Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

This sample is a 2.2 MB PE Executable identified by Malva.RE as XBinder / XBinder Variant / XRijMut Loader (loader, crypter, rat). Static analysis extracted 163 embedded or derived files, a malware configuration (XBinder config., njRAT config., XWorm config.) and 1 command-and-control endpoint. It matches 41 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
f9ac08dc0d9d265ba44e7b256cc554cd9a741ca2a7e4dc01807376a90f8b1024
MD5
01af93c099eda51a2b46fb2108fc1e2a
Verdict
Malicious
File type
PE Executable · 2.2 MB
Family
XBinderXBinder VariantXRijMut Loader
Category
Loader, Crypter, RAT
C2 (defanged)
8[.]tcp[.]cpolar[.]top

Cite this report: https://app.malva.re/sha256/f9ac08dc0d9d265ba44e7b256cc554cd9a741ca2a7e4dc01807376a90f8b1024

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
2.27 MB · 2,268,672 B
First seen
2026-09-13 17:15 · one month ago
Last seen
2026-09-13 17:15 · one month ago
Last analysis
2026-09-13 17:15 · one month ago
Hashes
MD5 01af93c099eda51a2b46fb2108fc1e2a Sha1 fd7ec45552919baf92c37cb17b533d5eedfe5758 Sha256 f9ac08dc0d9d265ba44e7b256cc554cd9a741ca2a7e4dc01807376a90f8b1024 Sha384 7231fd550acbc98cf122443c4f260548853a91738cc142fbac6969664b0e991bee6e88727cc931fcf8c8b76d255bd24d Sha512 9b97303c8804a99166c1918b05c437fc5521e1cfcc0bbf7ed06bcc5c4e7e405b8b24ad593775aaa7fd2c4b21f095d1e1e130b17f63151b8f537ace09b6e78b8d SSDeep 49152:V8U0SoUQ3nUMOZkDNgSJ71GXRBOkD0J3QIT3sAHQBetjDmWnp8LpMhH3N:eU0PRnUMOZMWSJ71GXAJ3Z4AHEeNyC9d TLSH 6EB533059D0688A5D5D41CF9287A8BDDCB688DD20E2CDD23DC7C3FA5543DC4A2E2B6E2
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NETUPolyX 0.3 -> delikon
Symbol obfuscation
Very low

5 malicious · 164 files
EXE01af93c099eda51a2b46fb2108fc1e2anjRat
Structure
BINResources
BINRT_ICON
BINID:0001
IMGID:0
IMGID:0-preview.png
BINID:0002
BINID:0
BINID:0003
BINID:0
BINID:0004
BINID:0
BINID:0005
BINID:0
BINID:0006
BINID:0
BINRT_GROUP_CURSOR4
BINID:0001
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN.Net Resources
BINdngq.Resources
7ZCreative EAX (1).7z
7ZCreative EAX (1).7z [AES Decoded]AgentTesla
BINCreative EAX (1)
EXEEAX Console.exe
Structure
BINResources
BINRT_ICON
BINID:0001
BINID:0
BINRT_GROUP_CURSOR4
BINID:7F00
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN.Net Resources
BINCreative_EAX_Setting.Form1.resources
BIN$this.BackgroundImage
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
ICON$this.Icon
BIN[NBF]root.IconData
BINguna2PictureBox1.BackgroundImage
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINguna2PictureBox2.BackgroundImage
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINguna2PictureBox3.BackgroundImage
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINguna2PictureBox4.BackgroundImage
BINguna2PictureBox5.BackgroundImage
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINpictureBoxArrow.BackgroundImage
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINCreative_EAX_Setting.EAXForm.Form2.resources
BIN$this.BackgroundImage
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
ICON$this.Icon
BIN[NBF]root.IconData
BINCreative_EAX_Setting.EAXForm.Form3.resources
BIN$this.BackgroundImage
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
ICON$this.Icon
BIN[NBF]root.IconData
BINCreative_EAX_Setting.EAXForm.Form4.resources
BIN$this.BackgroundImage
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
ICON$this.Icon
BIN[NBF]root.IconData
BINCreative_EAX_Setting.EAXForm.Form5.resources
BIN$this.BackgroundImage
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
ICON$this.Icon
BIN[NBF]root.IconData
BINCreative_EAX_Setting.Form6.resources
BIN$this.BackgroundImage
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINCreative_EAX_Setting.EAXForm.Form7.resources
BIN$this.BackgroundImage
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINCreative_EAX_Setting.EAXForm.Form8.resources
BIN$this.BackgroundImage
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINCreative_EAX_Setting.ModernComboBox.resources
CUREAXConsole.cur
DLLGuna.UI2.dllAgentTesla
Structure
BIN.Net Resources
BING22190F0D5B1120504B3E00280003060D0F0F4F38724F222206070B01020F0F27012B0C.resources
BINicon.Image
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINGuna.UI2.Properties.Resources.resources
BINCheckedCheckbox_20px
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINCheckedRadioButton_20px
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINFullImage_64px
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINImageCalendar
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINUncheckedCheckbox_20px
BINUncheckedRadioButton_20px
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINce_48px
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINcurv3
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINcurv3_w
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINerror
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINinfo
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINlogo
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINlogo_w
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINmiring
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINquestion
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINwarning
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BING22190F0D5B1120504B250025230207091246250F300029390C06331B0E163B151735041C232100000E0B.resources
BINbtDown.Image
BINbtUp.Image
BINimageList1.ImageStream
DATA[NBF]root.Data
P7B[Authenticode]_b8077f37.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
TXThand.txt
DLLMelanchall.DryWetMidi.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
XMLMelanchall.DryWetMidi.xml
DLLMelanchall_DryWetMidi_Native32.dll
Structure
BINOverlay_29072150.bin
BIN(folder)
BIN4
BIN14
BIN29
BIN41
BIN55
BIN67
BIN80
DLLMelanchall_DryWetMidi_Native64.dll
Structure
BINOverlay_e56caa8a.bin
BIN(folder)
BIN4
BIN19
BIN31
BIN45
BIN57
BIN70
BIN81
BINMelanchall_DryWetMidi_Native64.dylib
BMPsiledr.bmp
IMGsiledr.png
IMGsiledr.png-preview.png
DLLVoicemeeterRemote.dll
Structure
P7B[Authenticode]_a33c5367.p7b
DLLVoicemeeterRemote64.dll
Structure
P7B[Authenticode]_ada07639.p7b
BINResources
BINRT_ICON
BINID:0001
BINID:1033
BINRT_GROUP_CURSOR4
BINID:0064
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
BINRT_MANIFEST
BINID:0002
BINID:1033
EXEeax3.exe
EXEeax3.exe [AES Decoded]XWorm
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
EXEeaxx2.exe
EXEeaxx2.exe [AES Decoded]njRat
Structure
BINResources
BINRT_MANIFEST
BINID:0001
BINID:0
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
11 / 11
Path pe:exe>arc:7z>pe:dll>pe:rsrc>bin
Shape pe:exe>arc:7z>pe:dll>pe:rsrc>bin
malicious 5 nodes
Path pe:exe>arc:7z>pe:exe>pe:rsrc>bin
Shape pe:exe>arc:7z>pe:exe>pe:rsrc>bin
malicious 5 nodes

Config. Field Value
ref_elem_0x0000000E Creatihuhuhuhuhuhuhuhuhuhuhu
ref_elem_0x00000016 eax3.ehuhuhuhuhuhuhu
ref_elem_0x0000001E eaxx2.huhuhuhuhuhuhu
Workpath %Aphuhuhuhu
SPL -huhuhuhu
Mutex IX508huhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Config. Field Value
packet_size [b] 5huhuhuhu
BD [BD] Fhuhuhuhu
directory [DR] Thuhuhuhu
executable_name [EXE] dllhuhuhuhu
cnc_host [H] 8.tcphuhuhuhuhuhuhu
is_dir_defined [Idr] Fhuhuhuhu
Anti_CH Fhuhuhuhu
is_startup_folder [IsF] Fhuhuhuhu
USB_SP Fhuhuhuhu
is_user_reg [Isu] Fhuhuhuhu
cnc_port [P] 1huhuhuhu
reg_key [RG] 1eb30bhuhuhuhuhuhuhuhuhuhuhu
reg_path [sf] Softwahuhuhuhuhuhuhuhuhuhuhu
victim_name [VN] Vihuhuhuhu
version [VR] <- NjRhuhuhuhuhuhuhuhuhuhuhu
splitter [Y] Y262huhuhuhu
MSGE Dihuhuhuhu
MSGT Thhuhuhuhu
MSGB Sorry,huhuhuhuhuhuhuhuhuhuhu
MSGSYM vbChuhuhuhu
OBITO Dihuhuhuhu
TSKE Dihuhuhuhu
TSK Wirehuhuhuhuhuhuhu
KAKASHI Dihuhuhuhu
AKATSUKI Dihuhuhuhu
CLEANSWEEP Dihuhuhuhu
PASTEE Dihuhuhuhu
PASTEBIN https:huhuhuhuhuhuhuhuhuhuhu
CLIP nhuhuhuhu
UAC Dihuhuhuhu
nowifi ohuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Config. Field Value
Mutex FK4gehuhuhuhuhuhuhu
Hosts 8.tcphuhuhuhuhuhuhu
Port 1huhuhuhu
KEY <12huhuhuhu
USBNM <Xwhuhuhuhu
family xhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Name Value
Module Name
EAX-sound-card.rar.exe
Full Name
EAX-sound-card.rar.exe
EntryPoint
System.Void Program::Main()
Scope Name
EAX-sound-card.rar.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
EAX-sound-card.rar
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
12
Main Method
System.Void Program::Main()
Main IL Instruction Count
159
Main IL 
ldc.i4.1 <null>
stloc.s V_5
call System.Boolean Program::CreateMutex()
brtrue.s IL_0013: call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
ldc.i4.2 <null>
stloc.s V_5
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
ldc.i4.1 <null>
stloc.3 <null>
ldc.i4.5 <null>
stloc.s V_5
ldsfld System.Collections.Generic.List`1<System.String> Program::List
callvirt System.Collections.Generic.List`1/Enumerator<System.String> System.Collections.Generic.List`1<System.String>::GetEnumerator()
stloc.2 <null>
br IL_0130: ldloca.s V_2
ldloca.s V_2
call System.String System.Collections.Generic.List`1/Enumerator<System.String>::get_Current()
stloc.0 <null>
ldc.i4.6 <null>
stloc.s V_5
ldsfld System.String Program::Workpath
call System.Object Program::GETP(System.String)
ldstr \
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::ConcatenateObject(System.Object,System.Object)
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String Program::SPL
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.0 <null>
ldelem.ref <null>
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::ConcatenateObject(System.Object,System.Object)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stloc.1 <null>
ldc.i4.7 <null>
stloc.s V_5
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String Program::SPL
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.2 <null>
ldelem.ref <null>
ldstr True
ldc.i4.0 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean)
ldc.i4.0 <null>
bne.un.s IL_00CB: ldc.i4.s 13
ldc.i4.8 <null>
stloc.s V_5
ldloc.1 <null>
call System.Boolean System.IO.File::Exists(System.String)
brtrue.s IL_00C9: br.s IL_0123
ldc.i4.s 9
stloc.s V_5
ldloc.1 <null>
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String Program::SPL
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.0 <null>
ldelem.ref <null>
call System.Byte[] Program::GetTheResource(System.String)
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
ldc.i4.s 10
stloc.s V_5
ldloc.1 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String)
pop <null>
br.s IL_0123: ldc.i4.s 19
ldc.i4.s 13
stloc.s V_5
ldc.i4.s 14
stloc.s V_5
ldloc.1 <null>
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String Program::SPL
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.0 <null>
ldelem.ref <null>
call System.Byte[] Program::GetTheResource(System.String)
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
ldc.i4.s 15
stloc.s V_5
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String Program::SPL
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.1 <null>
ldelem.ref <null>
ldstr True
ldc.i4.0 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean)
ldc.i4.0 <null>
bne.un.s IL_0123: ldc.i4.s 19
ldc.i4.s 16
stloc.s V_5
ldloc.1 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String)
pop <null>
ldc.i4.s 19
stloc.s V_5
call System.Void System.GC::Collect()
ldc.i4.s 20
stloc.s V_5
ldloca.s V_2
call System.Boolean System.Collections.Generic.List`1/Enumerator<System.String>::MoveNext()
brtrue IL_002D: ldloca.s V_2
ldloca.s V_2
constrained. System.Collections.Generic.List`1/Enumerator<System.String>
callvirt System.Void System.IDisposable::Dispose()
leave IL_01F8: ldloc.s V_4
ldloc.s V_4
br.s IL_0156: ldc.i4.0
ldloc.s V_4
ldc.i4.1 <null>
add <null>
ldc.i4.0 <null>
stloc.s V_4
switch dnlib.DotNet.Emit.Instruction[]
leave.s IL_01ED: ldc.i4 -2146828237
ldloc.s V_5
stloc.s V_4
ldloc.3 <null>
switch dnlib.DotNet.Emit.Instruction[]
leave.s IL_01ED: ldc.i4 -2146828237
isinst System.Exception
ldnull <null>
cgt.un <null>
ldloc.3 <null>
ldc.i4.0 <null>
cgt.un <null>
and <null>
ldloc.s V_4
ldc.i4.0 <null>
ceq <null>
and <null>
endfilter <null>
castclass System.Exception
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
leave.s IL_01B8: ldloc.s V_5
ldc.i4 -2146828237
call System.Exception Microsoft.VisualBasic.CompilerServices.ProjectData::CreateProjectError(System.Int32)
throw <null>
ldloc.s V_4
brfalse.s IL_0201: ret
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
ret <null>
Module Name
EAX-sound-card.rar.exe
Full Name
EAX-sound-card.rar.exe
EntryPoint
System.Void Program::Main()
Scope Name
EAX-sound-card.rar.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
EAX-sound-card.rar
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
12
Main Method
System.Void Program::Main()
Main IL Instruction Count
159
Main IL 
ldc.i4.1 <null>
stloc.s V_5
call System.Boolean Program::CreateMutex()
brtrue.s IL_0013: call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
ldc.i4.2 <null>
stloc.s V_5
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
ldc.i4.1 <null>
stloc.3 <null>
ldc.i4.5 <null>
stloc.s V_5
ldsfld System.Collections.Generic.List`1<System.String> Program::List
callvirt System.Collections.Generic.List`1/Enumerator<System.String> System.Collections.Generic.List`1<System.String>::GetEnumerator()
stloc.2 <null>
br IL_0130: ldloca.s V_2
ldloca.s V_2
call System.String System.Collections.Generic.List`1/Enumerator<System.String>::get_Current()
stloc.0 <null>
ldc.i4.6 <null>
stloc.s V_5
ldsfld System.String Program::Workpath
call System.Object Program::GETP(System.String)
ldstr \
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::ConcatenateObject(System.Object,System.Object)
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String Program::SPL
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.0 <null>
ldelem.ref <null>
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::ConcatenateObject(System.Object,System.Object)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stloc.1 <null>
ldc.i4.7 <null>
stloc.s V_5
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String Program::SPL
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.2 <null>
ldelem.ref <null>
ldstr True
ldc.i4.0 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean)
ldc.i4.0 <null>
bne.un.s IL_00CB: ldc.i4.s 13
ldc.i4.8 <null>
stloc.s V_5
ldloc.1 <null>
call System.Boolean System.IO.File::Exists(System.String)
brtrue.s IL_00C9: br.s IL_0123
ldc.i4.s 9
stloc.s V_5
ldloc.1 <null>
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String Program::SPL
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.0 <null>
ldelem.ref <null>
call System.Byte[] Program::GetTheResource(System.String)
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
ldc.i4.s 10
stloc.s V_5
ldloc.1 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String)
pop <null>
br.s IL_0123: ldc.i4.s 19
ldc.i4.s 13
stloc.s V_5
ldc.i4.s 14
stloc.s V_5
ldloc.1 <null>
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String Program::SPL
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.0 <null>
ldelem.ref <null>
call System.Byte[] Program::GetTheResource(System.String)
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
ldc.i4.s 15
stloc.s V_5
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String Program::SPL
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.1 <null>
ldelem.ref <null>
ldstr True
ldc.i4.0 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean)
ldc.i4.0 <null>
bne.un.s IL_0123: ldc.i4.s 19
ldc.i4.s 16
stloc.s V_5
ldloc.1 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String)
pop <null>
ldc.i4.s 19
stloc.s V_5
call System.Void System.GC::Collect()
ldc.i4.s 20
stloc.s V_5
ldloca.s V_2
call System.Boolean System.Collections.Generic.List`1/Enumerator<System.String>::MoveNext()
brtrue IL_002D: ldloca.s V_2
ldloca.s V_2
constrained. System.Collections.Generic.List`1/Enumerator<System.String>
callvirt System.Void System.IDisposable::Dispose()
leave IL_01F8: ldloc.s V_4
ldloc.s V_4
br.s IL_0156: ldc.i4.0
ldloc.s V_4
ldc.i4.1 <null>
add <null>
ldc.i4.0 <null>
stloc.s V_4
switch dnlib.DotNet.Emit.Instruction[]
leave.s IL_01ED: ldc.i4 -2146828237
ldloc.s V_5
stloc.s V_4
ldloc.3 <null>
switch dnlib.DotNet.Emit.Instruction[]
leave.s IL_01ED: ldc.i4 -2146828237
isinst System.Exception
ldnull <null>
cgt.un <null>
ldloc.3 <null>
ldc.i4.0 <null>
cgt.un <null>
and <null>
ldloc.s V_4
ldc.i4.0 <null>
ceq <null>
and <null>
endfilter <null>
castclass System.Exception
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
leave.s IL_01B8: ldloc.s V_5
ldc.i4 -2146828237
call System.Exception Microsoft.VisualBasic.CompilerServices.ProjectData::CreateProjectError(System.Int32)
throw <null>
ldloc.s V_4
brfalse.s IL_0201: ret
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
ret <null>

CnC CNCmalicious
8.tcphuhuhuhuhuhuhu
Port PORTmalicious
1huhuhuhu
Mutex MUTEXmalicious
FK4gehuhuhuhuhuhuhu
Port PORTmalicious
1huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

5 malicious · 164 files
EXE01af93c099eda51a2b46fb2108fc1e2anjRat
Structure
BIN.Net Resources
BINdngq.Resources
7ZCreative EAX (1).7z
7ZCreative EAX (1).7z [AES Decoded]AgentTesla
BINCreative EAX (1)
CUREAXConsole.cur
DLLGuna.UI2.dllAgentTesla
Structure
P7B[Authenticode]_b8077f37.p7b
TXThand.txt
XMLMelanchall.DryWetMidi.xml
BINMelanchall_DryWetMidi_Native64.dylib
BMPsiledr.bmp
EXEeax3.exe
EXEeax3.exe [AES Decoded]XWorm
Structure
EXEeaxx2.exe
EXEeaxx2.exe [AES Decoded]njRat
Structure

Config. Field Value
ref_elem_0x0000000E Creatihuhuhuhuhuhuhuhuhuhuhu
ref_elem_0x00000016 eax3.ehuhuhuhuhuhuhu
ref_elem_0x0000001E eaxx2.huhuhuhuhuhuhu
Workpath %Aphuhuhuhu
SPL -huhuhuhu
Mutex IX508huhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Config. Field Value
packet_size [b] 5huhuhuhu
BD [BD] Fhuhuhuhu
directory [DR] Thuhuhuhu
executable_name [EXE] dllhuhuhuhu
cnc_host [H] 8.tcphuhuhuhuhuhuhu
is_dir_defined [Idr] Fhuhuhuhu
Anti_CH Fhuhuhuhu
is_startup_folder [IsF] Fhuhuhuhu
USB_SP Fhuhuhuhu
is_user_reg [Isu] Fhuhuhuhu
cnc_port [P] 1huhuhuhu
reg_key [RG] 1eb30bhuhuhuhuhuhuhuhuhuhuhu
reg_path [sf] Softwahuhuhuhuhuhuhuhuhuhuhu
victim_name [VN] Vihuhuhuhu
version [VR] <- NjRhuhuhuhuhuhuhuhuhuhuhu
splitter [Y] Y262huhuhuhu
MSGE Dihuhuhuhu
MSGT Thhuhuhuhu
MSGB Sorry,huhuhuhuhuhuhuhuhuhuhu
MSGSYM vbChuhuhuhu
OBITO Dihuhuhuhu
TSKE Dihuhuhuhu
TSK Wirehuhuhuhuhuhuhu
KAKASHI Dihuhuhuhu
AKATSUKI Dihuhuhuhu
CLEANSWEEP Dihuhuhuhu
PASTEE Dihuhuhuhu
PASTEBIN https:huhuhuhuhuhuhuhuhuhuhu
CLIP nhuhuhuhu
UAC Dihuhuhuhu
nowifi ohuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Config. Field Value
Mutex FK4gehuhuhuhuhuhuhu
Hosts 8.tcphuhuhuhuhuhuhu
Port 1huhuhuhu
KEY <12huhuhuhu
USBNM <Xwhuhuhuhu
family xhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

CnC CNCmalicious
8.tcphuhuhuhuhuhuhu
01af93c099eda51a2b46fb2108fc1e2a › .Net Resources › dngq.Resources › eaxx2.exe › eaxx2.exe [AES Decoded]
Port PORTmalicious
1huhuhuhu
01af93c099eda51a2b46fb2108fc1e2a › .Net Resources › dngq.Resources › eaxx2.exe › eaxx2.exe [AES Decoded]
Mutex MUTEXmalicious
FK4gehuhuhuhuhuhuhu
01af93c099eda51a2b46fb2108fc1e2a › .Net Resources › dngq.Resources › eax3.exe › eax3.exe [AES Decoded]
Port PORTmalicious
1huhuhuhu
01af93c099eda51a2b46fb2108fc1e2a › .Net Resources › dngq.Resources › eax3.exe › eax3.exe [AES Decoded]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙