Suspicious
Suspect

0a1760dacfb292281c791b81ccc9cdca

PE Executable
MD5: 0a1760dacfb292281c791b81ccc9cdca
Size: 104.96 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very low
MD5 0a1760dacfb292281c791b81ccc9cdca
Sha1 a21923b0f0b6646ce8c03cab08739ab781bc3822
Sha256 4f1105e2fab5bccdddc7ec5bb3ccdf2446abdf35fa43815337e4380209b108d3
Sha384 1c1b533b6dc49222f1402eaa93bccbdc3377d0fa44247dadbb3b17e44d90076f2a55bc52b7209b059df3900cb1778b4f
Sha512 6107544d8d72efb7e5191327e11823dbe38bc34b9c8323879feaa2c5170be91225b3f0566e3009952fcc782172e11fcdf97deae635369f21af0a0b488ba169cc
SSDeep 3072:GagxA3NC94Ju8ztcH6NFMpQR5yidc9vR/9h:VdC943tvvREidcR/9
TLSH B0A302C2D4945C31CFB62A796DE0A9080EFCE60017A6DABF4CACD909D3679105D63DBB
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
0a1760dacfb292281c791b81ccc9cdca
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
qrsiuqhc.Resources
ratonClient
STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Output.exe
Full Name
Output.exe
EntryPoint
System.Void Program::main()
Scope Name
Output.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Output
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
10
Main Method
System.Void Program::main()
Main IL Instruction Count
81
Main IL 
call System.Boolean Program::CreateMutex()
brtrue.s IL_0011: call System.Boolean Program::AdminCheck()
call System.Int32 System.Environment::get_ExitCode()
call System.Void System.Environment::Exit(System.Int32)
call System.Boolean Program::AdminCheck()
brfalse IL_00BE: newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
ldsfld System.String Program::workpath
ldstr ratonClient
call System.Byte[] Program::GetTheResource(System.String)
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
call System.Void System.GC::Collect()
leave.s IL_0044: ldsfld System.String Program::workpath
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.0 <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0044: ldsfld System.String Program::workpath
ldsfld System.String Program::workpath
call System.String System.IO.Path::GetExtension(System.String)
callvirt System.String System.String::ToLower()
ldstr .ps1
ldc.i4.0 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean)
ldc.i4.0 <null>
bne.un.s IL_00A1: ldsfld System.String Program::workpath
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
stloc.1 <null>
ldloc.1 <null>
ldstr powershell.exe
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
ldloc.1 <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
ldloc.1 <null>
ldstr -File "
ldsfld System.String Program::workpath
call System.String System.IO.Path::GetFullPath(System.String)
ldstr "
call System.String System.String::Concat(System.String,System.String,System.String)
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String)
ldloc.1 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
br.s IL_00AC: leave.s IL_00BC
ldsfld System.String Program::workpath
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String)
pop <null>
leave.s IL_00BC: br.s IL_0117
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.2 <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00BC: br.s IL_0117
br.s IL_0117: ret
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
stloc.3 <null>
ldloc.3 <null>
call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
callvirt System.Diagnostics.ProcessModule System.Diagnostics.Process::get_MainModule()
callvirt System.String System.Diagnostics.ProcessModule::get_FileName()
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
ldloc.3 <null>
ldstr runas
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String)
ldloc.3 <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
ldloc.3 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
call System.Int32 System.Environment::get_ExitCode()
call System.Void System.Environment::Exit(System.Int32)
leave.s IL_0117: ret
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_4
call System.Int32 System.Environment::get_ExitCode()
call System.Void System.Environment::Exit(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0117: ret
ret <null>
Module Name
Output.exe
Full Name
Output.exe
EntryPoint
System.Void Program::main()
Scope Name
Output.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Output
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
10
Main Method
System.Void Program::main()
Main IL Instruction Count
81
Main IL 
call System.Boolean Program::CreateMutex()
brtrue.s IL_0011: call System.Boolean Program::AdminCheck()
call System.Int32 System.Environment::get_ExitCode()
call System.Void System.Environment::Exit(System.Int32)
call System.Boolean Program::AdminCheck()
brfalse IL_00BE: newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
ldsfld System.String Program::workpath
ldstr ratonClient
call System.Byte[] Program::GetTheResource(System.String)
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
call System.Void System.GC::Collect()
leave.s IL_0044: ldsfld System.String Program::workpath
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.0 <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0044: ldsfld System.String Program::workpath
ldsfld System.String Program::workpath
call System.String System.IO.Path::GetExtension(System.String)
callvirt System.String System.String::ToLower()
ldstr .ps1
ldc.i4.0 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean)
ldc.i4.0 <null>
bne.un.s IL_00A1: ldsfld System.String Program::workpath
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
stloc.1 <null>
ldloc.1 <null>
ldstr powershell.exe
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
ldloc.1 <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
ldloc.1 <null>
ldstr -File "
ldsfld System.String Program::workpath
call System.String System.IO.Path::GetFullPath(System.String)
ldstr "
call System.String System.String::Concat(System.String,System.String,System.String)
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String)
ldloc.1 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
br.s IL_00AC: leave.s IL_00BC
ldsfld System.String Program::workpath
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String)
pop <null>
leave.s IL_00BC: br.s IL_0117
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.2 <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00BC: br.s IL_0117
br.s IL_0117: ret
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
stloc.3 <null>
ldloc.3 <null>
call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
callvirt System.Diagnostics.ProcessModule System.Diagnostics.Process::get_MainModule()
callvirt System.String System.Diagnostics.ProcessModule::get_FileName()
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
ldloc.3 <null>
ldstr runas
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String)
ldloc.3 <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
ldloc.3 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
call System.Int32 System.Environment::get_ExitCode()
call System.Void System.Environment::Exit(System.Int32)
leave.s IL_0117: ret
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_4
call System.Int32 System.Environment::get_ExitCode()
call System.Void System.Environment::Exit(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0117: ret
ret <null>
0a1760dacfb292281c791b81ccc9cdca
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
qrsiuqhc.Resources
ratonClient
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙