d95cb34bfe89fd4d25fd77ee2c8a47b4

PE Executable
|
MD5: d95cb34bfe89fd4d25fd77ee2c8a47b4
|
Size: 46.59 KB
|
application/x-dosexec

Infection Chain

Summary by MalvaGPT

Characteristics

Hash	Hash Value
MD5	d95cb34bfe89fd4d25fd77ee2c8a47b4
Sha1	42bb936cb48de3e2b7033fe9c55940b99dea4fcd
Sha256	eb018acb6e5a762ad7dcff4227a3ed4c836a43d24c5876805f41e039e9f7a09b
Sha384	6905dba0dfa1c298cf8c4bb5ca2e65ef87ed4033022919b3fcc97483703cc33be40a2d8773520430c6a75676d1043ee8
Sha512	42d4a4a227110bb5b040164e57ab23e7cc3cba7caa245e8d77f6797db299856d440f213c54867387694454cfc2206eca0a62ea12dbb1653c6e9bad9aa2158a54
SSDeep	768:/aMCDLPSc9xvXwnGex80bu5XTW0zR1PdJIjbpg47Fecy/SxszyD81i/qmM5bFf+:/aMCDWYDiudKbm4hecvxgyei/rM5bFf+
TLSH	40232A003BE98266F1BE4F7899F2225646BAF2533603DA4E1CC411D75613FC6CA426FE

PeID

.NET executable

Microsoft Visual C# / Basic .NET

Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL

Microsoft Visual C# v7.0 / Basic .NET

Microsoft Visual Studio .NET

File Structure

Malware Configuration - AsyncRAT config.

Config. Field0	Value
Key (AES_256)	MjduZkZMV3VuUk90eEdKbGRIbjlBYmhTTENKYmJnamI=
Pastebin	-
Certificate	MIIE8jCCAtqgAwIBAgIQAOKN8DvtPOQyTh0RjGdWTTANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjYwNDEzMTYzOTM4WhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAOhMcIL4LZ9Bgm7NuzHQwpuh7v9MKQbf8ZMlsu0+RLqL654cmLmFYi4RLTKKUXyulvhqeh823c0b42NzWBx0UEDYPikiiH7XVBxqro58Jvir3tsqZ34QMJdfQCyBrbFW9DE1G9e8XZ0cyT0keovFfrIGru99p35YiTO1hspC9MkJO5I04Zx7VVIEVeENuakPxKrg5XOuzjnxe5OWYsK5eoR3FEH49aifT/PYsvsNsXD1IJmJW7JXHPxHboFHQsTKGQ5hVoe1FUNm/7iGxXnL+8XzySTi2Wdw1KVRShrIAnxWB96VSby2WjxeK3l6OTO7Y+TMEoUbV8r4sVNj1JAtcSEAZhNOYrxYc2U5CZTte6ansubth7U60+ZYlWL59M9wNabW6P/P1EkQ0uEIz4lKnAOnCsZtHEFJ/PPb9FJuH1Ur7oJYG11stgs2u52yqL7t1TS5oKUmmQ3XJGrqCFNaG7ysUMoAmJsqMW9hKFO0DZJHAh5H7Gygl1r0TTGB+hQqdQnKUnlvkaSg+hxr7Eb67CJTDjPaSphihHETjz9xezOUCrM3fc8tDu4r0AaQGZdirYepzrL3IiqubBi2QVJB828N1PjIgZLMiZSts2EPS8N8Sp0LSJWf4rNRpqGhkAU+3HO89U3qBe9R9ZaWwmjMd2PUfQui2+bcK6KVl/h3YovVAgMBAAGjMjAwMB0GA1UdDgQWBBTWzcSFwwIghO+ukItoX/uggyR3MzAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQBJLNPxJrjPoZDmgYxYF/wFEGtppEiQ9m0MY2dAw6BbGuHVvASeEVzinBhpw3+DTm44M4kVjKfrVJQ8wWgHF7ustKAtHZYEONpDX+jQSkfVXX9OR7bPKmayez8TLsdcgY67DVj8YK/gfzbjIUB23ORacUsoAbOV/EJvZvWb0KJ0CjjjtUE7HZP9XVTFlvkvm7vwgIrWjSMeVKF3jx42ObnTIQ+RuX3Zx/4cWzekWZpGHF3oeAy3v2Ke77rRFTwM0YtKxM3vte0VcYN4Yx6O0d0c96FJ2QkySYzGfqhYfJee9lue43nkbj0Hy9e1Y6jPgQ/IFWjZFWgZw8qg2JWuv/Hds5wu4cfEnGTPh2mKTXf2NcWMA4Ibi8B6X93vV19wUugaKmNGnblPsvx15NzpGm/aS7tqWhEMYFtRwjYvJ1N8t8Rtx36Lav6E+01ldFBgz1V8PGWon6jiHcoyLERu2uTZTX+3uhMZOJNR0rD1gbSVglbngz0/oL3V9yc5nmIt2Il0Z0mjrsdIdhPvdbNwyFwCikTg8VwVSSVIzMeP2JJNyq6q5h5kDMPT8qe/ZDLHznK/z9pQ8CVpsh3yei5EmKeW8YfJDn0SjxX1fOBlApnDSW1VHma/asMdc2XLQdFwKdC6RrwERtpTqAeyceJPkZfHT2qTqBQdroO07w164mZe8g==
ServerSignature	BMIOFbk73b4q0AFzH+xj4zyyS6Whk8Lfkbd8bOtd92Ie+qf7j0qA8WwYwHJJaCH9XDpCJ3d+8WFhANOn2U6eyMVVUgk5TqRxfzwS9RXD/D6H5C6IJmBCG6izJ7Ck7smZYkDhPaeUE+GQEnckt1ut7JhkpqApzRHxxaHrRJ6IpvdnVLX2cVPt3eUVZ7mbM1XCCBnWVETD2bumMHeKlR/tPuock5aId/K75ZVEeYZlwLJAbF0pXYitrpU9BJhlYYcRPzkPRcd0TuyMKhUsZz91fBoSIQGR0lsjpx05xGlGakigwISFt8pPFExGo8oSAHK6HRdVHB0XFaPlS/1/rDDdXxSvvD0FzVuPB6UCIUcWacWtjHRYONlielHoX6H69On7Pvsall345JwvyK+05yUgGldHfXYl0XkugrvdaV/ZnTDLWyqAdiG73Ku4aZKbH2NJf9+n4qQx5oK+5ekHObKoNf1MgJFScAqj0TZgjAxY9vraEWjFJLa3Kxp2DmHxQqTDGgmJEmE3jj1Zvv82JfQOeCDU2mSRWbv88iyEQ8GdLrJ/C96x39J8wNdGgP+guIeoO51dI7KlU0Z32e2m1YWHOrI1Cn/ToUBskObZagFrsYwPaeVNUXS8t3K8Ti2b7d/z9SFrUha2sDxbFi0rJ8e9Onv96liEPMWN6uWtXAQWtfQ=
Install	false
BDOS	false
Anti-VM	false
Install-Folder	%AppData%
Hosts	yanhh3d.so,api.yanhh3d.so
Ports	80
Mutex	bSQsd3FvhNfx
Version	0.5.8
Delay	3
Group	Default

Informations

Name0	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	OpenClaw.exe
Full Name	OpenClaw.exe
EntryPoint	System.Void Client.Program::Main()
Scope Name	OpenClaw.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	OpenClaw
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.8
Total Strings	128
Main Method	System.Void Client.Program::Main()
Main IL Instruction Count	51
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0043: ldsfld System.String Client.Settings::Anti ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String Client.Settings::Install call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() ldsfld System.String Client.Settings::Install call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BDOS call System.Void Client.Install.NormalStartup::Install() ldsfld System.String Client.Settings::BDOS call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.ProcessCritical::Set() call System.Void Client.Helper.Methods::PreventSleep() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Module Name	OpenClaw.exe
Full Name	OpenClaw.exe
EntryPoint	System.Void Client.Program::Main()
Scope Name	OpenClaw.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	OpenClaw
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.8
Total Strings	128
Main Method	System.Void Client.Program::Main()
Main IL Instruction Count	51
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0043: ldsfld System.String Client.Settings::Anti ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String Client.Settings::Install call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() ldsfld System.String Client.Settings::Install call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BDOS call System.Void Client.Install.NormalStartup::Install() ldsfld System.String Client.Settings::BDOS call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.ProcessCritical::Set() call System.Void Client.Helper.Methods::PreventSleep() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop

Artefacts

Name0	Value
Key (AES_256)	MjduZkZMV3VuUk90eEdKbGRIbjlBYmhTTENKYmJnamI=
CnC	yanhh3d.so
CnC	api.yanhh3d.so
Ports	80
Mutex	bSQsd3FvhNfx

d95cb34bfe89fd4d25fd77ee2c8a47b4 (46.59 KB)