Sample details: 367db629beedf528adaa021bdb7c12de --

Hashes
MD5: 367db629beedf528adaa021bdb7c12de
SHA1: c3bbd16465694354ac828d08a66a62b2b80753db
SHA256: 9bb08a3ebacf37c3bcfcd1695fc972dd745c7861d40941f72a8b7f6487b2e212
SSDEEP: 3072:Qlt3n1WBATYG3Z8cBrV29vewcQMqqD/eWTBfsU:QlV1WBU3ZHSSqqD/eWTBUU
Details
File Type: MS-DOS
Yara Hits
YRP/Microsoft_Visual_Cpp_v50v60_MFC | YRP/IsPE32 | YRP/IsDLL | YRP/IsPacked | YRP/HasModified_DOS_Message | YRP/maldoc_find_kernel32_base_method_1 | YRP/domain | YRP/contentis_base64 | YRP/DebuggerCheck__QueryInfo | YRP/network_tcp_socket | YRP/win_registry | YRP/CRC32_poly_Constant | YRP/CRC32_table | YRP/MD5_Constants | YRP/RIPEMD160_Constants | YRP/SHA1_Constants | YRP/RijnDael_AES_CHAR | YRP/RijnDael_AES_LONG | YRP/Str_Win32_Winsock2_Library |
Strings
		t'VVVj
VPVVVVVVVV
SVHWtJHt
^(_^[]
F(9F,u5
~  }*j
t.Ht+Hu:
F4t!9]
u$Sj?W
wK9V8t
;F8t	P
Fx;FHu
;F8t	P
YY;~Hu
Fp;Ftt
PPPPPPP
PPPPPPP
tFIItBI
t ;t$$t
VC20XC00U
FXj@PV
to9nptjWUP
F\j@PV
Fhj@PV
ud97t$j
	uQj	h
	u;j	h
uG97tWSVW
Wtg9L$
G8;FDu
G8;FDu
GD;FDu
GD;FDu
F,;CDulP
G8;FDu
v6j X+E
JtmJtSJt0Jt
^(9^$u
N@;H s	
N@;H(s	
Fh;F\sL
L&&jl66Z~??A
Oh44\Q
sb11S*
uB!!c 
D""fT**~;
;d22Vt::N
J%%o\..r8
gg}V++
jL&&Zl66A~??
Sb11?*
tX,,.4
RRMv;;a
MMUf33
PPDx<<
cB!!0 
~~Gz==
fD""~T**
Vd22Nt::
xxoJ%%r\..$8
ppB|>>
aa_j55
UUxP((z
&jL&6Zl6?A~?
~=Gz=d
"fD"*~T*
2Vd2:Nt:
x%oJ%.r\.
a5_j5W
=&&jL66Zl??A~
g99KrJJ
==Gzdd
""fD**~T
22Vd::Nt
$$lH\\
77Ynmm
%%oJ..r\
55_jWW
[T:$6.
[.:$6g
j_FbT~
h4,8$@_
2\tHlWB
PQAeS~
~4[C)v
Qkkbal
[-&LMb#{'
w+OQvr
)\ZEo^m/
H*0"ZOW
l!;b	F
mj>zjZ
IiGM>nw
ewh/?y
OZw3(?
V_:X1:
;JGwWy
ntdll.dll
bin/i386/Kaga.so
X-Length
kernel32.dll
ExitProcess
DbgUserBreakPoint
DbgBreakPoint
Connection
X-Code
.z%02d
key expansion
master secret
server finished
client finished
%4d%2d%2d%2d%2d%2d
%2d%2d%2d%2d%2d%2d
SHA256
SHA224
_stricmp
strcmp
memset
memcpy
_snwprintf
ZwQueryInformationProcess
strlen
strtoul
strrchr
memcmp
memmove
strcpy
memchr
_memicmp
strncpy
_snprintf
_allshl
_aullshr
ntdll.dll
RtlUnwind
CreateTimerQueueTimer
DeleteTimerQueueTimer
ChangeTimerQueueTimer
GetProcAddress
GetModuleHandleA
ExitProcess
VirtualProtect
VirtualAlloc
DeleteTimerQueue
CloseHandle
WaitForSingleObject
CreateEventA
CreateTimerQueue
UnmapViewOfFile
GetCurrentProcessId
MapViewOfFile
CreateFileMappingW
GetCurrentProcess
InterlockedIncrement
SetEvent
InterlockedDecrement
BindIoCompletionCallback
IsBadReadPtr
lstrcmpiA
lstrlenA
KERNEL32.dll
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
ADVAPI32.dll
WSAIoctl
WSASocketA
WSARecv
WSASend
WS2_32.dll
malloc
calloc
_pctype
_isctype
__mb_cur_max
fwrite
fclose
sscanf
MSVCRT.dll
GetLocalTime
3!3@3F3^3d3F7M7
8,868<8C8X8c8
919E9R9~9
:$:-:6:?:G:Z:o:v:|:
?5?O?w?
0V1^1s1
2Y3c3h3s3
4@4b5<6g6w6
6L7u7{7
:/:j:h<x<
<	=%=W=z=
>9>L>\>f>
1R2^2k2w2
3;5B5I5
=,=S=u=
>&>3>G>x>
e1q1`3f3l3r3x3
\2f2p2
;W<`<R>[>
619J9V9g9w9
:2:>:O:_:
<5=<=E=Q=i=p=}=
>%>0>H>O>_>m>
?/?9?H?T?e?l?|?
0"010E0V0q0
1+1H1O1\1j1{1
2&232E2^2e2l2x2
3#313B3I3U3a3z3
4.4H4Q4_4r4
:W;[;_;c;g;k;o;s;w;{;
5g6?>f>
f7j7n7r7v7z7~7
:':0:E:L:Z:c:x:
;*;1;b;i;w;~;
; ;$;(;,;0;4;8;<;@;D;L;T;X;\;`;d;h;l;p;t;x;|;