Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
083c81aa9258d1058ef4cda4f9ac6699
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Config. Field Value
Key (AES_256) R2Fkbnhuhuhuhuhuhuhuhuhuhuhu
Pastebin -huhuhuhu
Certificate MIIE8Dhuhuhuhuhuhuhuhuhuhuhu
ServerSignature B/wBIehuhuhuhuhuhuhuhuhuhuhu
Install thuhuhuhu
BDOS fhuhuhuhu
Anti-VM thuhuhuhu
Install File winhuhuhuhu
Install-Folder %Aphuhuhuhu
Hosts 127.0.huhuhuhuhuhuhu
Ports 6606huhuhuhuhuhuhu
Mutex Amnehuhuhuhuhuhuhu
Delay 3huhuhuhu
Group nXCHhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
PvpsREtIWgCR
Full Name
PvpsREtIWgCR
EntryPoint
System.Void wPKSQATOIvn.vDtpplodqPnGby::Main()
Scope Name
PvpsREtIWgCR
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6.1
Total Strings
316
Main Method
System.Void wPKSQATOIvn.vDtpplodqPnGby::Main()
Main IL Instruction Count
66
Main IL 
ldc.i4.0 <null>
stloc.0 <null>
br.s IL_0012: ldloc.0
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
ldc.i4.1 <null>
add <null>
stloc.0 <null>
ldloc.0 <null>
ldsfld System.String wPKSQATOIvn.SlwnqLsBuy::KGIyFGZDSaQYb
call System.Int32 System.Convert::ToInt32(System.String)
blt.s IL_0004: ldc.i4 1000
call System.Boolean wPKSQATOIvn.SlwnqLsBuy::GgvRzfkytxZ()
brtrue.s IL_002C: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Boolean MxuGCvfNgLYKwN.YGZgkTPtolW::QVuZdZbdrgdy()
brtrue.s IL_003A: ldsfld System.String wPKSQATOIvn.SlwnqLsBuy::dMRnmWVbyQTXC
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String wPKSQATOIvn.SlwnqLsBuy::dMRnmWVbyQTXC
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_004B: ldsfld System.String wPKSQATOIvn.SlwnqLsBuy::oyYuKeEHHXmGHtF
call System.Void MxuGCvfNgLYKwN.iVnwnsDidWuIA::NHcMEVYymHeOOA()
ldsfld System.String wPKSQATOIvn.SlwnqLsBuy::oyYuKeEHHXmGHtF
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_005C: ldsfld System.String wPKSQATOIvn.SlwnqLsBuy::nUnrGZpBmgCho
call System.Void uZVKHvLUPt.qBnkOawQPqsLH::SucbudwrYUW()
ldsfld System.String wPKSQATOIvn.SlwnqLsBuy::nUnrGZpBmgCho
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_0074: call System.Void MxuGCvfNgLYKwN.tuLtxPMhRB::veYRaIdnBlDG()
call System.Boolean MxuGCvfNgLYKwN.tuLtxPMhRB::WFxJIkjwcbWSx()
brfalse.s IL_0074: call System.Void MxuGCvfNgLYKwN.tuLtxPMhRB::veYRaIdnBlDG()
call System.Void MxuGCvfNgLYKwN.GBKfvSySLG::jwedLDfzmffNw()
call System.Void MxuGCvfNgLYKwN.tuLtxPMhRB::veYRaIdnBlDG()
call System.Void MxuGCvfNgLYKwN.tuLtxPMhRB::NRnyTyyVjUnMg()
call System.Void MxuGCvfNgLYKwN.UFaryRCXSzQK::ydXOPZaNLlp()
ldnull <null>
ldftn System.Void MxuGCvfNgLYKwN.tuLtxPMhRB::DuIarKuuHWFqo()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
call System.Void System.Threading.Thread::Start()
ldsfld System.String wPKSQATOIvn.SlwnqLsBuy::yLdtyoVTlcwYA
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_00BB: leave.s IL_00C0
ldnull <null>
ldftn System.Void vtupNfyYVWz::ZKjwLijXlyHyXUZ()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
call System.Void System.Threading.Thread::Start()
leave.s IL_00C0: nop
pop <null>
leave.s IL_00C0: nop
nop <null>
call System.Boolean MASBDrsEvtnBcw.AQMUzIyHQBE::get_IsConnected()
brtrue.s IL_00D2: leave.s IL_00D7
call System.Void MASBDrsEvtnBcw.AQMUzIyHQBE::aLlSUqgOZwUL()
call System.Void MASBDrsEvtnBcw.AQMUzIyHQBE::SyuoVHJjHzkaFG()
leave.s IL_00D7: ldc.i4 5000
pop <null>
leave.s IL_00D7: ldc.i4 5000
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_00C0: nop
Module Name
PvpsREtIWgCR
Full Name
PvpsREtIWgCR
EntryPoint
System.Void wPKSQATOIvn.vDtpplodqPnGby::Main()
Scope Name
PvpsREtIWgCR
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6.1
Total Strings
316
Main Method
System.Void wPKSQATOIvn.vDtpplodqPnGby::Main()
Main IL Instruction Count
66
Main IL 
ldc.i4.0 <null>
stloc.0 <null>
br.s IL_0012: ldloc.0
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
ldc.i4.1 <null>
add <null>
stloc.0 <null>
ldloc.0 <null>
ldsfld System.String wPKSQATOIvn.SlwnqLsBuy::KGIyFGZDSaQYb
call System.Int32 System.Convert::ToInt32(System.String)
blt.s IL_0004: ldc.i4 1000
call System.Boolean wPKSQATOIvn.SlwnqLsBuy::GgvRzfkytxZ()
brtrue.s IL_002C: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Boolean MxuGCvfNgLYKwN.YGZgkTPtolW::QVuZdZbdrgdy()
brtrue.s IL_003A: ldsfld System.String wPKSQATOIvn.SlwnqLsBuy::dMRnmWVbyQTXC
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String wPKSQATOIvn.SlwnqLsBuy::dMRnmWVbyQTXC
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_004B: ldsfld System.String wPKSQATOIvn.SlwnqLsBuy::oyYuKeEHHXmGHtF
call System.Void MxuGCvfNgLYKwN.iVnwnsDidWuIA::NHcMEVYymHeOOA()
ldsfld System.String wPKSQATOIvn.SlwnqLsBuy::oyYuKeEHHXmGHtF
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_005C: ldsfld System.String wPKSQATOIvn.SlwnqLsBuy::nUnrGZpBmgCho
call System.Void uZVKHvLUPt.qBnkOawQPqsLH::SucbudwrYUW()
ldsfld System.String wPKSQATOIvn.SlwnqLsBuy::nUnrGZpBmgCho
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_0074: call System.Void MxuGCvfNgLYKwN.tuLtxPMhRB::veYRaIdnBlDG()
call System.Boolean MxuGCvfNgLYKwN.tuLtxPMhRB::WFxJIkjwcbWSx()
brfalse.s IL_0074: call System.Void MxuGCvfNgLYKwN.tuLtxPMhRB::veYRaIdnBlDG()
call System.Void MxuGCvfNgLYKwN.GBKfvSySLG::jwedLDfzmffNw()
call System.Void MxuGCvfNgLYKwN.tuLtxPMhRB::veYRaIdnBlDG()
call System.Void MxuGCvfNgLYKwN.tuLtxPMhRB::NRnyTyyVjUnMg()
call System.Void MxuGCvfNgLYKwN.UFaryRCXSzQK::ydXOPZaNLlp()
ldnull <null>
ldftn System.Void MxuGCvfNgLYKwN.tuLtxPMhRB::DuIarKuuHWFqo()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
call System.Void System.Threading.Thread::Start()
ldsfld System.String wPKSQATOIvn.SlwnqLsBuy::yLdtyoVTlcwYA
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_00BB: leave.s IL_00C0
ldnull <null>
ldftn System.Void vtupNfyYVWz::ZKjwLijXlyHyXUZ()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
call System.Void System.Threading.Thread::Start()
leave.s IL_00C0: nop
pop <null>
leave.s IL_00C0: nop
nop <null>
call System.Boolean MASBDrsEvtnBcw.AQMUzIyHQBE::get_IsConnected()
brtrue.s IL_00D2: leave.s IL_00D7
call System.Void MASBDrsEvtnBcw.AQMUzIyHQBE::aLlSUqgOZwUL()
call System.Void MASBDrsEvtnBcw.AQMUzIyHQBE::SyuoVHJjHzkaFG()
leave.s IL_00D7: ldc.i4 5000
pop <null>
leave.s IL_00D7: ldc.i4 5000
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_00C0: nop
Key (AES_256) MUTEXmalicious
R2Fkbnhuhuhuhuhuhuhuhuhuhuhu
CnC CNCmalicious
127huhuhuhu
CnC CNCmalicious
37.1huhuhuhuhuhuhu
Ports PORTmalicious
6huhuhuhu
Ports PORTmalicious
7huhuhuhu
Ports PORTmalicious
8huhuhuhu
Mutex MUTEXmalicious
Amnehuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙