Symbol Obfuscation Score
|
Hash | Hash Value |
|---|---|
| MD5 | 001c87cc966419eddd0096274f6262b7
|
| Sha1 | f40c9ff5d793b5e9b2ab3e12b30cdc187651d64b
|
| Sha256 | 79fc11e6ed88637cd432f69056e1c372fd31d0722ce24c19f4cb5131e1574b66
|
| Sha384 | c775f6dd91534bb03e85b8ec6fdc7fef77275056b439bd93ac2b9005754e052c4dcac45d8a8f6f7b235cda1263e6da95
|
| Sha512 | 5143523abfbec087182b1aa99b6511a87f595f11a366fedc886f308ad96192e59b9834c4aca8829d0fb289e03b89cca6ab91c8b72ecb11ed5fbbc785da99948f
|
| SSDeep | 768:wyP+2h8LckiPRlGiV9JeaGjraiy/XZJrt11+rSCv7mqb2n9pwn1on45Bvrqz8Gjs:/Qc7bOr0zrDtGbb0w045l3GjTVclN
|
| TLSH | 14535B013798C925E2AD4AB8BDF2950106B5D5772102DB5E7CC404DBABAFFC64A123EF
|
|
Config. Field0 | Value |
|---|---|
| Key (AES_256) | Q0FLd0huhuhuhuhuhuhuhuhuhuhu
|
| Pastebin | -huhuhuhu
|
| Certificate | MIICMDhuhuhuhuhuhuhuhuhuhuhu
|
| ServerSignature | J60Cuxhuhuhuhuhuhuhuhuhuhuhu
|
| Install | thuhuhuhu
|
| BDOS | fhuhuhuhu
|
| Anti-VM | fhuhuhuhu
|
| Install File | Googlehuhuhuhuhuhuhu
|
| Install-Folder | %Aphuhuhuhu
|
| Hosts | yqs.ukhuhuhuhuhuhuhuhuhuhuhu
|
| Ports | 80,443huhuhuhuhuhuhuhuhuhuhu
|
| Mutex | Gohuhuhuhu
|
| Version | 1huhuhuhu
|
| Delay | 1huhuhuhu
|
|
Name | Value |
|---|---|
| Info | PE Detect: PeReader OK (file layout) |
| Module Name | GoogleWorkspaceHelper.exe |
| Full Name | GoogleWorkspaceHelper.exe |
| EntryPoint | System.Void Client.Program::Main() |
| Scope Name | GoogleWorkspaceHelper.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v4.0.30319 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | GoogleWorkspaceHelper |
| Assembly Version | 1.0.7.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | .NETFramework,Version=v4.0 |
| Total Strings | 157 |
| Main Method | System.Void Client.Program::Main() |
| Main IL Instruction Count | 77 |
| Main IL | ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::De_lay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> ldsfld System.String Client.Settings::An_ti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0047: leave IL_0052 call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() leave IL_0052: call System.Void Client.Helper.A::B() pop <null> leave IL_0052: call System.Void Client.Helper.A::B() call System.Void Client.Helper.A::B() call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0067: leave IL_0072 ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) leave IL_0072: nop pop <null> leave IL_0072: nop nop <null> ldsfld System.String Client.Settings::Anti_Process call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0087: leave IL_0092 call System.Void Client.Helper.AntiProcess::StartBlock() leave IL_0092: nop pop <null> leave IL_0092: nop nop <null> ldsfld System.String Client.Settings::BS_OD call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_00B1: leave IL_00BC call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_00B1: leave IL_00BC call System.Void Client.Helper.ProcessCritical::Set() leave IL_00BC: nop pop <null> leave IL_00BC: nop nop <null> ldsfld System.String Client.Settings::In_stall call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_00D1: leave IL_00DC call System.Void Client.Install.NormalStartup::Install() leave IL_00DC: call System.Void Client.Helper.Methods::PreventSleep() pop <null> leave IL_00DC: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_00F0: leave IL_00FB call System.Void Client.Helper.Methods::ClearSetting() leave IL_00FB: nop pop <null> leave IL_00FB: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_0110: leave IL_011B call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_011B: ldc.i4 5000 pop <null> leave IL_011B: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_00FB: nop |
|
Name | Value |
|---|---|
| Key (AES_256) | Q0FLd0huhuhuhuhuhuhuhuhuhuhu
|
| CnC | yqshuhuhuhu
|
| CnC | www.huhuhuhuhuhuhu
|
| CnC | www.huhuhuhuhuhuhu
|
| CnC | fcwhuhuhuhu
|
| CnC | www.5huhuhuhuhuhuhu
|
| CnC | 58wihuhuhuhu
|
| CnC | www.pehuhuhuhuhuhuhu
|
| CnC | petrohuhuhuhuhuhuhu
|
| CnC | www.5huhuhuhuhuhuhu
|
| CnC | corhuhuhuhu
|
| CnC | www.chuhuhuhuhuhuhu
|
| CnC | www.8huhuhuhuhuhuhu
|
| CnC | 8xx0huhuhuhu
|
| Ports | 8huhuhuhu
|
| Ports | 4huhuhuhu
|
| Ports | 1huhuhuhu
|
| Ports | 4huhuhuhu
|
| Ports | 5huhuhuhu
|
| Ports | 6huhuhuhu
|
| Ports | 6huhuhuhu
|
| Ports | 8huhuhuhu
|
| Ports | 8huhuhuhu
|
| Mutex | Gohuhuhuhu
|
|
Config. Field0 | Value |
|---|---|
| Key (AES_256) | Q0FLd0huhuhuhuhuhuhuhuhuhuhu
|
| Pastebin | -huhuhuhu
|
| Certificate | MIICMDhuhuhuhuhuhuhuhuhuhuhu
|
| ServerSignature | J60Cuxhuhuhuhuhuhuhuhuhuhuhu
|
| Install | thuhuhuhu
|
| BDOS | fhuhuhuhu
|
| Anti-VM | fhuhuhuhu
|
| Install File | Googlehuhuhuhuhuhuhu
|
| Install-Folder | %Aphuhuhuhu
|
| Hosts | yqs.ukhuhuhuhuhuhuhuhuhuhuhu
|
| Ports | 80,443huhuhuhuhuhuhuhuhuhuhu
|
| Mutex | Gohuhuhuhu
|
| Version | 1huhuhuhu
|
| Delay | 1huhuhuhu
|
|
Name | Value | Location |
|---|---|---|
| Key (AES_256) | Q0FLd0huhuhuhuhuhuhuhuhuhuhu
Malicious |
001c87cc966419eddd0096274f6262b7 |
| CnC | yqshuhuhuhu
Malicious |
001c87cc966419eddd0096274f6262b7 |
| CnC | www.huhuhuhuhuhuhu
Malicious |
001c87cc966419eddd0096274f6262b7 |
| CnC | www.huhuhuhuhuhuhu
Malicious |
001c87cc966419eddd0096274f6262b7 |
| CnC | fcwhuhuhuhu
Malicious |
001c87cc966419eddd0096274f6262b7 |
| CnC | www.5huhuhuhuhuhuhu
Malicious |
001c87cc966419eddd0096274f6262b7 |
| CnC | 58wihuhuhuhu
Malicious |
001c87cc966419eddd0096274f6262b7 |
| CnC | www.pehuhuhuhuhuhuhu
Malicious |
001c87cc966419eddd0096274f6262b7 |
| CnC | petrohuhuhuhuhuhuhu
Malicious |
001c87cc966419eddd0096274f6262b7 |
| CnC | www.5huhuhuhuhuhuhu
Malicious |
001c87cc966419eddd0096274f6262b7 |
| CnC | corhuhuhuhu
Malicious |
001c87cc966419eddd0096274f6262b7 |
| CnC | www.chuhuhuhuhuhuhu
Malicious |
001c87cc966419eddd0096274f6262b7 |
| CnC | www.8huhuhuhuhuhuhu
Malicious |
001c87cc966419eddd0096274f6262b7 |
| CnC | 8xx0huhuhuhu
Malicious |
001c87cc966419eddd0096274f6262b7 |
| Ports | 8huhuhuhu
Malicious |
001c87cc966419eddd0096274f6262b7 |
| Ports | 4huhuhuhu
Malicious |
001c87cc966419eddd0096274f6262b7 |
| Ports | 1huhuhuhu
Malicious |
001c87cc966419eddd0096274f6262b7 |
| Ports | 4huhuhuhu
Malicious |
001c87cc966419eddd0096274f6262b7 |
| Ports | 5huhuhuhu
Malicious |
001c87cc966419eddd0096274f6262b7 |
| Ports | 6huhuhuhu
Malicious |
001c87cc966419eddd0096274f6262b7 |
| Ports | 6huhuhuhu
Malicious |
001c87cc966419eddd0096274f6262b7 |
| Ports | 8huhuhuhu
Malicious |
001c87cc966419eddd0096274f6262b7 |
| Ports | 8huhuhuhu
Malicious |
001c87cc966419eddd0096274f6262b7 |
| Mutex | Gohuhuhuhu
Malicious |
001c87cc966419eddd0096274f6262b7 |