eaaa380371cf6657c9b2991c01a7891b

PE Executable
|
MD5: eaaa380371cf6657c9b2991c01a7891b
|
Size: 48.64 KB
|
application/x-dosexec

Infection Chain

Summary by MalvaGPT

Characteristics

Hash	Hash Value
MD5	eaaa380371cf6657c9b2991c01a7891b
Sha1	24250f53f1ef61fc1d6e080a0a7a09df47c91a73
Sha256	7618127c48a459913418d5446d3d2922b8f6d9f132fad338829d7e1bd07ff08d
Sha384	3c2e1cb477108d1355e5a11a49e4f3d0066bda3717e6810b8e4e00284ed3a7c31cf8a1a55411064d5110596237b18c26
Sha512	fecc0e99213aaddef4c6a00ab4210f741ce90f3cfe7761ada20e42fa3b9de38ffb5d570f80ce5bdc7e34e15edce87bb95dd1274dddf4e30e42b53b3eb64b7e75
SSDeep	768:Ds9DILA+Es+biBtelDSN+iV08YbygeXZEFGvEgK/J3ZVc6KN:DsDUBtKDs4zb1x4nkJ3ZVclN
TLSH	83235C4037D88136F6BD4BB5ACF2E24182B5D2676903CA5D6CC814EA2F13BD596036FE

PeID

.NET executable

Microsoft Visual C# / Basic .NET

Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL

Microsoft Visual C# v7.0 / Basic .NET

Microsoft Visual Studio .NET

File Structure

Malware Configuration - DcRat config.

Config. Field0	Value
Key (AES_256)	NFZ5eU05OHlRMERhcnl2Ujl6bmJrMEtyUWxIeDFvM0c=
Pastebin	-
Certificate	MIICMDCCAZmgAwIBAgIVALDLHGORGC35yln9m9TGO6dkKn8pMA0GCSqGSIb3DQEBDQUAMGQxFTATBgNVBAMMDERjUmF0IFNlcnZlcjETMBEGA1UECwwKcXdxZGFuY2h1bjEcMBoGA1UECgwTRGNSYXQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTI1MDIwOTAyMjMxOFoXDTM1MTExOTAyMjMxOFowEDEOMAwGA1UEAwwFRGNSYXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAIl4KYoPge9992Q0L5f2MYvuMG5TOhNwE6cvJnLoQ7+n58Nn6UdngZWC5EVFcbMGS8gpnZsBqZWvxsdAqEvUYcEFNK46fII7YkPAaLxWOjTzTK4FZJNNNaIlyGwqStXD3GXBZJwGEOLu+DdVtT0xyqKH2P0AFcNKJly3FP16F3f7AgMBAAGjMjAwMB0GA1UdDgQWBBQsdlqZeQjwk7iR4kdb/T8WwDPUKzAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4GBACkjKHkaIP9wACL0EeZmt41D3+8WKX/+r+jxRKxsC1eaLOYzud5SlnLHMbI7SHjzPVGykzhw538QVoRGNWWrEtHTXaYoPJmomXPTt48ljX4Ki+JuVaoNUpSZarYn8VfZumtfqN3jJK9lJt59McaKjoARRpfyPz37If0wntAQf1vU
ServerSignature	T5Bbs9G0Vh6z/gYjUDnXPIZG2wRZ5k9eLLq6HRur+K0Ik6ZVK39mNsSZpeDuZAtym/7oQBLA1k+KgADzOCzno8eCNmE14Lp1GbN5W99hA2w186J2E2UokPf8l/ObIyNn68Cx2rzgh8BjXdQNE9F8wryvtQ189LbArjwU6LA1ncw=
Install	false
BDOS	false
Anti-VM	false
Install File	Chrome.exe
Install-Folder	%AppData%
Hosts	patriciakleijn.nl
Ports	443
Mutex	DcRatMutex_qwqdanchun
Version	1.0.7
Delay	1
Group	Default

Informations

Name0	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void Client.Program::Main()
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.0.7.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	150
Main Method	System.Void Client.Program::Main()
Main IL Instruction Count	59
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::De_lay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> ldsfld System.String Client.Settings::An_ti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0047: call System.Boolean Client.Helper.MutexControl::CreateMutex() call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0057: ldsfld System.String Client.Settings::Anti_Process ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti_Process call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BS_OD call System.Void Client.Helper.AntiProcess::StartBlock() ldsfld System.String Client.Settings::BS_OD call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: ldsfld System.String Client.Settings::In_stall call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: ldsfld System.String Client.Settings::In_stall call System.Void Client.Helper.ProcessCritical::Set() ldsfld System.String Client.Settings::In_stall call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_009D: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Install.NormalStartup::Install() call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_00B1: call System.Void Client.Connection.Amsi::Bypass() call System.Void Client.Helper.Methods::ClearSetting() call System.Void Client.Connection.Amsi::Bypass() leave IL_00C1: nop pop <null> leave IL_00C1: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00D6: leave IL_00E1 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00E1: ldc.i4 5000 pop <null> leave IL_00E1: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_00C1: nop
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void Client.Program::Main()
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.0.7.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	150
Main Method	System.Void Client.Program::Main()
Main IL Instruction Count	59
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::De_lay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> ldsfld System.String Client.Settings::An_ti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0047: call System.Boolean Client.Helper.MutexControl::CreateMutex() call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0057: ldsfld System.String Client.Settings::Anti_Process ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti_Process call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BS_OD call System.Void Client.Helper.AntiProcess::StartBlock() ldsfld System.String Client.Settings::BS_OD call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: ldsfld System.String Client.Settings::In_stall call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: ldsfld System.String Client.Settings::In_stall call System.Void Client.Helper.ProcessCritical::Set() ldsfld System.String Client.Settings::In_stall call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_009D: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Install.NormalStartup::Install() call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_00B1: call System.Void Client.Connection.Amsi::Bypass() call System.Void Client.Helper.Methods::ClearSetting() call System.Void Client.Connection.Amsi::Bypass() leave IL_00C1: nop pop <null> leave IL_00C1: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00D6: leave IL_00E1 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00E1: ldc.i4 5000 pop <null> leave IL_00E1: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_00C1: nop

Artefacts

Name0	Value
Key (AES_256)	NFZ5eU05OHlRMERhcnl2Ujl6bmJrMEtyUWxIeDFvM0c=
CnC	patriciakleijn.nl
Ports	443
Mutex	DcRatMutex_qwqdanchun

eaaa380371cf6657c9b2991c01a7891b (48.64 KB)