cb369d8917f97ef9f109b5d99530e43e

PE Executable
|
MD5: cb369d8917f97ef9f109b5d99530e43e
|
Size: 49.15 KB
|
application/x-dosexec

Infection Chain

Summary by MalvaGPT

Characteristics

Hash	Hash Value
MD5	cb369d8917f97ef9f109b5d99530e43e
Sha1	c4a52c63908a1df3235c81fe1cd40f52214221bb
Sha256	017ba68aa41ff6416707ea9fe1482dc231a6c6e2740961f5107c88695e9c4362
Sha384	c4230856f8fd6e69e171d91eb7948c87bcb56629c86d0ee656290d58329bd208d1d86d2e69cad9197bb3ef41fd6ca9b1
Sha512	89a8b9a50c9275e5f4bc00cf1e9d4d087c02a50f5f9c57ace694dd62a5a1d8a9fb37c5aebb12380fa03438d2a66d86f7cd884c3ccd56eb454b7afb7cd2a79926
SSDeep	768:+uQKNTREhzxrWUXrm5mo2q7L5SynRxPIMMewb8F0bZOQGS3trUS+xfMBDZRr:+uQKNTR+W2InIM7wb8ybZeaZYfKdRr
TLSH	8F233C003BE9812BF27E4F74A9F32145867AF2673602D64E5CC441971A13FC6DA92AFD

PeID

.NET executable

Microsoft Visual C# / Basic .NET

Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL

Microsoft Visual C# v7.0 / Basic .NET

Microsoft Visual Studio .NET

File Structure

Malware Configuration - AsyncRAT config.

Config. Field0	Value
Key (AES_256)	UEliUjhQSktMVzJHRVZUVURrS2t6NERmeGJGWnBabXk=
Pastebin	-
Certificate	MIIE8jCCAtqgAwIBAgIQAO1NZlMTBmGEdOZgQbCTXTANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjYwNDAxMjMxMDM3WhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAJB3Zd11Tq7XCJnmEiqarWG38oEsssSuNZGx1HLmQH6loJK9JrFRdwwq6peOS4jXhMN8I7GvBB3TxdpuXH/GZt3/cvwdEAv/y/tCSX4NYR8lJ6JBZDbHdiuGq253TUsx2UUbqPKFneWNduCzoNgcLM7pBJvMtEmUBgOWnKqaNSV8G4gA3LtNfP1WOB1Wk+4YI5a3jr4dURQtvkfqfFVrZnFlUhuGtdIydL7/V5eLyFER+Mln/ZOpNraSmhoBR8twrFm0Nj5kpdR3MdWyNaUbyElR8VRObtdRu48R6ScjbAYjT8oajClpAYHrfMv+vUpspKQ+n+Jt34yA+tv13UIT5wFZiI7LDXq39oF+8uQwSGhPn1I5fWvY4bnG+fkMRo70ZgWbI3TwSIZPTnnE7K/d/XwM8EOwJ+QUPzueQJwMepvSvprVNuU2Vm/vHhQBeLhvxLD80795LwG9b44Ytf2AwSkC82tTROOGLZqrLzkW/jXpcDo9I7hwA7+tlcQ+tuqWkPIyUwyoMMJcNfXwfmwK2VCNdKo0QRvIF813b7MJ6+G0tUWA7r7A4NqqiNwwOdQbO4kNkiWSom85UEy66g5A6Gw0XcbJAcKfcbbZgteicd9s6ZuHscCSeJkHniMuJXlNgJ1Ggt7sWNMCWBTyfbC1/MxVnV+bNyXnqM35bjatxX9NAgMBAAGjMjAwMB0GA1UdDgQWBBTSaz2CiPHtQBwLMmOQstTOM4HXqzAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQCIaPHun/YjvxRNIhgJZ12eKXGrpfqfPSE24DNXnPSLwfzwRYno4mD1TgUKi6wIALIxBJsxik+UM7AE+iUrYORX5qinjWWTUggiwTclAnKGclKdlqNAc9WWUtrhtfFRDnsrnoRpRnmYzWKLPucscBEKL15IEJijlegb5ZbpMnr5aiQCWYqlLDYy57UysMRg8b1sKUKfoDAiqTQN7+KEazG49DDC6d1DWfecCNQD3m0TSHdLRgJIlYDpMCZYrY1f9an4ORa0gDRYHt5Y+UI9bJM/SNihiLzvhKhEPbWGCjm+sbeHS8KS+ws41ywM74AuOoEZ/IaxE1ypo9AAoy5DeBmEOkniL+1HQhI7T4VvPwHOedeLLX7P5c8vd9xGs7p5Jky78YO+4JSI358+Z7gY78R/X+GMytoTYbv6HCgJaIl9mNynPwmG4RNxw5eOmxKjyrL9R3F3rLeLB3qqR//QIFA2sZTb4/Ip0kP19KKCvaexp7ZLZ471sEJFw/nE3+TN3ocCcWli3PCFmXZ0nSKtPNMP4GzCmq93TtCrcyiWotUqqIKmNI9YwIOg/EUIHaC8KBp7OcOFfo05BbPJgHj3yM4tobw1x8NNP7fL4VDnwWpjDUGmJfRquO/hjNH+A8kVbnth+Yfl8LgPxDn3cfYgmLw5EAziFrtXv27KvsHkq2b5ZA==
ServerSignature	h5zoAaJoKf6c20YWmkd5G6vjOc2LTCC3yOshI+nlRL9FAZUOHPw83mUMBEDZaq8e1L4vr+sLhTR/9zOeg/SutDPMgoPj/RdTbzzxRWuo+tTkhaSlTxTFV/I4qwVExQTLTX5/Y3mYu2tbDCGYwJA6erwVFVVC1pAkh6gUrB+4Mf2bciDFSfNNtN2bI1NzolcFbezmc2Q5pSHR3iwvGvC2eXnSzwDoSUFE85J2otHLFyqePrsvDW9KxEgPnIBhmgM8mfOXzo9E863uormUoVSGAWTMDv9SOy7r8a6MgXl0UGYwr2k2+LGgl9HlFYoJwdyoA1mguBdxKmzxnah+2iI1ccOQyuj1EhW7VGh+MOhQ9ltv2pr734n/8IyXuj6crfYFO3jgmfhXew2UXZ0QrBf3W2GvxYJXZFh5XqsTVrd7KTHRgxHLYPIozRC+cWcBURCuB4RM/ocAuDN7R/P91sOQuYZ4+10lcUf32GMRRs95gwRLPqmsnvozmHfYI2jkjQKbvx5sjQatRKDYC09tbyypvWEGUjrpXnIXzkvTH4DN0dhPCJIxOa/GxVtjLKS6Q01Aj1Gp9tx7P+dHsdCsOk1BCagbcDbuBK5grFFw6sB0UVMxzQ3VOHS/7zTor2OjAgrM3bRag+0P12k+GrrRbdqM1YNEHB3Gp/NkhuKCzqsHzLU=
Install	true
BDOS	true
Anti-VM	true
Install File	Nurs.exe
Install-Folder	%AppData%
Hosts	127.0.0.1,f4lmbzwznn.localto.net
Ports	5778,6606,7707,8808
Mutex	kGm3YSEXT2U8
Version	0.5.8
Delay	3
Group	Default

Informations

Name0	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	owpYhKBSmwUeFe
Full Name	owpYhKBSmwUeFe
EntryPoint	System.Void nPijBvcyLjudw.lnqgJZixyfnn::Main()
Scope Name	owpYhKBSmwUeFe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	AsyncaaClient
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	120
Main Method	System.Void nPijBvcyLjudw.lnqgJZixyfnn::Main()
Main IL Instruction Count	51
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String nPijBvcyLjudw.sIFpWFmTlYvjMmJ::FeUMYUwPYTxTFr call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean nPijBvcyLjudw.sIFpWFmTlYvjMmJ::jipvSzjIdKsuD() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean iAFwxiLlHopg.ZySTHNFvbUMCKGkT::YPOtTMKoRy() brtrue IL_0043: ldsfld System.String nPijBvcyLjudw.sIFpWFmTlYvjMmJ::nTAnMBsimB ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String nPijBvcyLjudw.sIFpWFmTlYvjMmJ::nTAnMBsimB call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String nPijBvcyLjudw.sIFpWFmTlYvjMmJ::ZgCmNrdiEW call System.Void iAFwxiLlHopg.whrTkAZjibzQ::XryxdetpxnGmbM() ldsfld System.String nPijBvcyLjudw.sIFpWFmTlYvjMmJ::ZgCmNrdiEW call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String nPijBvcyLjudw.sIFpWFmTlYvjMmJ::PEmznorrwMLzGqix call System.Void oUPrhAPlMgAR.deuaiOKTydF::DbtaCblykABU() ldsfld System.String nPijBvcyLjudw.sIFpWFmTlYvjMmJ::PEmznorrwMLzGqix call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void iAFwxiLlHopg.LkbxcpUBDDh::HDCsYZkWFYOxQf() call System.Boolean iAFwxiLlHopg.LkbxcpUBDDh::gvozeTkoTgvUpXt() brfalse IL_0089: call System.Void iAFwxiLlHopg.LkbxcpUBDDh::HDCsYZkWFYOxQf() call System.Void iAFwxiLlHopg.VPjVtYnPEMQt::DXoNRIjzgtu() call System.Void iAFwxiLlHopg.LkbxcpUBDDh::HDCsYZkWFYOxQf() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean GESdoftNEfj.kdNdtrOVjhpg::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void GESdoftNEfj.kdNdtrOVjhpg::ZgMUAajFcdk() call System.Void GESdoftNEfj.kdNdtrOVjhpg::AsqsUilWNZpM() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Module Name	owpYhKBSmwUeFe
Full Name	owpYhKBSmwUeFe
EntryPoint	System.Void nPijBvcyLjudw.lnqgJZixyfnn::Main()
Scope Name	owpYhKBSmwUeFe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	AsyncaaClient
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	120
Main Method	System.Void nPijBvcyLjudw.lnqgJZixyfnn::Main()
Main IL Instruction Count	51
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String nPijBvcyLjudw.sIFpWFmTlYvjMmJ::FeUMYUwPYTxTFr call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean nPijBvcyLjudw.sIFpWFmTlYvjMmJ::jipvSzjIdKsuD() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean iAFwxiLlHopg.ZySTHNFvbUMCKGkT::YPOtTMKoRy() brtrue IL_0043: ldsfld System.String nPijBvcyLjudw.sIFpWFmTlYvjMmJ::nTAnMBsimB ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String nPijBvcyLjudw.sIFpWFmTlYvjMmJ::nTAnMBsimB call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String nPijBvcyLjudw.sIFpWFmTlYvjMmJ::ZgCmNrdiEW call System.Void iAFwxiLlHopg.whrTkAZjibzQ::XryxdetpxnGmbM() ldsfld System.String nPijBvcyLjudw.sIFpWFmTlYvjMmJ::ZgCmNrdiEW call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String nPijBvcyLjudw.sIFpWFmTlYvjMmJ::PEmznorrwMLzGqix call System.Void oUPrhAPlMgAR.deuaiOKTydF::DbtaCblykABU() ldsfld System.String nPijBvcyLjudw.sIFpWFmTlYvjMmJ::PEmznorrwMLzGqix call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void iAFwxiLlHopg.LkbxcpUBDDh::HDCsYZkWFYOxQf() call System.Boolean iAFwxiLlHopg.LkbxcpUBDDh::gvozeTkoTgvUpXt() brfalse IL_0089: call System.Void iAFwxiLlHopg.LkbxcpUBDDh::HDCsYZkWFYOxQf() call System.Void iAFwxiLlHopg.VPjVtYnPEMQt::DXoNRIjzgtu() call System.Void iAFwxiLlHopg.LkbxcpUBDDh::HDCsYZkWFYOxQf() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean GESdoftNEfj.kdNdtrOVjhpg::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void GESdoftNEfj.kdNdtrOVjhpg::ZgMUAajFcdk() call System.Void GESdoftNEfj.kdNdtrOVjhpg::AsqsUilWNZpM() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop

Artefacts

Name0	Value
Key (AES_256)	UEliUjhQSktMVzJHRVZUVURrS2t6NERmeGJGWnBabXk=
CnC	127.0.0.1
CnC	f4lmbzwznn.localto.net
Ports	5778
Ports	6606
Ports	7707
Ports	8808
Mutex	kGm3YSEXT2U8

cb369d8917f97ef9f109b5d99530e43e (49.15 KB)