Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Detection
PeID
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Symbol obfuscation
Very high
1 malicious · 3 files
EXE082f43de4a688f64b1f211371d07becbnjRat
Structure
Config. Field Value
Key (AES_256) enR3enhuhuhuhuhuhuhuhuhuhuhu
Pastebin -huhuhuhu
Certificate MIIE9jhuhuhuhuhuhuhuhuhuhuhu
ServerSignature BMfv0ghuhuhuhuhuhuhuhuhuhuhu
Install fhuhuhuhu
BDOS fhuhuhuhu
Anti-VM fhuhuhuhu
Install-Folder %Aphuhuhuhu
Hosts 127huhuhuhu
Ports 6606huhuhuhuhuhuhu
Mutex Asynchuhuhuhuhuhuhu
Delay 3huhuhuhu
Group 504huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
日韋鼎厂方爿用无玉亠鼓爿
Full Name
日韋鼎厂方爿用无玉亠鼓爿
EntryPoint
System.Void 人鬥禾寸金走日乙鹵戈冫.毛耒火黹瓜厂隹身手血尢彳田匸冫小::Main()
Scope Name
日韋鼎厂方爿用无玉亠鼓爿
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
WorldWindClient
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
1746
Main Method
System.Void 人鬥禾寸金走日乙鹵戈冫.毛耒火黹瓜厂隹身手血尢彳田匸冫小::Main()
Main IL Instruction Count
58
Main IL 
ldc.i4.1 <null>
call System.Void System.Net.ServicePointManager::set_Expect100Continue(System.Boolean)
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
ldc.i4.0 <null>
stloc.0 <null>
br.s IL_0022: ldloc.0
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
ldc.i4.1 <null>
add <null>
stloc.0 <null>
ldloc.0 <null>
ldsfld System.String 人鬥禾寸金走日乙鹵戈冫.革尢片止氏癶几鼻衣目廾皮爪::方貝邑毋冂弓牛鼻耳身虫勹
call System.Int32 System.Convert::ToInt32(System.String)
blt.s IL_0014: ldc.i4 1000
call System.Boolean 人鬥禾寸金走日乙鹵戈冫.革尢片止氏癶几鼻衣目廾皮爪::竹皿缶頁辛香幺辰戶虫矛食()
brtrue.s IL_003C: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.String 人鬥禾寸金走日乙鹵戈冫.毛耒火黹瓜厂隹身手血尢彳田匸冫小::亠言麻黹冂鹵豸羊矛飛()
ldc.i4.0 <null>
call System.Void 人鬥禾寸金走日乙鹵戈冫.几丶足足火气囗辵人爪羊斗高里鼻::又斤鹿殳毛疒夕二儿麥色襾厶匚支黽(System.String,System.Boolean)
call System.Boolean 尢夂曰夕小鳥匕厂夂虫.戈禾卩匕廴卜夕氏貝麻父皿::田父牙黽卩山田亠釆血非辛力()
brtrue.s IL_0055: ldsfld System.String 人鬥禾寸金走日乙鹵戈冫.革尢片止氏癶几鼻衣目廾皮爪::瓦己谷水巛革血匚舟廾木犬龠
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String 人鬥禾寸金走日乙鹵戈冫.革尢片止氏癶几鼻衣目廾皮爪::瓦己谷水巛革血匚舟廾木犬龠
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_0066: ldsfld System.String 人鬥禾寸金走日乙鹵戈冫.革尢片止氏癶几鼻衣目廾皮爪::邑食亠氏冖卩手己音月廴靑儿
call System.Void 尢夂曰夕小鳥匕厂夂虫.斗音水广片耳食干聿羊走冫::广文鹵耳肉囗非匸夂止廴辰()
ldsfld System.String 人鬥禾寸金走日乙鹵戈冫.革尢片止氏癶几鼻衣目廾皮爪::邑食亠氏冖卩手己音月廴靑儿
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_0077: ldsfld System.String 人鬥禾寸金走日乙鹵戈冫.革尢片止氏癶几鼻衣目廾皮爪::豸宀又邑戈爿月艸夊鳥女巛勹龜
call System.Void 色鬼生入比禾幺手黽赤殳戶彐勹.毋几戈无矢几長金止癶力勹食::田龍毋寸疋耳米風心甘八片甘()
ldsfld System.String 人鬥禾寸金走日乙鹵戈冫.革尢片止氏癶几鼻衣目廾皮爪::豸宀又邑戈爿月艸夊鳥女巛勹龜
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_008F: call System.Void 尢夂曰夕小鳥匕厂夂虫.小自羊赤亠气疒父穴自廴厂::彡卩瓜卩爻毋卜癶夂水亠几方鬲心()
call System.Boolean 尢夂曰夕小鳥匕厂夂虫.小自羊赤亠气疒父穴自廴厂::瓦肉玄豆鬲舟夊白力斗冫()
brfalse.s IL_008F: call System.Void 尢夂曰夕小鳥匕厂夂虫.小自羊赤亠气疒父穴自廴厂::彡卩瓜卩爻毋卜癶夂水亠几方鬲心()
call System.Void 尢夂曰夕小鳥匕厂夂虫.頁厂子豆石夂鼻毋酉爻冖::高无人士犬爿厶勹長寸竹厶囗犬()
call System.Void 尢夂曰夕小鳥匕厂夂虫.小自羊赤亠气疒父穴自廴厂::彡卩瓜卩爻毋卜癶夂水亠几方鬲心()
leave.s IL_0099: nop
pop <null>
leave.s IL_0099: nop
nop <null>
call System.Boolean 凵弓夂廴非刀目几干香毛.瓜長人厶斗土尢羽夂工斗欠又::get_IsConnected()
brtrue.s IL_00AB: leave.s IL_00B0
call System.Void 凵弓夂廴非刀目几干香毛.瓜長人厶斗土尢羽夂工斗欠又::釆身色丿殳皿爪儿方色爿鬼()
call System.Void 凵弓夂廴非刀目几干香毛.瓜長人厶斗土尢羽夂工斗欠又::鹵疒廾二言鼠大夊釆比鼠()
leave.s IL_00B0: ldc.i4 5000
pop <null>
leave.s IL_00B0: ldc.i4 5000
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_0099: nop
Module Name
日韋鼎厂方爿用无玉亠鼓爿
Full Name
日韋鼎厂方爿用无玉亠鼓爿
EntryPoint
System.Void 人鬥禾寸金走日乙鹵戈冫.毛耒火黹瓜厂隹身手血尢彳田匸冫小::Main()
Scope Name
日韋鼎厂方爿用无玉亠鼓爿
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
WorldWindClient
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
1746
Main Method
System.Void 人鬥禾寸金走日乙鹵戈冫.毛耒火黹瓜厂隹身手血尢彳田匸冫小::Main()
Main IL Instruction Count
58
Main IL 
ldc.i4.1 <null>
call System.Void System.Net.ServicePointManager::set_Expect100Continue(System.Boolean)
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
ldc.i4.0 <null>
stloc.0 <null>
br.s IL_0022: ldloc.0
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
ldc.i4.1 <null>
add <null>
stloc.0 <null>
ldloc.0 <null>
ldsfld System.String 人鬥禾寸金走日乙鹵戈冫.革尢片止氏癶几鼻衣目廾皮爪::方貝邑毋冂弓牛鼻耳身虫勹
call System.Int32 System.Convert::ToInt32(System.String)
blt.s IL_0014: ldc.i4 1000
call System.Boolean 人鬥禾寸金走日乙鹵戈冫.革尢片止氏癶几鼻衣目廾皮爪::竹皿缶頁辛香幺辰戶虫矛食()
brtrue.s IL_003C: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.String 人鬥禾寸金走日乙鹵戈冫.毛耒火黹瓜厂隹身手血尢彳田匸冫小::亠言麻黹冂鹵豸羊矛飛()
ldc.i4.0 <null>
call System.Void 人鬥禾寸金走日乙鹵戈冫.几丶足足火气囗辵人爪羊斗高里鼻::又斤鹿殳毛疒夕二儿麥色襾厶匚支黽(System.String,System.Boolean)
call System.Boolean 尢夂曰夕小鳥匕厂夂虫.戈禾卩匕廴卜夕氏貝麻父皿::田父牙黽卩山田亠釆血非辛力()
brtrue.s IL_0055: ldsfld System.String 人鬥禾寸金走日乙鹵戈冫.革尢片止氏癶几鼻衣目廾皮爪::瓦己谷水巛革血匚舟廾木犬龠
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String 人鬥禾寸金走日乙鹵戈冫.革尢片止氏癶几鼻衣目廾皮爪::瓦己谷水巛革血匚舟廾木犬龠
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_0066: ldsfld System.String 人鬥禾寸金走日乙鹵戈冫.革尢片止氏癶几鼻衣目廾皮爪::邑食亠氏冖卩手己音月廴靑儿
call System.Void 尢夂曰夕小鳥匕厂夂虫.斗音水广片耳食干聿羊走冫::广文鹵耳肉囗非匸夂止廴辰()
ldsfld System.String 人鬥禾寸金走日乙鹵戈冫.革尢片止氏癶几鼻衣目廾皮爪::邑食亠氏冖卩手己音月廴靑儿
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_0077: ldsfld System.String 人鬥禾寸金走日乙鹵戈冫.革尢片止氏癶几鼻衣目廾皮爪::豸宀又邑戈爿月艸夊鳥女巛勹龜
call System.Void 色鬼生入比禾幺手黽赤殳戶彐勹.毋几戈无矢几長金止癶力勹食::田龍毋寸疋耳米風心甘八片甘()
ldsfld System.String 人鬥禾寸金走日乙鹵戈冫.革尢片止氏癶几鼻衣目廾皮爪::豸宀又邑戈爿月艸夊鳥女巛勹龜
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_008F: call System.Void 尢夂曰夕小鳥匕厂夂虫.小自羊赤亠气疒父穴自廴厂::彡卩瓜卩爻毋卜癶夂水亠几方鬲心()
call System.Boolean 尢夂曰夕小鳥匕厂夂虫.小自羊赤亠气疒父穴自廴厂::瓦肉玄豆鬲舟夊白力斗冫()
brfalse.s IL_008F: call System.Void 尢夂曰夕小鳥匕厂夂虫.小自羊赤亠气疒父穴自廴厂::彡卩瓜卩爻毋卜癶夂水亠几方鬲心()
call System.Void 尢夂曰夕小鳥匕厂夂虫.頁厂子豆石夂鼻毋酉爻冖::高无人士犬爿厶勹長寸竹厶囗犬()
call System.Void 尢夂曰夕小鳥匕厂夂虫.小自羊赤亠气疒父穴自廴厂::彡卩瓜卩爻毋卜癶夂水亠几方鬲心()
leave.s IL_0099: nop
pop <null>
leave.s IL_0099: nop
nop <null>
call System.Boolean 凵弓夂廴非刀目几干香毛.瓜長人厶斗土尢羽夂工斗欠又::get_IsConnected()
brtrue.s IL_00AB: leave.s IL_00B0
call System.Void 凵弓夂廴非刀目几干香毛.瓜長人厶斗土尢羽夂工斗欠又::釆身色丿殳皿爪儿方色爿鬼()
call System.Void 凵弓夂廴非刀目几干香毛.瓜長人厶斗土尢羽夂工斗欠又::鹵疒廾二言鼠大夊釆比鼠()
leave.s IL_00B0: ldc.i4 5000
pop <null>
leave.s IL_00B0: ldc.i4 5000
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_0099: nop
Key (AES_256) MUTEXmalicious
enR3enhuhuhuhuhuhuhuhuhuhuhu
CnC CNCmalicious
127huhuhuhu
Ports PORTmalicious
6huhuhuhu
Ports PORTmalicious
7huhuhuhu
Ports PORTmalicious
8huhuhuhu
Mutex MUTEXmalicious
Asynchuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙