Malicious
Malicious

caddb0373a774aba2ea986ef20fadc76

PE Executable
|
MD5: caddb0373a774aba2ea986ef20fadc76
|
Size: 114.18 KB
|
application/x-dosexec

Print
Infection Chain
Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Low

Hash
 Hash Value
MD5
caddb0373a774aba2ea986ef20fadc76
Sha1
62e04355a9feba397bbd99a63a3f203dbc0c3db9
Sha256
ce29924b9532734df50b9db292acf5ba4d0a66f6914765e11ba9a272ca5585d9
Sha384
f257eff605b1e07b9a3821ebe026572e851a042dd0c0d0a655d92590fa3be58d814679cbe52aa6686b5038bc4e65cb6c
Sha512
64046a10a66ceeb59934a89764ec41adf47f5598e02a25dbe35c642bde2449931ea321662a31d14815c63283b0e26238d927bdd063116f5ea28e276d34dd696d
SSDeep
1536:Ru8U1TPJnG2xsp4AwtbtXSpbH3SakakdvPEKo9p9:Ru8gTBnG2i4Awtbtij3SaAlEKo9p9
TLSH
7BB39F802E44C316F3793AB4C76157440F27AF76EB11BD4E7A4333699A3AEC199027A7

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
caddb0373a774aba2ea986ef20fadc76
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Malware Configuration - AsyncRAT config.
Config. Field
 Value
Key (AES_256)

bkpzQmFDU3VTaWk5YnFxM0s5bzlCTndtMmw1T01RZjY=
Pastebin

-
Certificate

MIIE8jCCAtqgAwIBAgIQAP9cLe67+VowhOj8MgBV+zANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjUxMjEzMTQyNzU4WhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAPh7MjtP68LnCtAe6l9Ll8KGwsA/isGjPeGd8kYkd81TTiB5QM/OL1cgIdOH0FiTdZmGMTW2ezjh8N1zvxtlP0BR73iMSSfqone7x5GquDg+48Mob9dWxhthDQ8eADsHbW0iPten44RuYrwU9ByhMzJ7YQkBvHbEMsj6tG2LF/nMCEBWVSp0Bo90Uy1ynkBspRl2gH+jovSGrl6JX7yJ9mgbP798lVHwV00LqIYj2PAs1jaTaJbeZbBMTK4PHpaEUKP/HKfaPoJpXGqVXQklwsyXAWzjBMB4h1rrKh1sNDsk2qvqT2Hv3cMwVx8a5sSFkWJYeJBcRVsaTTygtL40rvQ5j2XpmMbCPMZhKNmLkX7kj5mIaPUkiFw/88EHrnXXcLinPwD2OsDpUvHzZ/Vat+OQEKjY1FKPzKt1bj6FWjY5rkpVEcqjdMl2dZvFMupHOW6UxWvorkmBYy3h09sLNUIpa1TGJT0GyVKpuEe4ULEpcpi5scBZ5t15dReeb7zrCNBTACBAhskUBhX8u6MFbv6Eju+jIJxp7b0BGP9Rv/UC0pHx3DLSd1q8iDf1XIhM/HpuGHnjS8kzGt6MNAnKulgGy1c5/c2BqIdB7YlzNOGfUa3DsbNO/fmDRjrIy3QtiKO0bbDgueHZQEGusoi0vULLVd3dBkPHV3wHOTtv7RCfAgMBAAGjMjAwMB0GA1UdDgQWBBQldYjHMtxLyuSbhhNIph5Orfi0cDAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQAaNtsUa4SUlb7lsw8Esc4D9a7vHAgTe0ttd3z1rbtz3eYvDE/nEoNDRGvbWsk2NU8LFM3CedjPd/SFkWLCAj/3CYSc5K6VBhiM8dd46Auda/Dw0vA6hiJUrZdvP3lEPAmjuFXjE189VtGxqFOAZGr8WmyCvpxCOUByg+CgUOeZTm6DNgTj/7MyiK9nTfaJw2mySHvVWBltJpUF0vl6uT0VQeaCRbq5t47EzN5ob/GVGV1DDSSMIl2K14L1Vwhh50kbAVt3Z5q4EuZZSeWskjS1KvAkkSMKw8ssK0MQklzelVIpq9fppUAyHzmHh4YvG12KSlH5P/bLf18PduCEY/3ls+/y+w66WLiNz9/p8MyUcSFodVq39qz6HdJDBJ8l1sGp6DOAVoKhIrEIf+g0EkfKICCPWhawYCumqH9my+NEaKoEKOGL/knNEYHl02lL27++GEl8gPhE+9cJtlA2TCovT3jiY90g1B+dwgHPNH8DkHdTC2Mj8V2cTqCZPtSDyDuSp1VJcoPMrnHr3wh0xJ/ZwWCJLNIH2G19iH4r/UzjkrgVEbEl7tV+H/nym2PtK4xHbflbaLYePTNqRTU93tebcN+yypfs6xJZCN05R/ATgbJg/8db/MwK9vpEpRvooI4DvfqhAVvHMAX0kXiGdG6mD9DOhp205Og/YvMqwr5ggQ==
ServerSignature

gp7BSmtDiFmtAoG4o2pWnXa1GcpWakjgOd6Hv0rXfkMRUm37zoo5QZBmixbTS+MVDw6+3S3YuwDty1HDOiOIg8YZKgqELXwgslqabo2h3zIlR6S/Jzxi7obViZtIaJP4GCvCNvHqI3Xm1DRMUHq9Hujqnj8A6D34zUujCuYy8rREo8LZGJ7E8Snzg26IwwIWz8ph5UwW33ua+1UHuZg4/QwY7SQ5o0esTJdQgumC07I/Z934uAWr12XrpoRSdyoly4YlbJ0zBEkJQAvu3IUmkiWZ9kd6MvfxBsLU8GU84Tc3LgdVjC1yV6cGyqAl3cQcLr1HZrJEhNaSl78IYq9DdV73bxgudfKECx/iw9xSZByIDWLcbImdE/oAZmidXR6bRefnFym50ryzDjQ6O644WRJmmc4mCi8iYJxdiq/Zr7i2VNFz8GKBQKKeq5ylTbyFXIYmc06VHInE/4bRVvFrTKOI2BpUhqjQ2XUZd9Gbaj3vQD+2V9ylnQDErR2QdmREpsFYemJFqK5fcVp8sIUFUEFVQf3rHVP4mKEw3H1s3X9bUK9U3Htz3L9HGf1wrJYEAO5tx0u0wypzJNrgdHKrlqugq6QVZL9MdtpqQWNsMNXnqftjQXOaCmqgUTmOgKNaJh/YjGbqVAL3hFsxzzq0THVEyK4wB0uU
Install

true
BDOS

false
Anti-VM

true
Install File

safe_guard.exe
Install-Folder

%AppData%
Ports

80,443,8080,8848
Mutex

8NrnDsdGnscA
Version

0.5.8
Delay

3
Group

Default
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

safeguard.exe
Full Name

safeguard.exe
EntryPoint

System.Void Client.Program::Main()
Scope Name

safeguard.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

safeguard
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

120
Main Method

System.Void Client.Program::Main()
Main IL Instruction Count

51
Main IL

ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0043: ldsfld System.String Client.Settings::Anti ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String Client.Settings::Install call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() ldsfld System.String Client.Settings::Install call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BDOS call System.Void Client.Install.NormalStartup::Install() ldsfld System.String Client.Settings::BDOS call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.ProcessCritical::Set() call System.Void Client.Helper.Methods::PreventSleep() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Module Name

safeguard.exe
Full Name

safeguard.exe
EntryPoint

System.Void Client.Program::Main()
Scope Name

safeguard.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

safeguard
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

120
Main Method

System.Void Client.Program::Main()
Main IL Instruction Count

51
Main IL

ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0043: ldsfld System.String Client.Settings::Anti ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String Client.Settings::Install call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() ldsfld System.String Client.Settings::Install call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BDOS call System.Void Client.Install.NormalStartup::Install() ldsfld System.String Client.Settings::BDOS call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.ProcessCritical::Set() call System.Void Client.Helper.Methods::PreventSleep() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Artefacts
Name
 Value
Key (AES_256)

bkpzQmFDU3VTaWk5YnFxM0s5bzlCTndtMmw1T01RZjY=
Ports

80
Ports

443
Ports

8080
Ports

8848
Mutex

8NrnDsdGnscA
caddb0373a774aba2ea986ef20fadc76 (114.18 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙