Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very low
MD5 01af93c099eda51a2b46fb2108fc1e2a
Sha1 fd7ec45552919baf92c37cb17b533d5eedfe5758
Sha256 f9ac08dc0d9d265ba44e7b256cc554cd9a741ca2a7e4dc01807376a90f8b1024
Sha384 7231fd550acbc98cf122443c4f260548853a91738cc142fbac6969664b0e991bee6e88727cc931fcf8c8b76d255bd24d
Sha512 9b97303c8804a99166c1918b05c437fc5521e1cfcc0bbf7ed06bcc5c4e7e405b8b24ad593775aaa7fd2c4b21f095d1e1e130b17f63151b8f537ace09b6e78b8d
SSDeep 49152:V8U0SoUQ3nUMOZkDNgSJ71GXRBOkD0J3QIT3sAHQBetjDmWnp8LpMhH3N:eU0PRnUMOZMWSJ71GXAJ3Z4AHEeNyC9d
TLSH 6EB533059D0688A5D5D41CF9287A8BDDCB688DD20E2CDD23DC7C3FA5543DC4A2E2B6E2
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NETUPolyX 0.3 -> delikon
01af93c099eda51a2b46fb2108fc1e2a
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0-preview.png
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
ID:0006
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
dngq.Resources
Creative EAX (1).7z
Creative EAX (1).7z [AES Decoded]
Malicious
Creative EAX (1)
Malicious
EAX Console.exe
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Creative_EAX_Setting.Form1.resources
$this.BackgroundImage
[NBF]root.Data
[NBF]root.Data-preview.png
$this.Icon
[NBF]root.IconData
guna2PictureBox1.BackgroundImage
[NBF]root.Data
[NBF]root.Data-preview.png
guna2PictureBox2.BackgroundImage
[NBF]root.Data
[NBF]root.Data-preview.png
guna2PictureBox3.BackgroundImage
[NBF]root.Data
[NBF]root.Data-preview.png
guna2PictureBox4.BackgroundImage
guna2PictureBox5.BackgroundImage
[NBF]root.Data
[NBF]root.Data-preview.png
pictureBoxArrow.BackgroundImage
[NBF]root.Data
[NBF]root.Data-preview.png
Creative_EAX_Setting.EAXForm.Form2.resources
$this.BackgroundImage
[NBF]root.Data
[NBF]root.Data-preview.png
$this.Icon
[NBF]root.IconData
Creative_EAX_Setting.EAXForm.Form3.resources
$this.BackgroundImage
[NBF]root.Data
[NBF]root.Data-preview.png
$this.Icon
[NBF]root.IconData
Creative_EAX_Setting.EAXForm.Form4.resources
$this.BackgroundImage
[NBF]root.Data
[NBF]root.Data-preview.png
$this.Icon
[NBF]root.IconData
Creative_EAX_Setting.EAXForm.Form5.resources
$this.BackgroundImage
[NBF]root.Data
[NBF]root.Data-preview.png
$this.Icon
[NBF]root.IconData
Creative_EAX_Setting.Form6.resources
$this.BackgroundImage
[NBF]root.Data
[NBF]root.Data-preview.png
Creative_EAX_Setting.EAXForm.Form7.resources
$this.BackgroundImage
[NBF]root.Data
[NBF]root.Data-preview.png
Creative_EAX_Setting.EAXForm.Form8.resources
$this.BackgroundImage
[NBF]root.Data
[NBF]root.Data-preview.png
Creative_EAX_Setting.ModernComboBox.resources
EAXConsole.cur
Guna.UI2.dll
Malicious
.Net Resources
G22190F0D5B1120504B3E00280003060D0F0F4F38724F222206070B01020F0F27012B0C.resources
icon.Image
[NBF]root.Data
[NBF]root.Data-preview.png
Guna.UI2.Properties.Resources.resources
CheckedCheckbox_20px
[NBF]root.Data
[NBF]root.Data-preview.png
CheckedRadioButton_20px
[NBF]root.Data
[NBF]root.Data-preview.png
FullImage_64px
[NBF]root.Data
[NBF]root.Data-preview.png
ImageCalendar
[NBF]root.Data
[NBF]root.Data-preview.png
UncheckedCheckbox_20px
UncheckedRadioButton_20px
[NBF]root.Data
[NBF]root.Data-preview.png
ce_48px
[NBF]root.Data
[NBF]root.Data-preview.png
curv3
[NBF]root.Data
[NBF]root.Data-preview.png
curv3_w
[NBF]root.Data
[NBF]root.Data-preview.png
error
[NBF]root.Data
[NBF]root.Data-preview.png
info
[NBF]root.Data
[NBF]root.Data-preview.png
logo
[NBF]root.Data
[NBF]root.Data-preview.png
logo_w
[NBF]root.Data
[NBF]root.Data-preview.png
miring
[NBF]root.Data
[NBF]root.Data-preview.png
question
[NBF]root.Data
[NBF]root.Data-preview.png
warning
[NBF]root.Data
[NBF]root.Data-preview.png
G22190F0D5B1120504B250025230207091246250F300029390C06331B0E163B151735041C232100000E0B.resources
btDown.Image
btUp.Image
imageList1.ImageStream
[NBF]root.Data
[Authenticode]_b8077f37.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
hand.txt
Melanchall.DryWetMidi.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
Melanchall.DryWetMidi.xml
Melanchall_DryWetMidi_Native32.dll
Overlay_29072150.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.data
.rdata
.bss
.edata
.idata
.CRT
.tls
.reloc
4
14
29
41
55
67
80
Melanchall_DryWetMidi_Native64.dll
Overlay_e56caa8a.bin
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.data
.rdata
.pdata
.xdata
.bss
.edata
.idata
.tls
.reloc
4
19
31
45
57
70
81
Melanchall_DryWetMidi_Native64.dylib
siledr.bmp
siledr.png
siledr.png-preview.png
VoicemeeterRemote.dll
[Authenticode]_a33c5367.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.rsrc
.reloc
VoicemeeterRemote64.dll
[Authenticode]_ada07639.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:1033
RT_GROUP_CURSOR4
ID:0064
ID:1033
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0002
ID:1033
eax3.exe
eax3.exe [AES Decoded]
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
eaxx2.exe
eaxx2.exe [AES Decoded]
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_MANIFEST
ID:0001
ID:0
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
11 / 11
Path pe:exe>arc:7z>pe:dll>pe:rsrc>bin
Shape pe:exe>arc:7z>pe:dll>pe:rsrc>bin
malicious 5 nodes
Path pe:exe>arc:7z>pe:exe>pe:rsrc>bin
Shape pe:exe>arc:7z>pe:exe>pe:rsrc>bin
malicious 5 nodes
Config. Field Value
ref_elem_0x0000000E Creatihuhuhuhuhuhuhuhuhuhuhu
ref_elem_0x00000016 eax3.ehuhuhuhuhuhuhu
ref_elem_0x0000001E eaxx2.huhuhuhuhuhuhu
Workpath %Aphuhuhuhu
SPL -huhuhuhu
Mutex IX508huhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
packet_size [b] 5huhuhuhu
BD [BD] Fhuhuhuhu
directory [DR] Thuhuhuhu
executable_name [EXE] dllhuhuhuhu
cnc_host [H] 8.tcphuhuhuhuhuhuhu
is_dir_defined [Idr] Fhuhuhuhu
Anti_CH Fhuhuhuhu
is_startup_folder [IsF] Fhuhuhuhu
USB_SP Fhuhuhuhu
is_user_reg [Isu] Fhuhuhuhu
cnc_port [P] 1huhuhuhu
reg_key [RG] 1eb30bhuhuhuhuhuhuhuhuhuhuhu
reg_path [sf] Softwahuhuhuhuhuhuhuhuhuhuhu
victim_name [VN] Vihuhuhuhu
version [VR] <- NjRhuhuhuhuhuhuhuhuhuhuhu
splitter [Y] Y262huhuhuhu
MSGE Dihuhuhuhu
MSGT Thhuhuhuhu
MSGB Sorry,huhuhuhuhuhuhuhuhuhuhu
MSGSYM vbChuhuhuhu
OBITO Dihuhuhuhu
TSKE Dihuhuhuhu
TSK Wirehuhuhuhuhuhuhu
KAKASHI Dihuhuhuhu
AKATSUKI Dihuhuhuhu
CLEANSWEEP Dihuhuhuhu
PASTEE Dihuhuhuhu
PASTEBIN https:huhuhuhuhuhuhuhuhuhuhu
CLIP nhuhuhuhu
UAC Dihuhuhuhu
nowifi ohuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Mutex FK4gehuhuhuhuhuhuhu
Hosts 8.tcphuhuhuhuhuhuhu
Port 1huhuhuhu
KEY <12huhuhuhu
USBNM <Xwhuhuhuhu
family xhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
EAX-sound-card.rar.exe
Full Name
EAX-sound-card.rar.exe
EntryPoint
System.Void Program::Main()
Scope Name
EAX-sound-card.rar.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
EAX-sound-card.rar
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
12
Main Method
System.Void Program::Main()
Main IL Instruction Count
159
Main IL 
ldc.i4.1 <null>
stloc.s V_5
call System.Boolean Program::CreateMutex()
brtrue.s IL_0013: call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
ldc.i4.2 <null>
stloc.s V_5
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
ldc.i4.1 <null>
stloc.3 <null>
ldc.i4.5 <null>
stloc.s V_5
ldsfld System.Collections.Generic.List`1<System.String> Program::List
callvirt System.Collections.Generic.List`1/Enumerator<System.String> System.Collections.Generic.List`1<System.String>::GetEnumerator()
stloc.2 <null>
br IL_0130: ldloca.s V_2
ldloca.s V_2
call System.String System.Collections.Generic.List`1/Enumerator<System.String>::get_Current()
stloc.0 <null>
ldc.i4.6 <null>
stloc.s V_5
ldsfld System.String Program::Workpath
call System.Object Program::GETP(System.String)
ldstr \
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::ConcatenateObject(System.Object,System.Object)
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String Program::SPL
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.0 <null>
ldelem.ref <null>
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::ConcatenateObject(System.Object,System.Object)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stloc.1 <null>
ldc.i4.7 <null>
stloc.s V_5
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String Program::SPL
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.2 <null>
ldelem.ref <null>
ldstr True
ldc.i4.0 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean)
ldc.i4.0 <null>
bne.un.s IL_00CB: ldc.i4.s 13
ldc.i4.8 <null>
stloc.s V_5
ldloc.1 <null>
call System.Boolean System.IO.File::Exists(System.String)
brtrue.s IL_00C9: br.s IL_0123
ldc.i4.s 9
stloc.s V_5
ldloc.1 <null>
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String Program::SPL
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.0 <null>
ldelem.ref <null>
call System.Byte[] Program::GetTheResource(System.String)
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
ldc.i4.s 10
stloc.s V_5
ldloc.1 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String)
pop <null>
br.s IL_0123: ldc.i4.s 19
ldc.i4.s 13
stloc.s V_5
ldc.i4.s 14
stloc.s V_5
ldloc.1 <null>
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String Program::SPL
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.0 <null>
ldelem.ref <null>
call System.Byte[] Program::GetTheResource(System.String)
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
ldc.i4.s 15
stloc.s V_5
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String Program::SPL
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.1 <null>
ldelem.ref <null>
ldstr True
ldc.i4.0 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean)
ldc.i4.0 <null>
bne.un.s IL_0123: ldc.i4.s 19
ldc.i4.s 16
stloc.s V_5
ldloc.1 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String)
pop <null>
ldc.i4.s 19
stloc.s V_5
call System.Void System.GC::Collect()
ldc.i4.s 20
stloc.s V_5
ldloca.s V_2
call System.Boolean System.Collections.Generic.List`1/Enumerator<System.String>::MoveNext()
brtrue IL_002D: ldloca.s V_2
ldloca.s V_2
constrained. System.Collections.Generic.List`1/Enumerator<System.String>
callvirt System.Void System.IDisposable::Dispose()
leave IL_01F8: ldloc.s V_4
ldloc.s V_4
br.s IL_0156: ldc.i4.0
ldloc.s V_4
ldc.i4.1 <null>
add <null>
ldc.i4.0 <null>
stloc.s V_4
switch dnlib.DotNet.Emit.Instruction[]
leave.s IL_01ED: ldc.i4 -2146828237
ldloc.s V_5
stloc.s V_4
ldloc.3 <null>
switch dnlib.DotNet.Emit.Instruction[]
leave.s IL_01ED: ldc.i4 -2146828237
isinst System.Exception
ldnull <null>
cgt.un <null>
ldloc.3 <null>
ldc.i4.0 <null>
cgt.un <null>
and <null>
ldloc.s V_4
ldc.i4.0 <null>
ceq <null>
and <null>
endfilter <null>
castclass System.Exception
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
leave.s IL_01B8: ldloc.s V_5
ldc.i4 -2146828237
call System.Exception Microsoft.VisualBasic.CompilerServices.ProjectData::CreateProjectError(System.Int32)
throw <null>
ldloc.s V_4
brfalse.s IL_0201: ret
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
ret <null>
Module Name
EAX-sound-card.rar.exe
Full Name
EAX-sound-card.rar.exe
EntryPoint
System.Void Program::Main()
Scope Name
EAX-sound-card.rar.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
EAX-sound-card.rar
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
12
Main Method
System.Void Program::Main()
Main IL Instruction Count
159
Main IL 
ldc.i4.1 <null>
stloc.s V_5
call System.Boolean Program::CreateMutex()
brtrue.s IL_0013: call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
ldc.i4.2 <null>
stloc.s V_5
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
ldc.i4.1 <null>
stloc.3 <null>
ldc.i4.5 <null>
stloc.s V_5
ldsfld System.Collections.Generic.List`1<System.String> Program::List
callvirt System.Collections.Generic.List`1/Enumerator<System.String> System.Collections.Generic.List`1<System.String>::GetEnumerator()
stloc.2 <null>
br IL_0130: ldloca.s V_2
ldloca.s V_2
call System.String System.Collections.Generic.List`1/Enumerator<System.String>::get_Current()
stloc.0 <null>
ldc.i4.6 <null>
stloc.s V_5
ldsfld System.String Program::Workpath
call System.Object Program::GETP(System.String)
ldstr \
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::ConcatenateObject(System.Object,System.Object)
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String Program::SPL
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.0 <null>
ldelem.ref <null>
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::ConcatenateObject(System.Object,System.Object)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stloc.1 <null>
ldc.i4.7 <null>
stloc.s V_5
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String Program::SPL
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.2 <null>
ldelem.ref <null>
ldstr True
ldc.i4.0 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean)
ldc.i4.0 <null>
bne.un.s IL_00CB: ldc.i4.s 13
ldc.i4.8 <null>
stloc.s V_5
ldloc.1 <null>
call System.Boolean System.IO.File::Exists(System.String)
brtrue.s IL_00C9: br.s IL_0123
ldc.i4.s 9
stloc.s V_5
ldloc.1 <null>
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String Program::SPL
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.0 <null>
ldelem.ref <null>
call System.Byte[] Program::GetTheResource(System.String)
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
ldc.i4.s 10
stloc.s V_5
ldloc.1 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String)
pop <null>
br.s IL_0123: ldc.i4.s 19
ldc.i4.s 13
stloc.s V_5
ldc.i4.s 14
stloc.s V_5
ldloc.1 <null>
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String Program::SPL
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.0 <null>
ldelem.ref <null>
call System.Byte[] Program::GetTheResource(System.String)
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
ldc.i4.s 15
stloc.s V_5
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String Program::SPL
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.1 <null>
ldelem.ref <null>
ldstr True
ldc.i4.0 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean)
ldc.i4.0 <null>
bne.un.s IL_0123: ldc.i4.s 19
ldc.i4.s 16
stloc.s V_5
ldloc.1 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String)
pop <null>
ldc.i4.s 19
stloc.s V_5
call System.Void System.GC::Collect()
ldc.i4.s 20
stloc.s V_5
ldloca.s V_2
call System.Boolean System.Collections.Generic.List`1/Enumerator<System.String>::MoveNext()
brtrue IL_002D: ldloca.s V_2
ldloca.s V_2
constrained. System.Collections.Generic.List`1/Enumerator<System.String>
callvirt System.Void System.IDisposable::Dispose()
leave IL_01F8: ldloc.s V_4
ldloc.s V_4
br.s IL_0156: ldc.i4.0
ldloc.s V_4
ldc.i4.1 <null>
add <null>
ldc.i4.0 <null>
stloc.s V_4
switch dnlib.DotNet.Emit.Instruction[]
leave.s IL_01ED: ldc.i4 -2146828237
ldloc.s V_5
stloc.s V_4
ldloc.3 <null>
switch dnlib.DotNet.Emit.Instruction[]
leave.s IL_01ED: ldc.i4 -2146828237
isinst System.Exception
ldnull <null>
cgt.un <null>
ldloc.3 <null>
ldc.i4.0 <null>
cgt.un <null>
and <null>
ldloc.s V_4
ldc.i4.0 <null>
ceq <null>
and <null>
endfilter <null>
castclass System.Exception
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
leave.s IL_01B8: ldloc.s V_5
ldc.i4 -2146828237
call System.Exception Microsoft.VisualBasic.CompilerServices.ProjectData::CreateProjectError(System.Int32)
throw <null>
ldloc.s V_4
brfalse.s IL_0201: ret
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
ret <null>
CnC CNCmalicious
8.tcphuhuhuhuhuhuhu
Port PORTmalicious
1huhuhuhu
Mutex MUTEXmalicious
FK4gehuhuhuhuhuhuhu
Port PORTmalicious
1huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
01af93c099eda51a2b46fb2108fc1e2a
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0-preview.png
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
ID:0006
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
dngq.Resources
Creative EAX (1).7z
Creative EAX (1).7z [AES Decoded]
Malicious
Creative EAX (1)
Malicious
EAX Console.exe
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Creative_EAX_Setting.Form1.resources
$this.BackgroundImage
[NBF]root.Data
[NBF]root.Data-preview.png
$this.Icon
[NBF]root.IconData
guna2PictureBox1.BackgroundImage
[NBF]root.Data
[NBF]root.Data-preview.png
guna2PictureBox2.BackgroundImage
[NBF]root.Data
[NBF]root.Data-preview.png
guna2PictureBox3.BackgroundImage
[NBF]root.Data
[NBF]root.Data-preview.png
guna2PictureBox4.BackgroundImage
guna2PictureBox5.BackgroundImage
[NBF]root.Data
[NBF]root.Data-preview.png
pictureBoxArrow.BackgroundImage
[NBF]root.Data
[NBF]root.Data-preview.png
Creative_EAX_Setting.EAXForm.Form2.resources
$this.BackgroundImage
[NBF]root.Data
[NBF]root.Data-preview.png
$this.Icon
[NBF]root.IconData
Creative_EAX_Setting.EAXForm.Form3.resources
$this.BackgroundImage
[NBF]root.Data
[NBF]root.Data-preview.png
$this.Icon
[NBF]root.IconData
Creative_EAX_Setting.EAXForm.Form4.resources
$this.BackgroundImage
[NBF]root.Data
[NBF]root.Data-preview.png
$this.Icon
[NBF]root.IconData
Creative_EAX_Setting.EAXForm.Form5.resources
$this.BackgroundImage
[NBF]root.Data
[NBF]root.Data-preview.png
$this.Icon
[NBF]root.IconData
Creative_EAX_Setting.Form6.resources
$this.BackgroundImage
[NBF]root.Data
[NBF]root.Data-preview.png
Creative_EAX_Setting.EAXForm.Form7.resources
$this.BackgroundImage
[NBF]root.Data
[NBF]root.Data-preview.png
Creative_EAX_Setting.EAXForm.Form8.resources
$this.BackgroundImage
[NBF]root.Data
[NBF]root.Data-preview.png
Creative_EAX_Setting.ModernComboBox.resources
EAXConsole.cur
Guna.UI2.dll
Malicious
.Net Resources
G22190F0D5B1120504B3E00280003060D0F0F4F38724F222206070B01020F0F27012B0C.resources
icon.Image
[NBF]root.Data
[NBF]root.Data-preview.png
Guna.UI2.Properties.Resources.resources
CheckedCheckbox_20px
[NBF]root.Data
[NBF]root.Data-preview.png
CheckedRadioButton_20px
[NBF]root.Data
[NBF]root.Data-preview.png
FullImage_64px
[NBF]root.Data
[NBF]root.Data-preview.png
ImageCalendar
[NBF]root.Data
[NBF]root.Data-preview.png
UncheckedCheckbox_20px
UncheckedRadioButton_20px
[NBF]root.Data
[NBF]root.Data-preview.png
ce_48px
[NBF]root.Data
[NBF]root.Data-preview.png
curv3
[NBF]root.Data
[NBF]root.Data-preview.png
curv3_w
[NBF]root.Data
[NBF]root.Data-preview.png
error
[NBF]root.Data
[NBF]root.Data-preview.png
info
[NBF]root.Data
[NBF]root.Data-preview.png
logo
[NBF]root.Data
[NBF]root.Data-preview.png
logo_w
[NBF]root.Data
[NBF]root.Data-preview.png
miring
[NBF]root.Data
[NBF]root.Data-preview.png
question
[NBF]root.Data
[NBF]root.Data-preview.png
warning
[NBF]root.Data
[NBF]root.Data-preview.png
G22190F0D5B1120504B250025230207091246250F300029390C06331B0E163B151735041C232100000E0B.resources
btDown.Image
btUp.Image
imageList1.ImageStream
[NBF]root.Data
[Authenticode]_b8077f37.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
hand.txt
Melanchall.DryWetMidi.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
Melanchall.DryWetMidi.xml
Melanchall_DryWetMidi_Native32.dll
Overlay_29072150.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.data
.rdata
.bss
.edata
.idata
.CRT
.tls
.reloc
4
14
29
41
55
67
80
Melanchall_DryWetMidi_Native64.dll
Overlay_e56caa8a.bin
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.data
.rdata
.pdata
.xdata
.bss
.edata
.idata
.tls
.reloc
4
19
31
45
57
70
81
Melanchall_DryWetMidi_Native64.dylib
siledr.bmp
siledr.png
siledr.png-preview.png
VoicemeeterRemote.dll
[Authenticode]_a33c5367.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.rsrc
.reloc
VoicemeeterRemote64.dll
[Authenticode]_ada07639.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:1033
RT_GROUP_CURSOR4
ID:0064
ID:1033
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0002
ID:1033
eax3.exe
eax3.exe [AES Decoded]
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
eaxx2.exe
eaxx2.exe [AES Decoded]
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_MANIFEST
ID:0001
ID:0
Config. Field Value
ref_elem_0x0000000E Creatihuhuhuhuhuhuhuhuhuhuhu
ref_elem_0x00000016 eax3.ehuhuhuhuhuhuhu
ref_elem_0x0000001E eaxx2.huhuhuhuhuhuhu
Workpath %Aphuhuhuhu
SPL -huhuhuhu
Mutex IX508huhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
packet_size [b] 5huhuhuhu
BD [BD] Fhuhuhuhu
directory [DR] Thuhuhuhu
executable_name [EXE] dllhuhuhuhu
cnc_host [H] 8.tcphuhuhuhuhuhuhu
is_dir_defined [Idr] Fhuhuhuhu
Anti_CH Fhuhuhuhu
is_startup_folder [IsF] Fhuhuhuhu
USB_SP Fhuhuhuhu
is_user_reg [Isu] Fhuhuhuhu
cnc_port [P] 1huhuhuhu
reg_key [RG] 1eb30bhuhuhuhuhuhuhuhuhuhuhu
reg_path [sf] Softwahuhuhuhuhuhuhuhuhuhuhu
victim_name [VN] Vihuhuhuhu
version [VR] <- NjRhuhuhuhuhuhuhuhuhuhuhu
splitter [Y] Y262huhuhuhu
MSGE Dihuhuhuhu
MSGT Thhuhuhuhu
MSGB Sorry,huhuhuhuhuhuhuhuhuhuhu
MSGSYM vbChuhuhuhu
OBITO Dihuhuhuhu
TSKE Dihuhuhuhu
TSK Wirehuhuhuhuhuhuhu
KAKASHI Dihuhuhuhu
AKATSUKI Dihuhuhuhu
CLEANSWEEP Dihuhuhuhu
PASTEE Dihuhuhuhu
PASTEBIN https:huhuhuhuhuhuhuhuhuhuhu
CLIP nhuhuhuhu
UAC Dihuhuhuhu
nowifi ohuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Mutex FK4gehuhuhuhuhuhuhu
Hosts 8.tcphuhuhuhuhuhuhu
Port 1huhuhuhu
KEY <12huhuhuhu
USBNM <Xwhuhuhuhu
family xhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
CnC CNCmalicious
8.tcphuhuhuhuhuhuhu
01af93c099eda51a2b46fb2108fc1e2a › .Net Resources › dngq.Resources › eaxx2.exe › eaxx2.exe [AES Decoded]
Port PORTmalicious
1huhuhuhu
01af93c099eda51a2b46fb2108fc1e2a › .Net Resources › dngq.Resources › eaxx2.exe › eaxx2.exe [AES Decoded]
Mutex MUTEXmalicious
FK4gehuhuhuhuhuhuhu
01af93c099eda51a2b46fb2108fc1e2a › .Net Resources › dngq.Resources › eax3.exe › eax3.exe [AES Decoded]
Port PORTmalicious
1huhuhuhu
01af93c099eda51a2b46fb2108fc1e2a › .Net Resources › dngq.Resources › eax3.exe › eax3.exe [AES Decoded]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙