Malicious
Malicious

cb369d8917f97ef9f109b5d99530e43e

PE Executable
|
MD5: cb369d8917f97ef9f109b5d99530e43e
|
Size: 49.15 KB
|
application/x-dosexec

Print
Infection Chain
Summary by MalvaGPT
Characteristics

Symbol Obfuscation Score

Very high

Hash
 Hash Value
MD5
cb369d8917f97ef9f109b5d99530e43e
Sha1
c4a52c63908a1df3235c81fe1cd40f52214221bb
Sha256
017ba68aa41ff6416707ea9fe1482dc231a6c6e2740961f5107c88695e9c4362
Sha384
c4230856f8fd6e69e171d91eb7948c87bcb56629c86d0ee656290d58329bd208d1d86d2e69cad9197bb3ef41fd6ca9b1
Sha512
89a8b9a50c9275e5f4bc00cf1e9d4d087c02a50f5f9c57ace694dd62a5a1d8a9fb37c5aebb12380fa03438d2a66d86f7cd884c3ccd56eb454b7afb7cd2a79926
SSDeep
768:+uQKNTREhzxrWUXrm5mo2q7L5SynRxPIMMewb8F0bZOQGS3trUS+xfMBDZRr:+uQKNTR+W2InIM7wb8ybZeaZYfKdRr
TLSH
8F233C003BE9812BF27E4F74A9F32145867AF2673602D64E5CC441971A13FC6DA92AFD

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
cb369d8917f97ef9f109b5d99530e43e
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Malware Configuration - AsyncRAT config.
Config. Field
 Value
Key (AES_256)

UEliUjhQSktMVzJHRVZUVURrS2t6NERmeGJGWnBabXk=
Pastebin

-
Certificate

MIIE8jCCAtqgAwIBAgIQAO1NZlMTBmGEdOZgQbCTXTANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjYwNDAxMjMxMDM3WhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAJB3Zd11Tq7XCJnmEiqarWG38oEsssSuNZGx1HLmQH6loJK9JrFRdwwq6peOS4jXhMN8I7GvBB3TxdpuXH/GZt3/cvwdEAv/y/tCSX4NYR8lJ6JBZDbHdiuGq253TUsx2UUbqPKFneWNduCzoNgcLM7pBJvMtEmUBgOWnKqaNSV8G4gA3LtNfP1WOB1Wk+4YI5a3jr4dURQtvkfqfFVrZnFlUhuGtdIydL7/V5eLyFER+Mln/ZOpNraSmhoBR8twrFm0Nj5kpdR3MdWyNaUbyElR8VRObtdRu48R6ScjbAYjT8oajClpAYHrfMv+vUpspKQ+n+Jt34yA+tv13UIT5wFZiI7LDXq39oF+8uQwSGhPn1I5fWvY4bnG+fkMRo70ZgWbI3TwSIZPTnnE7K/d/XwM8EOwJ+QUPzueQJwMepvSvprVNuU2Vm/vHhQBeLhvxLD80795LwG9b44Ytf2AwSkC82tTROOGLZqrLzkW/jXpcDo9I7hwA7+tlcQ+tuqWkPIyUwyoMMJcNfXwfmwK2VCNdKo0QRvIF813b7MJ6+G0tUWA7r7A4NqqiNwwOdQbO4kNkiWSom85UEy66g5A6Gw0XcbJAcKfcbbZgteicd9s6ZuHscCSeJkHniMuJXlNgJ1Ggt7sWNMCWBTyfbC1/MxVnV+bNyXnqM35bjatxX9NAgMBAAGjMjAwMB0GA1UdDgQWBBTSaz2CiPHtQBwLMmOQstTOM4HXqzAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQCIaPHun/YjvxRNIhgJZ12eKXGrpfqfPSE24DNXnPSLwfzwRYno4mD1TgUKi6wIALIxBJsxik+UM7AE+iUrYORX5qinjWWTUggiwTclAnKGclKdlqNAc9WWUtrhtfFRDnsrnoRpRnmYzWKLPucscBEKL15IEJijlegb5ZbpMnr5aiQCWYqlLDYy57UysMRg8b1sKUKfoDAiqTQN7+KEazG49DDC6d1DWfecCNQD3m0TSHdLRgJIlYDpMCZYrY1f9an4ORa0gDRYHt5Y+UI9bJM/SNihiLzvhKhEPbWGCjm+sbeHS8KS+ws41ywM74AuOoEZ/IaxE1ypo9AAoy5DeBmEOkniL+1HQhI7T4VvPwHOedeLLX7P5c8vd9xGs7p5Jky78YO+4JSI358+Z7gY78R/X+GMytoTYbv6HCgJaIl9mNynPwmG4RNxw5eOmxKjyrL9R3F3rLeLB3qqR//QIFA2sZTb4/Ip0kP19KKCvaexp7ZLZ471sEJFw/nE3+TN3ocCcWli3PCFmXZ0nSKtPNMP4GzCmq93TtCrcyiWotUqqIKmNI9YwIOg/EUIHaC8KBp7OcOFfo05BbPJgHj3yM4tobw1x8NNP7fL4VDnwWpjDUGmJfRquO/hjNH+A8kVbnth+Yfl8LgPxDn3cfYgmLw5EAziFrtXv27KvsHkq2b5ZA==
ServerSignature

h5zoAaJoKf6c20YWmkd5G6vjOc2LTCC3yOshI+nlRL9FAZUOHPw83mUMBEDZaq8e1L4vr+sLhTR/9zOeg/SutDPMgoPj/RdTbzzxRWuo+tTkhaSlTxTFV/I4qwVExQTLTX5/Y3mYu2tbDCGYwJA6erwVFVVC1pAkh6gUrB+4Mf2bciDFSfNNtN2bI1NzolcFbezmc2Q5pSHR3iwvGvC2eXnSzwDoSUFE85J2otHLFyqePrsvDW9KxEgPnIBhmgM8mfOXzo9E863uormUoVSGAWTMDv9SOy7r8a6MgXl0UGYwr2k2+LGgl9HlFYoJwdyoA1mguBdxKmzxnah+2iI1ccOQyuj1EhW7VGh+MOhQ9ltv2pr734n/8IyXuj6crfYFO3jgmfhXew2UXZ0QrBf3W2GvxYJXZFh5XqsTVrd7KTHRgxHLYPIozRC+cWcBURCuB4RM/ocAuDN7R/P91sOQuYZ4+10lcUf32GMRRs95gwRLPqmsnvozmHfYI2jkjQKbvx5sjQatRKDYC09tbyypvWEGUjrpXnIXzkvTH4DN0dhPCJIxOa/GxVtjLKS6Q01Aj1Gp9tx7P+dHsdCsOk1BCagbcDbuBK5grFFw6sB0UVMxzQ3VOHS/7zTor2OjAgrM3bRag+0P12k+GrrRbdqM1YNEHB3Gp/NkhuKCzqsHzLU=
Install

true
BDOS

true
Anti-VM

true
Install File

Nurs.exe
Install-Folder

%AppData%
Hosts

127.0.0.1,f4lmbzwznn.localto.net
Ports

5778,6606,7707,8808
Mutex

kGm3YSEXT2U8
Version

0.5.8
Delay

3
Group

Default
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

owpYhKBSmwUeFe
Full Name

owpYhKBSmwUeFe
EntryPoint

System.Void nPijBvcyLjudw.lnqgJZixyfnn::Main()
Scope Name

owpYhKBSmwUeFe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

AsyncaaClient
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

120
Main Method

System.Void nPijBvcyLjudw.lnqgJZixyfnn::Main()
Main IL Instruction Count

51
Main IL

ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String nPijBvcyLjudw.sIFpWFmTlYvjMmJ::FeUMYUwPYTxTFr call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean nPijBvcyLjudw.sIFpWFmTlYvjMmJ::jipvSzjIdKsuD() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean iAFwxiLlHopg.ZySTHNFvbUMCKGkT::YPOtTMKoRy() brtrue IL_0043: ldsfld System.String nPijBvcyLjudw.sIFpWFmTlYvjMmJ::nTAnMBsimB ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String nPijBvcyLjudw.sIFpWFmTlYvjMmJ::nTAnMBsimB call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String nPijBvcyLjudw.sIFpWFmTlYvjMmJ::ZgCmNrdiEW call System.Void iAFwxiLlHopg.whrTkAZjibzQ::XryxdetpxnGmbM() ldsfld System.String nPijBvcyLjudw.sIFpWFmTlYvjMmJ::ZgCmNrdiEW call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String nPijBvcyLjudw.sIFpWFmTlYvjMmJ::PEmznorrwMLzGqix call System.Void oUPrhAPlMgAR.deuaiOKTydF::DbtaCblykABU() ldsfld System.String nPijBvcyLjudw.sIFpWFmTlYvjMmJ::PEmznorrwMLzGqix call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void iAFwxiLlHopg.LkbxcpUBDDh::HDCsYZkWFYOxQf() call System.Boolean iAFwxiLlHopg.LkbxcpUBDDh::gvozeTkoTgvUpXt() brfalse IL_0089: call System.Void iAFwxiLlHopg.LkbxcpUBDDh::HDCsYZkWFYOxQf() call System.Void iAFwxiLlHopg.VPjVtYnPEMQt::DXoNRIjzgtu() call System.Void iAFwxiLlHopg.LkbxcpUBDDh::HDCsYZkWFYOxQf() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean GESdoftNEfj.kdNdtrOVjhpg::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void GESdoftNEfj.kdNdtrOVjhpg::ZgMUAajFcdk() call System.Void GESdoftNEfj.kdNdtrOVjhpg::AsqsUilWNZpM() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Module Name

owpYhKBSmwUeFe
Full Name

owpYhKBSmwUeFe
EntryPoint

System.Void nPijBvcyLjudw.lnqgJZixyfnn::Main()
Scope Name

owpYhKBSmwUeFe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

AsyncaaClient
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

120
Main Method

System.Void nPijBvcyLjudw.lnqgJZixyfnn::Main()
Main IL Instruction Count

51
Main IL

ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String nPijBvcyLjudw.sIFpWFmTlYvjMmJ::FeUMYUwPYTxTFr call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean nPijBvcyLjudw.sIFpWFmTlYvjMmJ::jipvSzjIdKsuD() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean iAFwxiLlHopg.ZySTHNFvbUMCKGkT::YPOtTMKoRy() brtrue IL_0043: ldsfld System.String nPijBvcyLjudw.sIFpWFmTlYvjMmJ::nTAnMBsimB ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String nPijBvcyLjudw.sIFpWFmTlYvjMmJ::nTAnMBsimB call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String nPijBvcyLjudw.sIFpWFmTlYvjMmJ::ZgCmNrdiEW call System.Void iAFwxiLlHopg.whrTkAZjibzQ::XryxdetpxnGmbM() ldsfld System.String nPijBvcyLjudw.sIFpWFmTlYvjMmJ::ZgCmNrdiEW call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String nPijBvcyLjudw.sIFpWFmTlYvjMmJ::PEmznorrwMLzGqix call System.Void oUPrhAPlMgAR.deuaiOKTydF::DbtaCblykABU() ldsfld System.String nPijBvcyLjudw.sIFpWFmTlYvjMmJ::PEmznorrwMLzGqix call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void iAFwxiLlHopg.LkbxcpUBDDh::HDCsYZkWFYOxQf() call System.Boolean iAFwxiLlHopg.LkbxcpUBDDh::gvozeTkoTgvUpXt() brfalse IL_0089: call System.Void iAFwxiLlHopg.LkbxcpUBDDh::HDCsYZkWFYOxQf() call System.Void iAFwxiLlHopg.VPjVtYnPEMQt::DXoNRIjzgtu() call System.Void iAFwxiLlHopg.LkbxcpUBDDh::HDCsYZkWFYOxQf() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean GESdoftNEfj.kdNdtrOVjhpg::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void GESdoftNEfj.kdNdtrOVjhpg::ZgMUAajFcdk() call System.Void GESdoftNEfj.kdNdtrOVjhpg::AsqsUilWNZpM() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Artefacts
Name
 Value
Key (AES_256)

UEliUjhQSktMVzJHRVZUVURrS2t6NERmeGJGWnBabXk=
CnC

127.0.0.1
CnC

f4lmbzwznn.localto.net
Ports

5778
Ports

6606
Ports

7707
Ports

8808
Mutex

kGm3YSEXT2U8
cb369d8917f97ef9f109b5d99530e43e (49.15 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙