Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
2 malicious · 2 files
EXE04eb676116c2448ff613207576afb6d2AsyncRAT
EXE[Rebuild from dump]_613695dc.exeAsyncRAT
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key CFE1EEhuhuhuhuhuhuhuhuhuhuhu
Version 1huhuhuhu
Port 4huhuhuhu
Host mike-rhuhuhuhuhuhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
SubDirectory Suhuhuhuhu
InstallName Clihuhuhuhu
Install 0huhuhuhu
Startup 1huhuhuhu
Mutex c3ff74huhuhuhuhuhuhuhuhuhuhu
StartupKey Systhuhuhuhuhuhuhu
HideFile 0huhuhuhu
EnableLogger 1huhuhuhu
Tag Ofhuhuhuhu
LogDirectory Uphuhuhuhu
ServerSignature Y7fET8huhuhuhuhuhuhuhuhuhuhu
ServerCertificate MIIFEzhuhuhuhuhuhuhuhuhuhuhu
HideLogDirectory 0huhuhuhu
HideLogSubdirectory 0huhuhuhu
UnattendedMod 1huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Key (AES_256) -huhuhuhu
Pastebin -huhuhuhu
ServerSignature k83Id8huhuhuhuhuhuhuhuhuhuhu
Install File Sbihuhuhuhu
Mutex cmdvhuhuhuhu
Group cmdvhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client
Full Name
Client
EntryPoint
System.Void qpcpxdbnrcavmdjbwtmo.ﯪﯫ쩭邯�談㐱尽止ᥪ뗩ع䋒ꕦ뢺ÙҴ纬㵧::Main(System.String[])
Scope Name
Client
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.4.1.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
1957
Main Method
System.Void qpcpxdbnrcavmdjbwtmo.ﯪﯫ쩭邯�談㐱尽止ᥪ뗩ع䋒ꕦ뢺ÙҴ纬㵧::Main(System.String[])
Main IL Instruction Count
20
Main IL 
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
ldnull <null>
ldftn System.Void qpcpxdbnrcavmdjbwtmo.ﯪﯫ쩭邯�談㐱尽止ᥪ뗩ع䋒ꕦ뢺ÙҴ纬㵧::ണ彪鍦⑂磙⬏䚔ᦚᣪࢉ혆옄咝⥋ϰ濶ந┬痢䯥(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void qpcpxdbnrcavmdjbwtmo.ﯪﯫ쩭邯�談㐱尽止ᥪ뗩ع䋒ꕦ뢺ÙҴ纬㵧::홡７悴༱称嘑꿟ើ璶众㌯攫㳕�害ᤆ伙줜(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.Void qpcpxdbnrcavmdjbwtmo.ﯪﯫ쩭邯�談㐱尽止ᥪ뗩ع䋒ꕦ뢺ÙҴ纬㵧::ႀሬᓌ⟯�곤⦄쬗뭖狮㕡彁哣栓쬬猅먏맶()
newobj System.Void qpcpxdbnrcavmdjbwtmo.냂濕⎡ᖮ唉Ƚ輳ỵ쟿碊Q꽀厽ⷤ堈䌚::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
Module Name
Client
Full Name
Client
EntryPoint
System.Void qpcpxdbnrcavmdjbwtmo.ﯪﯫ쩭邯�談㐱尽止ᥪ뗩ع䋒ꕦ뢺ÙҴ纬㵧::Main(System.String[])
Scope Name
Client
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.4.1.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
1957
Main Method
System.Void qpcpxdbnrcavmdjbwtmo.ﯪﯫ쩭邯�談㐱尽止ᥪ뗩ع䋒ꕦ뢺ÙҴ纬㵧::Main(System.String[])
Main IL Instruction Count
20
Main IL 
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
ldnull <null>
ldftn System.Void qpcpxdbnrcavmdjbwtmo.ﯪﯫ쩭邯�談㐱尽止ᥪ뗩ع䋒ꕦ뢺ÙҴ纬㵧::ണ彪鍦⑂磙⬏䚔ᦚᣪࢉ혆옄咝⥋ϰ濶ந┬痢䯥(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void qpcpxdbnrcavmdjbwtmo.ﯪﯫ쩭邯�談㐱尽止ᥪ뗩ع䋒ꕦ뢺ÙҴ纬㵧::홡７悴༱称嘑꿟ើ璶众㌯攫㳕�害ᤆ伙줜(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.Void qpcpxdbnrcavmdjbwtmo.ﯪﯫ쩭邯�談㐱尽止ᥪ뗩ع䋒ꕦ뢺ÙҴ纬㵧::ႀሬᓌ⟯�곤⦄쬗뭖狮㕡彁哣栓쬬猅먏맶()
newobj System.Void qpcpxdbnrcavmdjbwtmo.냂濕⎡ᖮ唉Ƚ輳ỵ쟿碊Q꽀厽ⷤ堈䌚::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
CnC CNCmalicious
mike-rhuhuhuhuhuhuhuhuhuhuhu
Port PORTmalicious
4huhuhuhu
Key (AES_256) MUTEXmalicious
-huhuhuhu
Mutex MUTEXmalicious
cmdvhuhuhuhu
PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙