: nop nop <null> ldsfld System.String Client.Settings::In_stall call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_00D1: leave IL_00DC call System.Void Client.Install.NormalStartup::Install() leave IL_00DC: call System.Void Client.Helper.Methods::PreventSleep() pop <null> leave IL_00DC: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_00F0: leave IL_00FB call System.Void Client.Helper.Methods::ClearSetting() leave IL_00FB: nop pop <null> leave IL_00FB: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_0110: leave IL_011B call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_011B: ldc.i4 5000 pop <null> leave IL_011B: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_00FB: nop
Module Name

Urban Vpn Updater.exe
Full Name

Urban Vpn Updater.exe
EntryPoint

System.Void Client.Program::Main()
Scope Name

Urban Vpn Updater.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Urban Vpn Updater
Assembly Version

1.0.7.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0
Total Strings

157
Main Method

System.Void Client.Program::Main()
Main IL Instruction Count

77
Main IL

ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::De_lay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> ldsfld System.String Client.Settings::An_ti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0047: leave IL_0052 call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() leave IL_0052: call System.Void Client.Helper.A::B() pop <null> leave IL_0052: call System.Void Client.Helper.A::B() call System.Void Client.Helper.A::B() call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0067: leave IL_0072 ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) leave IL_0072: nop pop <null> leave IL_0072: nop nop <null> ldsfld System.String Client.Settings::Anti_Process call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0087: leave IL_0092 call System.Void Client.Helper.AntiProcess::StartBlock() leave IL_0092: nop pop <null> leave IL_0092: nop nop <null> ldsfld System.String Client.Settings::BS_OD call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_00B1: leave IL_00BC call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_00B1: leave IL_00BC call System.Void Client.Helper.ProcessCritical::Set() leave IL_00BC: nop pop <null> leave IL_00BC: nop nop <null> ldsfld System.String Client.Settings::In_stall call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_00D1: leave IL_00DC call System.Void Client.Install.NormalStartup::Install() leave IL_00DC: call System.Void Client.Helper.Methods::PreventSleep() pop <null> leave IL_00DC: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_00F0: leave IL_00FB call System.Void Client.Helper.Methods::ClearSetting() leave IL_00FB: nop pop <null> leave IL_00FB: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_0110: leave IL_011B call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_011B: ldc.i4 5000 pop <null> leave IL_011B: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_00FB: nop
Artefacts
Name
 Value
Key (AES_256)

Z3lOQk9WR2NicmRheERGVzZPY3VjRjBpWmt6Z2VRREc=
CnC

104.21.87.11
CnC

172.67.139.34
CnC

188.114.97.0
CnC

188.114.96.0
CnC

108.162.193.193
CnC

108.162.192.120
CnC

kalyanonlinematkaapp.in.net
CnC

server.kalyanonlinematkaapp.in.net
CnC

api.kalyanonlinematkaapp.in.net
CnC

email.kalyanonlinematkaapp.in.net
CnC

screenshot.kalyanonlinematkaapp.in.net
Ports

53
Ports

80
Ports

443
Ports

1604
Ports

8080
Mutex

UrbanVpn-gf6-sfk-as3k238-j3-2fuj
c153de0ecc7626bcb2fd34a4944e79e7 (274.94 KB)
File Structure
c153de0ecc7626bcb2fd34a4944e79e7
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
ID:0-preview.png
ID:0006
ID:0
ID:0-preview.png
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Characteristics
Malware Configuration - DcRat config.
Config. Field
 Value
Key (AES_256)

Z3lOQk9WR2NicmRheERGVzZPY3VjRjBpWmt6Z2VRREc=
Pastebin

-
Certificate

MIICMDCCAZmgAwIBAgIVAKAAD/SurGzixOhqLGBOobqogcoTMA0GCSqGSIb3DQEBDQUAMGQxFTATBgNVBAMMDERjUmF0IFNlcnZlcjETMBEGA1UECwwKcXdxZGFuY2h1bjEcMBoGA1UECgwTRGNSYXQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTI1MDczMDE2MDAzNFoXDTM2MDUwODE2MDAzNFowEDEOMAwGA1UEAwwFRGNSYXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAJygeMMS0Eky6soRjVpJncMJvGjNgnGiKLCBDMTmZBPuqoKlp/FJSfO1tkK80BgDAR7JPAo4kUq0Q67UzlLrMBI55WSZ42FqNch/8syD+YJnb4l9BDCfsiVfn0gxPqNohKwohtejFsMyzT7bVXjx8+MF1yehWgqbpzQLE9fX+3K3AgMBAAGjMjAwMB0GA1UdDgQWBBTkZtw3jYmWNyJBHmhQKHdLTEkuVzAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4GBAFujYCRjoUzFA6XMARCuvELNJ+9JInrUWdGSDHSzd58SkReUeDmuAPYaZVfnzexYDQ9rxa/UT6CX/nkMnZjXGdkStbkdKRb5FDT8BkvjLdyrqP8ES8K2qXngvdkSmfWz+bGQShb7Pj+y7eHEReJUkTnxu3E1tGItlMMZWP1fYCX8
ServerSignature

a1KXCUSCL/w4sGdLeUMPYLKCIJVoTgXDkOt+bTWD7+P+Ko14HxxZbe6CrU527agK7l4l8xeq8t1v5q/PSXWGHaAmEX2Xcc0aBeVbw5UWZQ6UXMvkS7dKq/ainpFeB3s7dVQkoIDcd7Nukq2PAS8G/daMRlcyCClBUgc289Ymsf8=
Install

true
BDOS

true
Anti-VM

false
Install File

UrbanVpn.exe
Install-Folder

%AppData%
Hosts

104.21.87.11,172.67.139.34,188.114.97.0,188.114.96.0,108.162.193.193,108.162.192.120,kalyanonlinematkaapp.in.net,server.kalyanonlinematkaapp.in.net,api.kalyanonlinematkaapp.in.net,email.kalyanonlinematkaapp.in.net,screenshot.kalyanonlinematkaapp.in.net
Ports

53,80,443,1604,8080
Mutex

UrbanVpn-gf6-sfk-as3k238-j3-2fuj
Version

1.0.7
Delay

1
Group

Setup
Artefacts
Name
 Value Location
Key (AES_256)

Z3lOQk9WR2NicmRheERGVzZPY3VjRjBpWmt6Z2VRREc=

Malicious

c153de0ecc7626bcb2fd34a4944e79e7
CnC

104.21.87.11

Malicious

c153de0ecc7626bcb2fd34a4944e79e7
CnC

172.67.139.34

Malicious

c153de0ecc7626bcb2fd34a4944e79e7
CnC

188.114.97.0

Malicious

c153de0ecc7626bcb2fd34a4944e79e7
CnC

188.114.96.0

Malicious

c153de0ecc7626bcb2fd34a4944e79e7
CnC

108.162.193.193

Malicious

c153de0ecc7626bcb2fd34a4944e79e7
CnC

108.162.192.120

Malicious

c153de0ecc7626bcb2fd34a4944e79e7
CnC

kalyanonlinematkaapp.in.net

Malicious

c153de0ecc7626bcb2fd34a4944e79e7
CnC

server.kalyanonlinematkaapp.in.net

Malicious

c153de0ecc7626bcb2fd34a4944e79e7
CnC

api.kalyanonlinematkaapp.in.net

Malicious

c153de0ecc7626bcb2fd34a4944e79e7
CnC

email.kalyanonlinematkaapp.in.net

Malicious

c153de0ecc7626bcb2fd34a4944e79e7
CnC

screenshot.kalyanonlinematkaapp.in.net

Malicious

c153de0ecc7626bcb2fd34a4944e79e7
Ports

53

Malicious

c153de0ecc7626bcb2fd34a4944e79e7
Ports

80

Malicious

c153de0ecc7626bcb2fd34a4944e79e7
Ports

443

Malicious

c153de0ecc7626bcb2fd34a4944e79e7
Ports

1604

Malicious

c153de0ecc7626bcb2fd34a4944e79e7
Ports

8080

Malicious

c153de0ecc7626bcb2fd34a4944e79e7
Mutex

UrbanVpn-gf6-sfk-as3k238-j3-2fuj

Malicious

c153de0ecc7626bcb2fd34a4944e79e7
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙