Malicious
Malicious

d1ecbcbae1ba214c0d5ae1b2edba55fd

PE Executable
|
MD5: d1ecbcbae1ba214c0d5ae1b2edba55fd
|
Size: 77.82 KB
|
application/x-dosexec

Print
Infection Chain
Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

High

Hash
 Hash Value
MD5
d1ecbcbae1ba214c0d5ae1b2edba55fd
Sha1
c5a85181d8985fba60485dad1e5d8f78046315c8
Sha256
432be80b43a6e63fdbfe7487d2bd2dbba90281c03fc95a15fcac91f1f2f7c589
Sha384
c256201c769c91377f44a773171486dafe6f6fdcc3ba0331bc2b9b20288de68033775d52ed1d968bcf540c4958f03cc4
Sha512
4977a621e7bf7dd299bc5876d25d4e0aadaaf3a3a6af24d767c39aea75cf28f12770187217f49a83a3d9de639113a1c3e66fddf98cb092ced7db6c792486d563
SSDeep
768:xDJ6dbYT5PG1q5+nCMI0boPaVr572GxXGmdxfsRNa0GY4JsiTBincnAGEaDDp5BH:xdH0MJaSaVr59502pinKAGXDpTk97JG
TLSH
1D734B18BBEBC522D1AD9A7984E113050375E7573603DB5F2CC803A94F23BC79F46A9A

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
d1ecbcbae1ba214c0d5ae1b2edba55fd
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
b0494a1f-4bd3-sFuO8sRWF2aQfulVj78LmA==
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Client.g.resources
aR3nbf8dQp2feLmk31.lSfgApatkdxsVcGcrktoFd.resources
$this.Icon
[NBF]root.IconData
progressBar1.Modifiers
$this.Language
$this.GridSize
Malware Configuration - AsyncRAT config.
Config. Field
 Value
Key (AES_256)

OXZaVXlUdWJjaXRETG9qUTFHT1pzRWJZZHh6ZGhwYjk=
Pastebin

-
Certificate

MIIE8jCCAtqgAwIBAgIQAKxLlAkF1WRT8tAExBlQyzANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjIwOTIwMTQyNzUwWhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKrrWexesJSLqGeYC6kTxL6e4fbMdbCF6T1opNgSYFlyavRm733h8x2GXmzipr8dl/UHWmWcPmk8g2zwjmE7GxoR1aZvC706J8/1cezY8r/KN3wk63Og1nfs4IBpiAAS1FiZYe5mIVFU4np9SfOmuY/FdcCEd8OUu7UbHl28KhuwIMDKtBn2K/rCw9CIzH/KBD4ll1OszTjzf9NLX5bBhz42/lRQE3fvO2gHrewjgy99RFWXdo4YLOZiJqDSQLBMtVezMBTFgGGNeRMzAnwNFyl5/8h0T2GtcdqGhwOTYTQR+Rsj02iuogScF7rgqwrBr5uYxYrZoI36ewAdl2wN1JklGJRx11puu0hDRzCjrFE0CxXcVtdrIztzChIltYHZBKZyxRiZXGmvpZzPIzjCEO3ChXJTBdYqQP2aOQSBVEliDXuxuBNS11uRB1A/D6TQOAy0TWigbjfniDKBvzeSr3dnQxyjH6srvuGD6DFONwba7CVaKadGrmxreDm8vucoUYpaJ4cjOK+ouqQrG7btjHfDhc4MtgSSwR72/Me97QQ0Uybis0q0/im9hhKxZr6I0jhZglfZ/ouZiTjvPsT38azYeUXVo4uYmcbJ3RPTNVv9xwc3DPkFsMkRmDXCp2UWlGVSb7ZjeRz36kW7fnIiQbN2cG5levzLVAWtOjFwjr3/AgMBAAGjMjAwMB0GA1UdDgQWBBRnnpfEE8/fplVj0LmNEhbg781l4TAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQBYfqUFr9Bld91t6lqV5NrngVezAFI4ZBHTDxhyvkrPQZhVxCvGVhOl5WqtmkUrdkUQbs+BS3rm1BBi2c5F4cC5f02v4lehtsM+EXifLaAU5DCE0WQ+/5CCEBh5VZ5dWoszKSIJFZFzktODyhLHwix/SgNcQ7k4+NtAjb6LTg0rSzcDfttAHcgKTCHpIYxR4FdbEAJ0iwBK1w2oBj/aVm9/nW8mQlzTAIyeEIBcfAL95asjkTOj/MrTElXz09nulfPrVSElidHMHsMXMnn7VZKM5rzhpA/zwV/NGYV6U8f9pF+bwZ1ubJKANo0CbkxCMO6BzMwBj+5pdhVCi9Sl6wg9QyYI5RuICLN03MNGEU0G0tVLkMiE3uzx7/evyrTguZJaAOiTmcSrdoToTCpS7znuLwCRyCNMCu0iUxCxbVE27IRxtOJBtVYqUD2Na8ZjaJQPQ5T+afCaeorSXHPX+/TKaqJqPALKVjNt8D6iYPmUXGZy2ED5YxV+QxFi3kibZe3QmR8MnJJs82mz5Tj0czZoZCnEIhm3bRG2BOSXmtwEC1raIXlgYbxmYr4FGYeUBDPL+sDr38YZ3fW2kRvpxocsUrmzYEbqRr3oLFppdKQIbTFNmdtBXOtEfqj8XcERQ4VA3qtOrDFulsAp7lWtoW6Cw6iCcO/1UWkCk6yC0jqdJA==
ServerSignature

hwenOLeNlVPn+lF4z0H7GiJmnEzcIa34JRh/IIWy+PQtrPEv9LwFyNYXyCUoFPi4LuFfPM9bvA6bkfzsF4nqAeScXDfXa1S2THFeYPYktEeG0FaKAJOo5gNIhj87BixVTsXfEGwYca3grB4gsk4an37f2AeB3irZxX47rrdZlvB1RVek+cRu3jRHptf1uGl6pK1Q/70RcxmtKN5YbOQnkC+8/DRRGM4RW5k5FhFz8lveRfzNdeRTKDWoF1JksFnsYYCmqsKoBmPVPzGGulb6f30IWo+zefyqgHDdFP8MuEvvNB08ZlsU6RuRudWVupU+WjjEfg+CS8xNh7LS6MPiTi4kVwPRMcrMlPQY9o+HJWt8jkALpTcZDBa2npijCxoFSqlXMeeWzoiGkRhLiOrL2q6tf3mUgS9CYXkDEO/Vc97XRFPnvU2i5ziatFoFSp2LsMWn4HxKLVwHQ/411X2nuNDoih6E0ZVmTu9r7qRWLjVwALrxT6j5z6zCAfB8JV3jaY0CbQdJicNoh53l1EJSNIF3wJMwQrMI74LSYVk0epISnSVDh3fvVO5AhfepUD8Dn0E/FhSTX7QdJRdj567zQWIJmvwf8CO3+FykxmaIUyNIATH9GLEc311xZQIYHavwXJli6xParVihyguUVfz+O8XIKrnuaEas
Install

false
BDOS

false
Anti-VM

false
Install-Folder

%AppData%
Version

0.5.7B
Hosts

franciamarquez202520252025.duckd
Ports

3011
Mutex

AsyncMutex_6S8Ok
Delay

3
Group

Ragst02
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

Raagts03.exe
Full Name

Raagts03.exe
EntryPoint

System.Void <PrivateImplementationDetails>{C9D51624-7BE3-4530-BBD7-5A7744545664}::Main()
Scope Name

Raagts03.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Raagts03
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0
Total Strings

135
Main Method

System.Void <PrivateImplementationDetails>{C9D51624-7BE3-4530-BBD7-5A7744545664}::Main()
Main IL Instruction Count

3
Main IL

call System.Void hyBi4B7CHOZ0PcM2da.BrEOWILUFmZ9AtRTw7::lLHifFIsCLsZtjvFfN0i() call System.Void Client.Program::Main() ret <null>
Module Name

Raagts03.exe
Full Name

Raagts03.exe
EntryPoint

System.Void <PrivateImplementationDetails>{C9D51624-7BE3-4530-BBD7-5A7744545664}::Main()
Scope Name

Raagts03.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Raagts03
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0
Total Strings

135
Main Method

System.Void <PrivateImplementationDetails>{C9D51624-7BE3-4530-BBD7-5A7744545664}::Main()
Main IL Instruction Count

3
Main IL

call System.Void hyBi4B7CHOZ0PcM2da.BrEOWILUFmZ9AtRTw7::lLHifFIsCLsZtjvFfN0i() call System.Void Client.Program::Main() ret <null>
Artefacts
Name
 Value
Key (AES_256)

OXZaVXlUdWJjaXRETG9qUTFHT1pzRWJZZHh6ZGhwYjk=
CnC

franciamarquez202520252025.duckd
Ports

3011
Mutex

AsyncMutex_6S8Ok
d1ecbcbae1ba214c0d5ae1b2edba55fd (77.82 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙