Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Low
1 malicious · 3 files
EXE044011bd4f8ff29f900d646d831202b0njRat
Structure
Config. Field Value
Key (AES_256) UlZ2c2huhuhuhuhuhuhuhuhuhuhu
Pastebin -huhuhuhu
Certificate MIIE8jhuhuhuhuhuhuhuhuhuhuhu
ServerSignature OV/M+2huhuhuhuhuhuhuhuhuhuhu
Install thuhuhuhu
BDOS fhuhuhuhu
Anti-VM fhuhuhuhu
Install File yandehuhuhuhuhuhuhu
Install-Folder %Aphuhuhuhu
Hosts 127.0.huhuhuhuhuhuhu
Ports 6606huhuhuhuhuhuhu
Mutex 63iohuhuhuhu
Version 0huhuhuhu
Delay 3huhuhuhu
Group Dehuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
AsyncClient.exe
Full Name
AsyncClient.exe
EntryPoint
System.Void Client.Program::Main()
Scope Name
AsyncClient.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
AsyncClient
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
171
Main Method
System.Void Client.Program::Main()
Main IL Instruction Count
180
Main IL 
newobj System.Void Client.Program/<>c__DisplayClass3_0::.ctor()
stloc.0 <null>
call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
stloc.1 <null>
ldloc.0 <null>
ldloc.1 <null>
callvirt System.Diagnostics.ProcessModule System.Diagnostics.Process::get_MainModule()
callvirt System.String System.Diagnostics.ProcessModule::get_FileName()
stfld System.String Client.Program/<>c__DisplayClass3_0::currentPath
ldloc.1 <null>
callvirt System.String System.Diagnostics.Process::get_ProcessName()
call System.Diagnostics.Process[] System.Diagnostics.Process::GetProcessesByName(System.String)
ldloc.0 <null>
ldftn System.Boolean Client.Program/<>c__DisplayClass3_0::<Main>b__0(System.Diagnostics.Process)
newobj System.Void System.Func`2<System.Diagnostics.Process,System.Boolean>::.ctor(System.Object,System.IntPtr)
call System.Int32 System.Linq.Enumerable::Count<System.Diagnostics.Process>(System.Collections.Generic.IEnumerable`1<System.Diagnostics.Process>,System.Func`2<System.Diagnostics.Process,System.Boolean>)
ldc.i4.1 <null>
ble IL_0045: ldsfld System.Action Client.Program/<>c::<>9__3_1
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.Action Client.Program/<>c::<>9__3_1
dup <null>
brtrue IL_0067: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
ldsfld Client.Program/<>c Client.Program/<>c::<>9
ldftn System.Void Client.Program/<>c::<Main>b__3_1()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action Client.Program/<>c::<>9__3_1
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
ldc.i4.0 <null>
stloc.2 <null>
br IL_0082: ldloc.2
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.2 <null>
ldc.i4.1 <null>
add <null>
stloc.2 <null>
ldloc.2 <null>
ldsfld System.String Client.Settings::Delay
call System.Int32 System.Convert::ToInt32(System.String)
blt.s IL_0074: ldc.i4 1000
call System.Boolean Client.Settings::InitializeSettings()
brtrue IL_009F: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Boolean Client.Helper.MutexControl::CreateMutex()
brtrue IL_00B0: ldsfld System.String Client.Settings::Anti
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String Client.Settings::Anti
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_00C4: ldsfld System.String Client.Settings::Install
call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis()
ldsfld System.String Client.Settings::Install
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_00D8: ldsfld System.String Client.Settings::BDOS
call System.Void Client.Install.NormalStartup::Install()
ldsfld System.String Client.Settings::BDOS
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_00F6: call System.Void Client.Helper.Methods::PreventSleep()
call System.Boolean Client.Helper.Methods::IsAdmin()
brfalse IL_00F6: call System.Void Client.Helper.Methods::PreventSleep()
call System.Void Client.Helper.ProcessCritical::Set()
call System.Void Client.Helper.Methods::PreventSleep()
leave IL_0106: ldc.i4.1
pop <null>
leave IL_0106: ldc.i4.1
ldc.i4.1 <null>
stloc.3 <null>
nop <null>
ldsfld System.Boolean Client.Program::taskmgr_active
brtrue IL_0140: call System.Boolean Client.Connection.ClientSocket::get_IsConnected()
ldloc.3 <null>
brtrue IL_0127: call System.Boolean Client.Connection.ClientSocket::get_IsConnected()
ldstr Task Manager isn't running
call System.Void Client.Handle_Packet.Packet::Info(System.String)
ldloc.3 <null>
ldc.i4.1 <null>
add <null>
stloc.3 <null>
call System.Boolean Client.Connection.ClientSocket::get_IsConnected()
brtrue IL_0258: leave IL_0263
call System.Void Client.Connection.ClientSocket::Reconnect()
call System.Void Client.Connection.ClientSocket::InitializeClient()
br IL_0258: leave IL_0263
call System.Boolean Client.Connection.ClientSocket::get_IsConnected()
brfalse IL_0258: leave IL_0263
ldsfld System.Boolean Client.Program::taskmgr_active
brfalse IL_0258: leave IL_0263
ldstr Task Manager is running
call System.Void Client.Handle_Packet.Packet::Info(System.String)
ldc.i4.0 <null>
stloc.3 <null>
ldsfld System.Boolean Client.Program::cmenir_active
brtrue IL_0174: ldstr "nnsapi"
ldsfld System.Boolean Client.Program::gmenir_active
brfalse IL_0258: leave IL_0263
ldstr nnsapi
call System.Diagnostics.Process[] System.Diagnostics.Process::GetProcessesByName(System.String)
pop <null>
ldstr APIaudioDSGPU
call System.Diagnostics.Process[] System.Diagnostics.Process::GetProcessesByName(System.String)
pop <null>
ldstr nnsapi
call System.Diagnostics.Process[] System.Diagnostics.Process::GetProcessesByName(System.String)
stloc.s V_4
ldc.i4.0 <null>
stloc.s V_5
br IL_01E9: ldloc.s V_5
ldloc.s V_4
ldloc.s V_5
ldelem System.Diagnostics.Process
stloc.s V_6
ldloc.s V_6
callvirt System.Void System.Diagnostics.Process::Kill()
ldloc.s V_6
callvirt System.Void System.Diagnostics.Process::WaitForExit()
ldstr Terminated process nnsapi
call System.Void Client.Handle_Packet.Packet::Info(System.String)
leave IL_01E3: ldloc.s V_5
stloc.s V_7
ldstr Error terminating process: 
ldloc.s V_7
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
call System.Void Client.Handle_Packet.Packet::Error(System.String)
leave IL_01E3: ldloc.s V_5
ldloc.s V_5
ldc.i4.1 <null>
add <null>
stloc.s V_5
ldloc.s V_5
ldloc.s V_4
ldlen <null>
conv.i4 <null>
blt.s IL_019E: ldloc.s V_4
ldstr APIaudioDSGPU
call System.Diagnostics.Process[] System.Diagnostics.Process::GetProcessesByName(System.String)
stloc.s V_4
ldc.i4.0 <null>
stloc.s V_5
br IL_0250: ldloc.s V_5
ldloc.s V_4
ldloc.s V_5
ldelem System.Diagnostics.Process
stloc.s V_8
ldloc.s V_8
callvirt System.Void System.Diagnostics.Process::Kill()
ldloc.s V_8
callvirt System.Void System.Diagnostics.Process::WaitForExit()
ldstr Terminated process APIaudioDSGPU
call System.Void Client.Handle_Packet.Packet::Info(System.String)
leave IL_024A: ldloc.s V_5
stloc.s V_9
ldstr Error terminating process: 
ldloc.s V_9
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
call System.Void Client.Handle_Packet.Packet::Error(System.String)
leave IL_024A: ldloc.s V_5
ldloc.s V_5
ldc.i4.1 <null>
add <null>
stloc.s V_5
ldloc.s V_5
ldloc.s V_4
ldlen <null>
conv.i4 <null>
blt.s IL_0205: ldloc.s V_4
leave IL_0263: ldsfld System.String Client.Settings::Delay
pop <null>
leave IL_0263: ldsfld System.String Client.Settings::Delay
ldsfld System.String Client.Settings::Delay
call System.Int32 System.Convert::ToInt32(System.String)
call System.Void System.Threading.Thread::Sleep(System.Int32)
br IL_0108: nop
Module Name
AsyncClient.exe
Full Name
AsyncClient.exe
EntryPoint
System.Void Client.Program::Main()
Scope Name
AsyncClient.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
AsyncClient
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
171
Main Method
System.Void Client.Program::Main()
Main IL Instruction Count
180
Main IL 
newobj System.Void Client.Program/<>c__DisplayClass3_0::.ctor()
stloc.0 <null>
call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
stloc.1 <null>
ldloc.0 <null>
ldloc.1 <null>
callvirt System.Diagnostics.ProcessModule System.Diagnostics.Process::get_MainModule()
callvirt System.String System.Diagnostics.ProcessModule::get_FileName()
stfld System.String Client.Program/<>c__DisplayClass3_0::currentPath
ldloc.1 <null>
callvirt System.String System.Diagnostics.Process::get_ProcessName()
call System.Diagnostics.Process[] System.Diagnostics.Process::GetProcessesByName(System.String)
ldloc.0 <null>
ldftn System.Boolean Client.Program/<>c__DisplayClass3_0::<Main>b__0(System.Diagnostics.Process)
newobj System.Void System.Func`2<System.Diagnostics.Process,System.Boolean>::.ctor(System.Object,System.IntPtr)
call System.Int32 System.Linq.Enumerable::Count<System.Diagnostics.Process>(System.Collections.Generic.IEnumerable`1<System.Diagnostics.Process>,System.Func`2<System.Diagnostics.Process,System.Boolean>)
ldc.i4.1 <null>
ble IL_0045: ldsfld System.Action Client.Program/<>c::<>9__3_1
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.Action Client.Program/<>c::<>9__3_1
dup <null>
brtrue IL_0067: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
ldsfld Client.Program/<>c Client.Program/<>c::<>9
ldftn System.Void Client.Program/<>c::<Main>b__3_1()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action Client.Program/<>c::<>9__3_1
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
ldc.i4.0 <null>
stloc.2 <null>
br IL_0082: ldloc.2
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.2 <null>
ldc.i4.1 <null>
add <null>
stloc.2 <null>
ldloc.2 <null>
ldsfld System.String Client.Settings::Delay
call System.Int32 System.Convert::ToInt32(System.String)
blt.s IL_0074: ldc.i4 1000
call System.Boolean Client.Settings::InitializeSettings()
brtrue IL_009F: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Boolean Client.Helper.MutexControl::CreateMutex()
brtrue IL_00B0: ldsfld System.String Client.Settings::Anti
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String Client.Settings::Anti
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_00C4: ldsfld System.String Client.Settings::Install
call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis()
ldsfld System.String Client.Settings::Install
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_00D8: ldsfld System.String Client.Settings::BDOS
call System.Void Client.Install.NormalStartup::Install()
ldsfld System.String Client.Settings::BDOS
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_00F6: call System.Void Client.Helper.Methods::PreventSleep()
call System.Boolean Client.Helper.Methods::IsAdmin()
brfalse IL_00F6: call System.Void Client.Helper.Methods::PreventSleep()
call System.Void Client.Helper.ProcessCritical::Set()
call System.Void Client.Helper.Methods::PreventSleep()
leave IL_0106: ldc.i4.1
pop <null>
leave IL_0106: ldc.i4.1
ldc.i4.1 <null>
stloc.3 <null>
nop <null>
ldsfld System.Boolean Client.Program::taskmgr_active
brtrue IL_0140: call System.Boolean Client.Connection.ClientSocket::get_IsConnected()
ldloc.3 <null>
brtrue IL_0127: call System.Boolean Client.Connection.ClientSocket::get_IsConnected()
ldstr Task Manager isn't running
call System.Void Client.Handle_Packet.Packet::Info(System.String)
ldloc.3 <null>
ldc.i4.1 <null>
add <null>
stloc.3 <null>
call System.Boolean Client.Connection.ClientSocket::get_IsConnected()
brtrue IL_0258: leave IL_0263
call System.Void Client.Connection.ClientSocket::Reconnect()
call System.Void Client.Connection.ClientSocket::InitializeClient()
br IL_0258: leave IL_0263
call System.Boolean Client.Connection.ClientSocket::get_IsConnected()
brfalse IL_0258: leave IL_0263
ldsfld System.Boolean Client.Program::taskmgr_active
brfalse IL_0258: leave IL_0263
ldstr Task Manager is running
call System.Void Client.Handle_Packet.Packet::Info(System.String)
ldc.i4.0 <null>
stloc.3 <null>
ldsfld System.Boolean Client.Program::cmenir_active
brtrue IL_0174: ldstr "nnsapi"
ldsfld System.Boolean Client.Program::gmenir_active
brfalse IL_0258: leave IL_0263
ldstr nnsapi
call System.Diagnostics.Process[] System.Diagnostics.Process::GetProcessesByName(System.String)
pop <null>
ldstr APIaudioDSGPU
call System.Diagnostics.Process[] System.Diagnostics.Process::GetProcessesByName(System.String)
pop <null>
ldstr nnsapi
call System.Diagnostics.Process[] System.Diagnostics.Process::GetProcessesByName(System.String)
stloc.s V_4
ldc.i4.0 <null>
stloc.s V_5
br IL_01E9: ldloc.s V_5
ldloc.s V_4
ldloc.s V_5
ldelem System.Diagnostics.Process
stloc.s V_6
ldloc.s V_6
callvirt System.Void System.Diagnostics.Process::Kill()
ldloc.s V_6
callvirt System.Void System.Diagnostics.Process::WaitForExit()
ldstr Terminated process nnsapi
call System.Void Client.Handle_Packet.Packet::Info(System.String)
leave IL_01E3: ldloc.s V_5
stloc.s V_7
ldstr Error terminating process: 
ldloc.s V_7
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
call System.Void Client.Handle_Packet.Packet::Error(System.String)
leave IL_01E3: ldloc.s V_5
ldloc.s V_5
ldc.i4.1 <null>
add <null>
stloc.s V_5
ldloc.s V_5
ldloc.s V_4
ldlen <null>
conv.i4 <null>
blt.s IL_019E: ldloc.s V_4
ldstr APIaudioDSGPU
call System.Diagnostics.Process[] System.Diagnostics.Process::GetProcessesByName(System.String)
stloc.s V_4
ldc.i4.0 <null>
stloc.s V_5
br IL_0250: ldloc.s V_5
ldloc.s V_4
ldloc.s V_5
ldelem System.Diagnostics.Process
stloc.s V_8
ldloc.s V_8
callvirt System.Void System.Diagnostics.Process::Kill()
ldloc.s V_8
callvirt System.Void System.Diagnostics.Process::WaitForExit()
ldstr Terminated process APIaudioDSGPU
call System.Void Client.Handle_Packet.Packet::Info(System.String)
leave IL_024A: ldloc.s V_5
stloc.s V_9
ldstr Error terminating process: 
ldloc.s V_9
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
call System.Void Client.Handle_Packet.Packet::Error(System.String)
leave IL_024A: ldloc.s V_5
ldloc.s V_5
ldc.i4.1 <null>
add <null>
stloc.s V_5
ldloc.s V_5
ldloc.s V_4
ldlen <null>
conv.i4 <null>
blt.s IL_0205: ldloc.s V_4
leave IL_0263: ldsfld System.String Client.Settings::Delay
pop <null>
leave IL_0263: ldsfld System.String Client.Settings::Delay
ldsfld System.String Client.Settings::Delay
call System.Int32 System.Convert::ToInt32(System.String)
call System.Void System.Threading.Thread::Sleep(System.Int32)
br IL_0108: nop
Key (AES_256) MUTEXmalicious
UlZ2c2huhuhuhuhuhuhuhuhuhuhu
CnC CNCmalicious
127huhuhuhu
CnC CNCmalicious
196.huhuhuhuhuhuhu
Ports PORTmalicious
6huhuhuhu
Ports PORTmalicious
7huhuhuhu
Ports PORTmalicious
8huhuhuhu
Mutex MUTEXmalicious
63iohuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙