Malicious
Malicious

f0be4843f2df9f384563da0a1705c169

PE Executable
|
MD5: f0be4843f2df9f384563da0a1705c169
|
Size: 48.64 KB
|
application/x-dosexec

Infection Chain
Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Low

Hash
 Hash Value
MD5
f0be4843f2df9f384563da0a1705c169
Sha1
f9f4a11d94dba7a47ec0f72a0eefdfe10c89775d
Sha256
c1129d126820d0b83ec14389944fd8a7ade95e6a980245d37b904623183ddbf1
Sha384
78ecccd837ac79e79bbdf2d6b11b86210578049387951eb6024a848f1930953e05b636cf417bd194999277d5f67a8d7a
Sha512
0edbec7c90dcc988467a3c1cfefc92afd800e44fbf29df3f7c54a7846730bb9e68f84b563e9c02567e41e5f456345fc985216add41f8b2c1b43ad06360c2043b
SSDeep
768:VOEuILWCKi+DiQyYE/pif8Yb3ge5lFtGAi4JHvEgK/J/ZVc6KN:VOtmhezbQUlXGAznkJ/ZVclN
TLSH
19235D4037A8C136E2FD4BB4A8F3A6058279D6572D03DA9C6CC854EA1B13BC597136FE

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
f0be4843f2df9f384563da0a1705c169
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Malware Configuration - DcRat config.
Config. Field
 Value
Key (AES_256)

SmZLZ1dXNTRPZHVnUzJqUlIyb0xBMlgzMEJiM0hNR1E=
Pastebin

-
Certificate

MIICMDCCAZmgAwIBAgIVAOSWG7otcUXubHy01S93Y3gAj6N1MA0GCSqGSIb3DQEBDQUAMGQxFTATBgNVBAMMDERjUmF0IFNlcnZlcjETMBEGA1UECwwKcXdxZGFuY2h1bjEcMBoGA1UECgwTRGNSYXQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTI0MDkxNjIwNDM0M1oXDTM1MDYyNjIwNDM0M1owEDEOMAwGA1UEAwwFRGNSYXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAKE4uR9tgMxqIO23B29/97+k3L/lTaqQLHV6GM/0yMBiNkcaMHPFZuc7IUQ2cV8gmOpq5FPSSS4P7hD+u0qVK3AbfjUqpe5lEAq8NlFDxBz/Y8WaM9H6AEzcEVmkNvNXML7zvCMlrSjpyX0+yxsLso8LX3I3E8AFXXmTu0sHRD3RAgMBAAGjMjAwMB0GA1UdDgQWBBST3OfVD1NZudcPZyZiVDEEWn4pDjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4GBAGLHJ2XM6aeYYqeOEcC5IxcN+YwM67Vf0Emk/b7EUHLyXjH9kY/SvWE4ODs1MMORWVcyJOABaF0DxhJ4hikzZ71M/Zim/d5BRaDQHD544rShEFj7GenJUdeZo1fTIphoPAJbyctrHKtb7UA+URgQ8yWXI+cAXHWfXRtXT0f8XoUj
ServerSignature

VziqsZ1F4NzHPbIA1VyPNLMLIIo2VJ+PyQTu6DfvtT86AU2iALBIw4IAQKU5wYPdKx5KHOLzh+KOnaPYVHuTylKyINdIT4Z6bD62WRnFtiUQc3qCVOZ7hk2xz0otgi55vEsGAsSvTXdIS+gzM8s8fjfEtn42y2pi
Install

false
BDOS

false
Anti-VM

false
Install-Folder

%AppData%
Hosts

88.247.16.132
Ports

1604
Mutex

DcRatMutex_qwqda
Version

1.0.7
Delay

1
Group

MAL
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

COM Surrogate.exe
Full Name

COM Surrogate.exe
EntryPoint

System.Void Client.Program::Main()
Scope Name

COM Surrogate.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

COM Surrogate
Assembly Version

1.0.7.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0
Total Strings

150
Main Method

System.Void Client.Program::Main()
Main IL Instruction Count

59
Main IL

ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::De_lay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> ldsfld System.String Client.Settings::An_ti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0047: call System.Boolean Client.Helper.MutexControl::CreateMutex() call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0057: ldsfld System.String Client.Settings::Anti_Process ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti_Process call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BS_OD call System.Void Client.Helper.AntiProcess::StartBlock() ldsfld System.String Client.Settings::BS_OD call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: ldsfld System.String Client.Settings::In_stall call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: ldsfld System.String Client.Settings::In_stall call System.Void Client.Helper.ProcessCritical::Set() ldsfld System.String Client.Settings::In_stall call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_009D: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Install.NormalStartup::Install() call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_00B1: call System.Void Client.Connection.Amsi::Bypass() call System.Void Client.Helper.Methods::ClearSetting() call System.Void Client.Connection.Amsi::Bypass() leave IL_00C1: nop pop <null> leave IL_00C1: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00D6: leave IL_00E1 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00E1: ldc.i4 5000 pop <null> leave IL_00E1: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_00C1: nop
Module Name

COM Surrogate.exe
Full Name

COM Surrogate.exe
EntryPoint

System.Void Client.Program::Main()
Scope Name

COM Surrogate.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

COM Surrogate
Assembly Version

1.0.7.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0
Total Strings

150
Main Method

System.Void Client.Program::Main()
Main IL Instruction Count

59
Main IL

ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::De_lay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> ldsfld System.String Client.Settings::An_ti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0047: call System.Boolean Client.Helper.MutexControl::CreateMutex() call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0057: ldsfld System.String Client.Settings::Anti_Process ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti_Process call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BS_OD call System.Void Client.Helper.AntiProcess::StartBlock() ldsfld System.String Client.Settings::BS_OD call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: ldsfld System.String Client.Settings::In_stall call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: ldsfld System.String Client.Settings::In_stall call System.Void Client.Helper.ProcessCritical::Set() ldsfld System.String Client.Settings::In_stall call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_009D: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Install.NormalStartup::Install() call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_00B1: call System.Void Client.Connection.Amsi::Bypass() call System.Void Client.Helper.Methods::ClearSetting() call System.Void Client.Connection.Amsi::Bypass() leave IL_00C1: nop pop <null> leave IL_00C1: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00D6: leave IL_00E1 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00E1: ldc.i4 5000 pop <null> leave IL_00E1: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_00C1: nop
Artefacts
Name
 Value
Key (AES_256)

SmZLZ1dXNTRPZHVnUzJqUlIyb0xBMlgzMEJiM0hNR1E=
CnC

88.247.16.132
Ports

1604
Mutex

DcRatMutex_qwqda
f0be4843f2df9f384563da0a1705c169 (48.64 KB)
File Structure
f0be4843f2df9f384563da0a1705c169
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Characteristics
Malware Configuration - DcRat config.
Config. Field
 Value
Key (AES_256)

SmZLZ1dXNTRPZHVnUzJqUlIyb0xBMlgzMEJiM0hNR1E=
Pastebin

-
Certificate

MIICMDCCAZmgAwIBAgIVAOSWG7otcUXubHy01S93Y3gAj6N1MA0GCSqGSIb3DQEBDQUAMGQxFTATBgNVBAMMDERjUmF0IFNlcnZlcjETMBEGA1UECwwKcXdxZGFuY2h1bjEcMBoGA1UECgwTRGNSYXQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTI0MDkxNjIwNDM0M1oXDTM1MDYyNjIwNDM0M1owEDEOMAwGA1UEAwwFRGNSYXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAKE4uR9tgMxqIO23B29/97+k3L/lTaqQLHV6GM/0yMBiNkcaMHPFZuc7IUQ2cV8gmOpq5FPSSS4P7hD+u0qVK3AbfjUqpe5lEAq8NlFDxBz/Y8WaM9H6AEzcEVmkNvNXML7zvCMlrSjpyX0+yxsLso8LX3I3E8AFXXmTu0sHRD3RAgMBAAGjMjAwMB0GA1UdDgQWBBST3OfVD1NZudcPZyZiVDEEWn4pDjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4GBAGLHJ2XM6aeYYqeOEcC5IxcN+YwM67Vf0Emk/b7EUHLyXjH9kY/SvWE4ODs1MMORWVcyJOABaF0DxhJ4hikzZ71M/Zim/d5BRaDQHD544rShEFj7GenJUdeZo1fTIphoPAJbyctrHKtb7UA+URgQ8yWXI+cAXHWfXRtXT0f8XoUj
ServerSignature

VziqsZ1F4NzHPbIA1VyPNLMLIIo2VJ+PyQTu6DfvtT86AU2iALBIw4IAQKU5wYPdKx5KHOLzh+KOnaPYVHuTylKyINdIT4Z6bD62WRnFtiUQc3qCVOZ7hk2xz0otgi55vEsGAsSvTXdIS+gzM8s8fjfEtn42y2pi
Install

false
BDOS

false
Anti-VM

false
Install-Folder

%AppData%
Hosts

88.247.16.132
Ports

1604
Mutex

DcRatMutex_qwqda
Version

1.0.7
Delay

1
Group

MAL
Artefacts
Name
 Value Location
Key (AES_256)

SmZLZ1dXNTRPZHVnUzJqUlIyb0xBMlgzMEJiM0hNR1E=

Malicious

f0be4843f2df9f384563da0a1705c169
CnC

88.247.16.132

Malicious

f0be4843f2df9f384563da0a1705c169
Ports

1604

Malicious

f0be4843f2df9f384563da0a1705c169
Mutex

DcRatMutex_qwqda

Malicious

f0be4843f2df9f384563da0a1705c169
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙