Malicious
Malicious

d6c1328728e411166d7613d52c4ae618

PE Executable
MD5: d6c1328728e411166d7613d52c4ae618
Size: 46.08 KB
application/x-dosexec
Summary by MalvaGPT
Characteristics

Symbol Obfuscation Score

Low

Hash
 Hash Value
MD5
d6c1328728e411166d7613d52c4ae618
Sha1
4d7503e11abc7fd2995a30dfa9bbf52d58ebb7a7
Sha256
53efaffb26ff1a404c68e769b402cfd492fe6bfbc13c82ee0bc82ae78969295c
Sha384
f42b58447569cfeaf050deee156ae150a519b122f929a2d2af6ce9fdd9842eb09235a6803623a89a0a948c06b917a2bb
Sha512
b180771885d388966261e090c640f961c707bfff57a0fd711016a66f5a3dc904dd20ef4c2e9dd8111b68c249e965d2c51bcefee15032811f85cfea6dd86d0968
SSDeep
768:Nunn5TgoqzqWU8d9rmo2qrcOjPGagAWOzjbFgX3iwHoUT9kdKXgH+72cDZLf+:Nunn5TgNR2dOTKTO3bCXS3UTEKq+7Zd6
TLSH
BF231B003BE98227F2BE5FB89CF26145457AF1A32603D54E1CC452DB5613FC69A426FE

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
d6c1328728e411166d7613d52c4ae618
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Malware Configuration - AsyncRAT config.
Config. Field
 Value
Key (AES_256)

bXB0R01xYzZRU2dDNVc4eU9DaGlmbEtZbVdUVGxjSVY=
Pastebin

-
Certificate

MIIE8jCCAtqgAwIBAgIQAIHNt4dWr2fpH2x/27PM2zANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjYwNDE1MDIyMTEzWhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAI5RSo2nQ/y8B1I6onJTmKF0s9F5YMYJaWxfwzkmur66I2wGXoPn3/7ZacJQYPoDV+zxNcn+xihQRxvw6Kcu8U7OBPvwU1ji6rpmKyQD9JLfDeB8y7Ahi96jikNdv3P/D/nczFhTsMSqe7ZaFuGYnewtXQEoVSvL5uiczK9GvjJ175dksaKN2fmKLQVguNUTFWqa6YZMPt5l9iUITFUT/qFIcz1vC76inP8RNkjPPQZHWXqWUGWwnbf86XY0OxtjG99ZIQKfcTSRXjTFPX1ozpXvgNwYwGbSLte8X4gIAvgaxRVwjvl23FtSaZnqPJOh78nOQrQkPgYtHkre4QwGZRFZ+3qmj5PHG7EI+zFBUPkQv66MybHv38jQW3bMKbULZwKKZ5naq7cW5BGGvc8U40F1UV/0c60GeEe3eAJDHrSooWD1DnaMvTg4/3i2qh0Yf9X6d+bJmK+fdLSLMvn8YSuxenMH9gM8oygE3Dnd5FznDLxpyzOiGTs83MXtM3/3WN+D3qu8EA7MaC6tY+VJ0a6DqnLj1cO2L3Xmh3FGv3Y7VAbznyjX+K8Nb9izgJ9ys2ufvK55Zq96bTSIKIiBDeTFMPhWxsulSnnzQQ6Ey58kfSpZZN53sw//8+hRK2MuSkgWoep5cbVxIxHm00PaFuIV3OzD5fDldh72Lzjg86wjAgMBAAGjMjAwMB0GA1UdDgQWBBSB1wC1hnhyQ549nY975g7GDLgl5TAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQAqgUoD3X4FL+qGbOihZW5rjE0piv1a9o1WN1fkg4NgLXc+fcvUVUd2mJpmDoTQT+gmESatNbSoc/z4qupddIcQr9ZVH+HWWl37HyxBV73bQ/qsdrURySYfEZ/Q717LQKaEI0Au/bPaY6RzUmkRSP+vjpIYYLgTOrhTsCY4IfgxKPyvLevVQnYn6Akv9dv8m8210piBRUGk41NRGf3VrqJUpZSwL4gwZAZrh+Lb1ELbjiEPk9qNwgEf/AGQ+v1HNsX8OIP1/Y08+LkQVbwflz1M5sQVtAkE5xSyg/g/CaBICuAT9sL/iWbyIdtZ43yfryB+gPZUxWEkVSbyntnMvNSGtCee9bbZ61FkO8a3e8cBERaqohdvSAJ7JsYGCYTuAmPPkc0CYP0/soPclrKYNV1FkV1+ua5ubI9QUUxcgYF3hcyMnTWCVvJmEH/AxbEu9tnmpPWjuGlSSA9WN/O/Emm9yr1EfkJmRH/JJsh0TPmZYKtTw3eF13ccnkqAVgTlR70mGl31gnllkVjabS0tBWISnu81/VSfqRm8SyyrDruj/DJlVMfdMlkImgieEbXJ7klIWdEkfMOtyh7/7wofPM+kmzD24QfwDWMsJMMVu5vNT51Sn9qcBqq/cU0p2ASC8xc0ZFO5C91L5wUlsVzkWEs0nnfLJ040jnoVwc1DAVJh9Q==
ServerSignature

XvW564iGoHGtAFzxqqU3aTbdOhzlRxKSz8+XjIlI91E7ts1FN0vyzEoZAPKXgDMhEJQtYhPmS/QzQK6/tmYczcXIwG6nxny0ZKWmGBxxuuQMS/nubrcBj6AeMehTLMfmVY6PdHZKmf6Y57/DOF03bFpI8bIWFV9so/p9noCt/BF2EqkDvL4bi7ZK86zHwVeEM1KqE1fY+SILAU6oh1UUB9na+beEYrjl/ODJJGBhpIGn4UKEFP709hOWRBxrTS25muAsz6J9uUkKgrBIbWwSVGUDaZdgFn7SbRkTEd1Wp//hMANY3Al+LDhtTcaDQ6PXc/+WSevu0QYgcxsSd0VhrFGHxyo/WB1X4ekKm6vAbF6W6X/26PApyvMCJqmTdkbkokwQrRyyz4LSVRb/2JxKYwYgtSqDxaptLoRGwTWhCKhb8GzGeOzlgd+E7oP8yXgaCihSx8nu5H8/rgsZXSnW/QG6CTlDKUUoikTnaecMwlO8UK1yaeTZHbfLY9Vf3fGVaf8L5KjqUnQ77a0ewILhvLdPXN5eRBvqJa3kKW/NFk71D+K4Cl8QBXYMl7IxY4M5Ked1dtEJfpUX5wn/dm6StmKrwLnFNiN4GFKXfpXmDSci5uagllUdAdDSET7QZkfI6GRwXWOSqA87WN+E+VT+o5i3HvOoPmxxFRrIDotgLTo=
Install

false
BDOS

false
Anti-VM

false
Install-Folder

%AppData%
Hosts

bong88.com.ng
Ports

22,53,80,443,6606,7707,8808,8844
Mutex

FtTRmAL1FxCo
Version

0.5.8
Delay

3
Group

Default
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

AsyncClient.exe
Full Name

AsyncClient.exe
EntryPoint

System.Void Client.Program::Main()
Scope Name

AsyncClient.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

AsyncClient
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.8
Total Strings

120
Main Method

System.Void Client.Program::Main()
Main IL Instruction Count

51
Main IL

ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0043: ldsfld System.String Client.Settings::Anti ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String Client.Settings::Install call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() ldsfld System.String Client.Settings::Install call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BDOS call System.Void Client.Install.NormalStartup::Install() ldsfld System.String Client.Settings::BDOS call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.ProcessCritical::Set() call System.Void Client.Helper.Methods::PreventSleep() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Module Name

AsyncClient.exe
Full Name

AsyncClient.exe
EntryPoint

System.Void Client.Program::Main()
Scope Name

AsyncClient.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

AsyncClient
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.8
Total Strings

120
Main Method

System.Void Client.Program::Main()
Main IL Instruction Count

51
Main IL

ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0043: ldsfld System.String Client.Settings::Anti ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String Client.Settings::Install call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() ldsfld System.String Client.Settings::Install call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BDOS call System.Void Client.Install.NormalStartup::Install() ldsfld System.String Client.Settings::BDOS call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.ProcessCritical::Set() call System.Void Client.Helper.Methods::PreventSleep() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Artefacts
Name
 Value
Key (AES_256)

bXB0R01xYzZRU2dDNVc4eU9DaGlmbEtZbVdUVGxjSVY=
CnC

bong88.com.ng
Ports

22
Ports

53
Ports

80
Ports

443
Ports

6606
Ports

7707
Ports

8808
Ports

8844
Mutex

FtTRmAL1FxCo
d6c1328728e411166d7613d52c4ae618 (46.08 KB)
File Structure
d6c1328728e411166d7613d52c4ae618
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Characteristics
Malware Configuration - AsyncRAT config.
Config. Field
 Value
Key (AES_256)

bXB0R01xYzZRU2dDNVc4eU9DaGlmbEtZbVdUVGxjSVY=
Pastebin

-
Certificate

MIIE8jCCAtqgAwIBAgIQAIHNt4dWr2fpH2x/27PM2zANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjYwNDE1MDIyMTEzWhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAI5RSo2nQ/y8B1I6onJTmKF0s9F5YMYJaWxfwzkmur66I2wGXoPn3/7ZacJQYPoDV+zxNcn+xihQRxvw6Kcu8U7OBPvwU1ji6rpmKyQD9JLfDeB8y7Ahi96jikNdv3P/D/nczFhTsMSqe7ZaFuGYnewtXQEoVSvL5uiczK9GvjJ175dksaKN2fmKLQVguNUTFWqa6YZMPt5l9iUITFUT/qFIcz1vC76inP8RNkjPPQZHWXqWUGWwnbf86XY0OxtjG99ZIQKfcTSRXjTFPX1ozpXvgNwYwGbSLte8X4gIAvgaxRVwjvl23FtSaZnqPJOh78nOQrQkPgYtHkre4QwGZRFZ+3qmj5PHG7EI+zFBUPkQv66MybHv38jQW3bMKbULZwKKZ5naq7cW5BGGvc8U40F1UV/0c60GeEe3eAJDHrSooWD1DnaMvTg4/3i2qh0Yf9X6d+bJmK+fdLSLMvn8YSuxenMH9gM8oygE3Dnd5FznDLxpyzOiGTs83MXtM3/3WN+D3qu8EA7MaC6tY+VJ0a6DqnLj1cO2L3Xmh3FGv3Y7VAbznyjX+K8Nb9izgJ9ys2ufvK55Zq96bTSIKIiBDeTFMPhWxsulSnnzQQ6Ey58kfSpZZN53sw//8+hRK2MuSkgWoep5cbVxIxHm00PaFuIV3OzD5fDldh72Lzjg86wjAgMBAAGjMjAwMB0GA1UdDgQWBBSB1wC1hnhyQ549nY975g7GDLgl5TAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQAqgUoD3X4FL+qGbOihZW5rjE0piv1a9o1WN1fkg4NgLXc+fcvUVUd2mJpmDoTQT+gmESatNbSoc/z4qupddIcQr9ZVH+HWWl37HyxBV73bQ/qsdrURySYfEZ/Q717LQKaEI0Au/bPaY6RzUmkRSP+vjpIYYLgTOrhTsCY4IfgxKPyvLevVQnYn6Akv9dv8m8210piBRUGk41NRGf3VrqJUpZSwL4gwZAZrh+Lb1ELbjiEPk9qNwgEf/AGQ+v1HNsX8OIP1/Y08+LkQVbwflz1M5sQVtAkE5xSyg/g/CaBICuAT9sL/iWbyIdtZ43yfryB+gPZUxWEkVSbyntnMvNSGtCee9bbZ61FkO8a3e8cBERaqohdvSAJ7JsYGCYTuAmPPkc0CYP0/soPclrKYNV1FkV1+ua5ubI9QUUxcgYF3hcyMnTWCVvJmEH/AxbEu9tnmpPWjuGlSSA9WN/O/Emm9yr1EfkJmRH/JJsh0TPmZYKtTw3eF13ccnkqAVgTlR70mGl31gnllkVjabS0tBWISnu81/VSfqRm8SyyrDruj/DJlVMfdMlkImgieEbXJ7klIWdEkfMOtyh7/7wofPM+kmzD24QfwDWMsJMMVu5vNT51Sn9qcBqq/cU0p2ASC8xc0ZFO5C91L5wUlsVzkWEs0nnfLJ040jnoVwc1DAVJh9Q==
ServerSignature

XvW564iGoHGtAFzxqqU3aTbdOhzlRxKSz8+XjIlI91E7ts1FN0vyzEoZAPKXgDMhEJQtYhPmS/QzQK6/tmYczcXIwG6nxny0ZKWmGBxxuuQMS/nubrcBj6AeMehTLMfmVY6PdHZKmf6Y57/DOF03bFpI8bIWFV9so/p9noCt/BF2EqkDvL4bi7ZK86zHwVeEM1KqE1fY+SILAU6oh1UUB9na+beEYrjl/ODJJGBhpIGn4UKEFP709hOWRBxrTS25muAsz6J9uUkKgrBIbWwSVGUDaZdgFn7SbRkTEd1Wp//hMANY3Al+LDhtTcaDQ6PXc/+WSevu0QYgcxsSd0VhrFGHxyo/WB1X4ekKm6vAbF6W6X/26PApyvMCJqmTdkbkokwQrRyyz4LSVRb/2JxKYwYgtSqDxaptLoRGwTWhCKhb8GzGeOzlgd+E7oP8yXgaCihSx8nu5H8/rgsZXSnW/QG6CTlDKUUoikTnaecMwlO8UK1yaeTZHbfLY9Vf3fGVaf8L5KjqUnQ77a0ewILhvLdPXN5eRBvqJa3kKW/NFk71D+K4Cl8QBXYMl7IxY4M5Ked1dtEJfpUX5wn/dm6StmKrwLnFNiN4GFKXfpXmDSci5uagllUdAdDSET7QZkfI6GRwXWOSqA87WN+E+VT+o5i3HvOoPmxxFRrIDotgLTo=
Install

false
BDOS

false
Anti-VM

false
Install-Folder

%AppData%
Hosts

bong88.com.ng
Ports

22,53,80,443,6606,7707,8808,8844
Mutex

FtTRmAL1FxCo
Version

0.5.8
Delay

3
Group

Default
Artefacts
Name
 Value Location
Key (AES_256)

bXB0R01xYzZRU2dDNVc4eU9DaGlmbEtZbVdUVGxjSVY=

Malicious

d6c1328728e411166d7613d52c4ae618
CnC

bong88.com.ng

Malicious

d6c1328728e411166d7613d52c4ae618
Ports

22

Malicious

d6c1328728e411166d7613d52c4ae618
Ports

53

Malicious

d6c1328728e411166d7613d52c4ae618
Ports

80

Malicious

d6c1328728e411166d7613d52c4ae618
Ports

443

Malicious

d6c1328728e411166d7613d52c4ae618
Ports

6606

Malicious

d6c1328728e411166d7613d52c4ae618
Ports

7707

Malicious

d6c1328728e411166d7613d52c4ae618
Ports

8808

Malicious

d6c1328728e411166d7613d52c4ae618
Ports

8844

Malicious

d6c1328728e411166d7613d52c4ae618
Mutex

FtTRmAL1FxCo

Malicious

d6c1328728e411166d7613d52c4ae618
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙