Symbol Ofbuscation Score
|
Hash | Hash Value |
|---|---|
| MD5 | f51d0f8922881aa603d5503ca8b56ebb
|
| Sha1 | 70710b60a027f78f4f36bf6a839c71cef08c97a9
|
| Sha256 | 01139818cc4f023f50dfa34b471e6440f097d05a767d72e7f5cf129cc1b7f3b1
|
| Sha384 | 459ac458b3ba738d8139a5ba97c6a44bd8e0897e0fc391be6740e5b7fef56e185e629025e4db273c61b1f0bbf0fa8f31
|
| Sha512 | fb5fbdcb0195d126c5627d72a2706cf7e09b703a241e4d7d2dfc5f74fe3788e5fcac3769478ba0e1415ecb92908a86bc72af82b023ebd5733770793633baeeb5
|
| SSDeep | 768:qVbyx3SWiPjRYin9JSP4Duw24DGXEOa8w1+jNSCv7mqb7napwH1oaclhPI85Kg80:qMSN9GxwEaDjGbbUwcXIYKtG9AhVclN
|
| TLSH | 8D534A002798C965E1AE4AB4BCF3550106B1E9772102DB5E7CC415DBAB9FFC64A123FE
|
|
Config. Field0 | Value |
|---|---|
| Key (AES_256) | TmdZYTBSMm5wNWxaVEF3c0RhOTlmMXVLVUhuRUpVM1Y= |
| Pastebin | - |
| Certificate | MIICMDCCAZmgAwIBAgIVAMis7lcdT+wU9VD3/IX301ufmZbDMA0GCSqGSIb3DQEBDQUAMGQxFTATBgNVBAMMDERjUmF0IFNlcnZlcjETMBEGA1UECwwKcXdxZGFuY2h1bjEcMBoGA1UECgwTRGNSYXQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTI1MDMyNzAxMzMzOVoXDTM2MDEwNDAxMzMzOVowEDEOMAwGA1UEAwwFRGNSYXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAJ9LcpyTYQ8OmJAaFsg21ICvNro3tiqOu91m4kF+5Dm41/LNHsathepPzmivZgC+n3dqokqvrVdbmrBfpzxvAFqDviHxH9nvNOszDdx3Su6RmVndNFShIFDAfc6Dv15L650MOtq/dEi/U9OJXBjkW4sRrlsz559QEbrNBsNJhSpjAgMBAAGjMjAwMB0GA1UdDgQWBBQUeYdKJbi05fK7gQhYHeSlux8D0DAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4GBAAuH0OQ0WhcdFFJiXuirZ0KE5Q+GuaKjwQJ4P7fga4xczbVowT4WliFO/MWLFjRgMZd8jpfuIvmpkp/Zlo531+xp0lNlrypnxDX2w8rOVsBNlWDKOfUrI1dsBHYvj6ywh01hA6sX+WQac5ZeiuNQ06bBYZ9FHCperBY4JNay/co9 |
| ServerSignature | efzwGW8kbF64JfqDsSHAWIIGa7jEHkhnzGJFnlJrVXnavjbZR97Q33XFVpds6tccVfMR8Aew9JvX99jJfxQPnI2TXBJ85HNN4cRE3myA7GTsWuIjrwMKaaNIuPNFFlhy2LrdvPUUXVDPI50zpJKQwUG9KGD7CrTIZM6f4vWWkfg= |
| Install | true |
| BDOS | false |
| Anti-VM | false |
| Install File | StratigonEndpointPrime.exe |
| Install-Folder | %AppData% |
| Hosts | dehesa.sa.com,www.dehesa.sa.com,psyca.co.com,www.psyca.co.com,win678.ru.com,www.win678.ru.com,automotive6.sa.com,www.automotive6.sa.com,sgna.sa.com,www.sgna.sa.com,riku.in.net,www.riku.in.net |
| Ports | 80,443,4444,4782,5555,6060,6666,8080,8848 |
| Mutex | SDT_PrimeEndpoint_SentinelLock_2035v4 |
| Version | 1.0.7 |
| Delay | 1 |
| Group | Default |
|
Name0 | Value |
|---|---|
| Info | PE Detect: PeReader OK (file layout) |
| Module Name | StratigonEndpointPrime.exe |
| Full Name | StratigonEndpointPrime.exe |
| EntryPoint | System.Void Client.Program::Main() |
| Scope Name | StratigonEndpointPrime.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v4.0.30319 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | StratigonEndpointPrime |
| Assembly Version | 1.0.7.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | .NETFramework,Version=v4.0 |
| Total Strings | 157 |
| Main Method | System.Void Client.Program::Main() |
| Main IL Instruction Count | 77 |
| Main IL | ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::De_lay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> ldsfld System.String Client.Settings::An_ti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0047: leave IL_0052 call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() leave IL_0052: call System.Void Client.Helper.A::B() pop <null> leave IL_0052: call System.Void Client.Helper.A::B() call System.Void Client.Helper.A::B() call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0067: leave IL_0072 ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) leave IL_0072: nop pop <null> leave IL_0072: nop nop <null> ldsfld System.String Client.Settings::Anti_Process call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0087: leave IL_0092 call System.Void Client.Helper.AntiProcess::StartBlock() leave IL_0092: nop pop <null> leave IL_0092: nop nop <null> ldsfld System.String Client.Settings::BS_OD call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_00B1: leave IL_00BC call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_00B1: leave IL_00BC call System.Void Client.Helper.ProcessCritical::Set() leave IL_00BC: nop pop <null> leave IL_00BC: nop nop <null> ldsfld System.String Client.Settings::In_stall call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_00D1: leave IL_00DC call System.Void Client.Install.NormalStartup::Install() leave IL_00DC: call System.Void Client.Helper.Methods::PreventSleep() pop <null> leave IL_00DC: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_00F0: leave IL_00FB call System.Void Client.Helper.Methods::ClearSetting() leave IL_00FB: nop pop <null> leave IL_00FB: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_0110: leave IL_011B call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_011B: ldc.i4 5000 pop <null> leave IL_011B: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_00FB: nop |
|
Name0 | Value |
|---|---|
| Key (AES_256) | TmdZYTBSMm5wNWxaVEF3c0RhOTlmMXVLVUhuRUpVM1Y= |
| CnC | dehesa.sa.com |
| CnC | www.dehesa.sa.com |
| CnC | psyca.co.com |
| CnC | www.psyca.co.com |
| CnC | win678.ru.com |
| CnC | www.win678.ru.com |
| CnC | automotive6.sa.com |
| CnC | www.automotive6.sa.com |
| CnC | sgna.sa.com |
| CnC | www.sgna.sa.com |
| CnC | riku.in.net |
| CnC | www.riku.in.net |
| Ports | 80 |
| Ports | 443 |
| Ports | 4444 |
| Ports | 4782 |
| Ports | 5555 |
| Ports | 6060 |
| Ports | 6666 |
| Ports | 8080 |
| Ports | 8848 |
| Mutex | SDT_PrimeEndpoint_SentinelLock_2035v4 |
|
Config. Field0 | Value |
|---|---|
| Key (AES_256) | TmdZYTBSMm5wNWxaVEF3c0RhOTlmMXVLVUhuRUpVM1Y= |
| Pastebin | - |
| Certificate | MIICMDCCAZmgAwIBAgIVAMis7lcdT+wU9VD3/IX301ufmZbDMA0GCSqGSIb3DQEBDQUAMGQxFTATBgNVBAMMDERjUmF0IFNlcnZlcjETMBEGA1UECwwKcXdxZGFuY2h1bjEcMBoGA1UECgwTRGNSYXQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTI1MDMyNzAxMzMzOVoXDTM2MDEwNDAxMzMzOVowEDEOMAwGA1UEAwwFRGNSYXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAJ9LcpyTYQ8OmJAaFsg21ICvNro3tiqOu91m4kF+5Dm41/LNHsathepPzmivZgC+n3dqokqvrVdbmrBfpzxvAFqDviHxH9nvNOszDdx3Su6RmVndNFShIFDAfc6Dv15L650MOtq/dEi/U9OJXBjkW4sRrlsz559QEbrNBsNJhSpjAgMBAAGjMjAwMB0GA1UdDgQWBBQUeYdKJbi05fK7gQhYHeSlux8D0DAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4GBAAuH0OQ0WhcdFFJiXuirZ0KE5Q+GuaKjwQJ4P7fga4xczbVowT4WliFO/MWLFjRgMZd8jpfuIvmpkp/Zlo531+xp0lNlrypnxDX2w8rOVsBNlWDKOfUrI1dsBHYvj6ywh01hA6sX+WQac5ZeiuNQ06bBYZ9FHCperBY4JNay/co9 |
| ServerSignature | efzwGW8kbF64JfqDsSHAWIIGa7jEHkhnzGJFnlJrVXnavjbZR97Q33XFVpds6tccVfMR8Aew9JvX99jJfxQPnI2TXBJ85HNN4cRE3myA7GTsWuIjrwMKaaNIuPNFFlhy2LrdvPUUXVDPI50zpJKQwUG9KGD7CrTIZM6f4vWWkfg= |
| Install | true |
| BDOS | false |
| Anti-VM | false |
| Install File | StratigonEndpointPrime.exe |
| Install-Folder | %AppData% |
| Hosts | dehesa.sa.com,www.dehesa.sa.com,psyca.co.com,www.psyca.co.com,win678.ru.com,www.win678.ru.com,automotive6.sa.com,www.automotive6.sa.com,sgna.sa.com,www.sgna.sa.com,riku.in.net,www.riku.in.net |
| Ports | 80,443,4444,4782,5555,6060,6666,8080,8848 |
| Mutex | SDT_PrimeEndpoint_SentinelLock_2035v4 |
| Version | 1.0.7 |
| Delay | 1 |
| Group | Default |
|
Name0 | Value | Location |
|---|---|---|
| Key (AES_256) | TmdZYTBSMm5wNWxaVEF3c0RhOTlmMXVLVUhuRUpVM1Y= Malicious |
f51d0f8922881aa603d5503ca8b56ebb |
| CnC | dehesa.sa.com Malicious |
f51d0f8922881aa603d5503ca8b56ebb |
| CnC | www.dehesa.sa.com Malicious |
f51d0f8922881aa603d5503ca8b56ebb |
| CnC | psyca.co.com Malicious |
f51d0f8922881aa603d5503ca8b56ebb |
| CnC | www.psyca.co.com Malicious |
f51d0f8922881aa603d5503ca8b56ebb |
| CnC | win678.ru.com Malicious |
f51d0f8922881aa603d5503ca8b56ebb |
| CnC | www.win678.ru.com Malicious |
f51d0f8922881aa603d5503ca8b56ebb |
| CnC | automotive6.sa.com Malicious |
f51d0f8922881aa603d5503ca8b56ebb |
| CnC | www.automotive6.sa.com Malicious |
f51d0f8922881aa603d5503ca8b56ebb |
| CnC | sgna.sa.com Malicious |
f51d0f8922881aa603d5503ca8b56ebb |
| CnC | www.sgna.sa.com Malicious |
f51d0f8922881aa603d5503ca8b56ebb |
| CnC | riku.in.net Malicious |
f51d0f8922881aa603d5503ca8b56ebb |
| CnC | www.riku.in.net Malicious |
f51d0f8922881aa603d5503ca8b56ebb |
| Ports | 80 Malicious |
f51d0f8922881aa603d5503ca8b56ebb |
| Ports | 443 Malicious |
f51d0f8922881aa603d5503ca8b56ebb |
| Ports | 4444 Malicious |
f51d0f8922881aa603d5503ca8b56ebb |
| Ports | 4782 Malicious |
f51d0f8922881aa603d5503ca8b56ebb |
| Ports | 5555 Malicious |
f51d0f8922881aa603d5503ca8b56ebb |
| Ports | 6060 Malicious |
f51d0f8922881aa603d5503ca8b56ebb |
| Ports | 6666 Malicious |
f51d0f8922881aa603d5503ca8b56ebb |
| Ports | 8080 Malicious |
f51d0f8922881aa603d5503ca8b56ebb |
| Ports | 8848 Malicious |
f51d0f8922881aa603d5503ca8b56ebb |
| Mutex | SDT_PrimeEndpoint_SentinelLock_2035v4 Malicious |
f51d0f8922881aa603d5503ca8b56ebb |