Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 08c3a66548259d0589ca348c905ad3ce
Sha1 977173776f3cd3005d8c6cc21b12e19712196c05
Sha256 f2145437eba0d3bb81c9b7bc905b4cd26a546a8b9a958e5e8ad5c38c0323dcda
Sha384 74cf19bde2904562bb4621aa461c08b64b2dfbf4a6f755a8a7fe1c8f5621f354410c484075dd39c922644dcf0542318c
Sha512 174e4524d1f5c2f5d10469036ce4587531608a62bbab3c69fe94b200b128fa32ee0c7d42a907a2e09d13e559a5801b87f0e322f71080126f1747fa0fc4074cb6
SSDeep 12288:aOLPT2CPpHAP/iGc1ZOM+FhWF2hekxpp4yHC/WchGt/YTtPxW:B2UxAPqGcv/+Duyx4ult/YTC
TLSH 0E05F0294DDB2A25CB7E4E79C1A6089823F0C7279217E72B2EF890F89B537857D17053
PeID
.NET executableHQR data fileMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
08c3a66548259d0589ca348c905ad3ce
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Genitalk.klaoxao.tiff
tZf7Rn2iydW48x.Resources.resources
d6ed57f1c2c949.Resources.resources
4efe909b0
[NBF]root.Data
4efe909b1
[NBF]root.Data
4efe909b2
[NBF]root.Data
4efe909b3
[NBF]root.Data
4efe909b4
[NBF]root.Data
4efe909b5
[NBF]root.Data
4efe909b6
[NBF]root.Data
4efe909b7
[NBF]root.Data
.Net Reflective Loader
Malicious
Genitalk.klaoxao.tiff [AES Decrypted]
Malicious
Overlay_ddd3db78.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
ObjectRequester.ScopeObject
ScheduledObject.ObjectParser
DecryptorCompressor.ControllableObject
AuditorMap.LocalObject
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
4 / 4
Path pe:exe>pe:dll>pe:rsrc>bin
Shape pe:exe>pe:dll>pe:rsrc>bin
malicious 4 nodes
Path pe:exe>pe:dll>bin
Shape pe:exe>pe:dll>bin
malicious 3 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
tZf7Rn2iydW48x
Full Name
tZf7Rn2iydW48x
EntryPoint
System.Void jAs6fo1.0ZnyYs3::xHq4zq1TErm()
Scope Name
tZf7Rn2iydW48x
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
tZf7Rn2iydW48x
Assembly Version
16.14.42.229
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void jAs6fo1.0ZnyYs3::xHq4zq1TErm()
Main IL Instruction Count
67
Main IL 
ldc.i4.1 <null>
stloc.s V_4
ldloc.s V_4
switch dnlib.DotNet.Emit.Instruction[]
nop <null>
ldc.i4.s 25
ldc.i4.6 <null>
ldc.i4 2026
call System.DateTime Microsoft.VisualBasic.DateAndTime::DateSerial(System.Int32,System.Int32,System.Int32)
stloc.0 <null>
ldloca.s V_1
initobj Microsoft.VisualBasic.FirstDayOfWeek
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.2 <null>
stloc.s V_4
br.s IL_0003: ldloc.s V_4
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
call System.Boolean jAs6fo1.0ZnyYs3::Mo8gx6()
ldc.i4.0 <null>
ceq <null>
stloc.2 <null>
ldloc.2 <null>
brfalse.s IL_0064: ldc.i4.7
ldc.i4.3 <null>
stloc.s V_4
br.s IL_0003: ldloc.s V_4
ldc.i4.7 <null>
br.s IL_0060: stloc.s V_4
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
nop <null>
ldc.i4.7 <null>
stloc.s V_4
br.s IL_0003: ldloc.s V_4
nop <null>
call System.Void jAs6fo1.0ZnyYs3::5drMH()
nop <null>
nop <null>
ldc.i8 6
ldc.i4.6 <null>
ldc.i8 5
ldc.i4 1358906416
call System.String Tbe2mS7sA.Kdq8os3R/Mj6fj7Tm.2Axaz::Mi8n6inGEc0ma(System.Int64,System.Int32,System.Int64,System.Int32)
nop <null>
ldc.i4.5 <null>
ldnull <null>
ldc.i4 25223648
call System.String Mj3cnNa.cb5E7Wnwz2p::3grLE9j(System.Int32,System.Reflection.Assembly,System.Int32)
call System.Void jAs6fo1.0ZnyYs3::me2Z0dJpo3yFXx(System.String,System.String)
ldc.i4.5 <null>
stloc.s V_4
br IL_0003: ldloc.s V_4
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
newobj System.Void jAs6fo1.0ZnyYs3::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
ldtoken System.Void jAs6fo1.0ZnyYs3::xHq4zq1TErm()
pop <null>
ret <null>
Module Name
tZf7Rn2iydW48x
Full Name
tZf7Rn2iydW48x
EntryPoint
System.Void jAs6fo1.0ZnyYs3::xHq4zq1TErm()
Scope Name
tZf7Rn2iydW48x
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
tZf7Rn2iydW48x
Assembly Version
16.14.42.229
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void jAs6fo1.0ZnyYs3::xHq4zq1TErm()
Main IL Instruction Count
67
Main IL 
ldc.i4.1 <null>
stloc.s V_4
ldloc.s V_4
switch dnlib.DotNet.Emit.Instruction[]
nop <null>
ldc.i4.s 25
ldc.i4.6 <null>
ldc.i4 2026
call System.DateTime Microsoft.VisualBasic.DateAndTime::DateSerial(System.Int32,System.Int32,System.Int32)
stloc.0 <null>
ldloca.s V_1
initobj Microsoft.VisualBasic.FirstDayOfWeek
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.2 <null>
stloc.s V_4
br.s IL_0003: ldloc.s V_4
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
call System.Boolean jAs6fo1.0ZnyYs3::Mo8gx6()
ldc.i4.0 <null>
ceq <null>
stloc.2 <null>
ldloc.2 <null>
brfalse.s IL_0064: ldc.i4.7
ldc.i4.3 <null>
stloc.s V_4
br.s IL_0003: ldloc.s V_4
ldc.i4.7 <null>
br.s IL_0060: stloc.s V_4
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
nop <null>
ldc.i4.7 <null>
stloc.s V_4
br.s IL_0003: ldloc.s V_4
nop <null>
call System.Void jAs6fo1.0ZnyYs3::5drMH()
nop <null>
nop <null>
ldc.i8 6
ldc.i4.6 <null>
ldc.i8 5
ldc.i4 1358906416
call System.String Tbe2mS7sA.Kdq8os3R/Mj6fj7Tm.2Axaz::Mi8n6inGEc0ma(System.Int64,System.Int32,System.Int64,System.Int32)
nop <null>
ldc.i4.5 <null>
ldnull <null>
ldc.i4 25223648
call System.String Mj3cnNa.cb5E7Wnwz2p::3grLE9j(System.Int32,System.Reflection.Assembly,System.Int32)
call System.Void jAs6fo1.0ZnyYs3::me2Z0dJpo3yFXx(System.String,System.String)
ldc.i4.5 <null>
stloc.s V_4
br IL_0003: ldloc.s V_4
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
newobj System.Void jAs6fo1.0ZnyYs3::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
ldtoken System.Void jAs6fo1.0ZnyYs3::xHq4zq1TErm()
pop <null>
ret <null>
08c3a66548259d0589ca348c905ad3ce
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Genitalk.klaoxao.tiff
tZf7Rn2iydW48x.Resources.resources
d6ed57f1c2c949.Resources.resources
4efe909b0
[NBF]root.Data
4efe909b1
[NBF]root.Data
4efe909b2
[NBF]root.Data
4efe909b3
[NBF]root.Data
4efe909b4
[NBF]root.Data
4efe909b5
[NBF]root.Data
4efe909b6
[NBF]root.Data
4efe909b7
[NBF]root.Data
.Net Reflective Loader
Malicious
Genitalk.klaoxao.tiff [AES Decrypted]
Malicious
Overlay_ddd3db78.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
ObjectRequester.ScopeObject
ScheduledObject.ObjectParser
DecryptorCompressor.ControllableObject
AuditorMap.LocalObject
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙