Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium
1 malicious · 9 files
EXE0cb5525809690c37808aa4c8dae0bb98AsyncRAT
Structure
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key 2568EDhuhuhuhuhuhuhuhuhuhuhu
Version 1huhuhuhu
Port 4huhuhuhu
Host aimbothuhuhuhuhuhuhuhuhuhuhu
ReconnectDelay 5huhuhuhu
SubDirectory Suhuhuhuhu
InstallName Clihuhuhuhu
Install 0huhuhuhu
Startup 0huhuhuhu
Mutex a2d36ahuhuhuhuhuhuhuhuhuhuhu
StartupKey Quasarhuhuhuhuhuhuhuhuhuhuhu
HideFile 0huhuhuhu
EnableLogger 0huhuhuhu
Tag Onhuhuhuhu
LogDirectory Lhuhuhuhu
ServerSignature DmMCuThuhuhuhuhuhuhuhuhuhuhu
ServerCertificate MIIFEzhuhuhuhuhuhuhuhuhuhuhu
HideLogDirectory 0huhuhuhu
HideLogSubdirectory 0huhuhuhu
UnattendedMod 1huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Key (AES_256) -huhuhuhu
Pastebin -huhuhuhu
ServerSignature gtNOhOhuhuhuhuhuhuhuhuhuhuhu
Install File Sbihuhuhuhu
Mutex cmdvhuhuhuhu
Group cmdvhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client
Full Name
Client
EntryPoint
System.Void vmvosvupgnqrydqoqqpi.똚㊆螫⿝ꅭ䪻뱕骴방ㅉ臈、繉ㅜ䶙텿::Main(System.String[])
Scope Name
Client
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.7.1.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
1957
Main Method
System.Void vmvosvupgnqrydqoqqpi.똚㊆螫⿝ꅭ䪻뱕骴방ㅉ臈、繉ㅜ䶙텿::Main(System.String[])
Main IL Instruction Count
20
Main IL 
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
ldnull <null>
ldftn System.Void vmvosvupgnqrydqoqqpi.똚㊆螫⿝ꅭ䪻뱕骴방ㅉ臈、繉ㅜ䶙텿::봁⨯卑✌ꦪ탖ḧꘫꉴ㌁∈殰ⲧ𣏕ϐܨ蓬(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void vmvosvupgnqrydqoqqpi.똚㊆螫⿝ꅭ䪻뱕骴방ㅉ臈、繉ㅜ䶙텿::䟟㏄涇惍념⿯튑滩ﻓ텵윲졭Ẁ꯰胝뷱⚒罭仕(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.Void vmvosvupgnqrydqoqqpi.똚㊆螫⿝ꅭ䪻뱕骴방ㅉ臈、繉ㅜ䶙텿::䡙숃炶㵌諾⨚ﮖᨻᅩ搼舘᭍跩곎箪轑糶䴕蠩()
newobj System.Void vmvosvupgnqrydqoqqpi.춎ശ៤鹪梴댾鰰矼犰㹤䬡킬綛䱃ᴱၚỺ뿥濓॥::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
Module Name
Client
Full Name
Client
EntryPoint
System.Void vmvosvupgnqrydqoqqpi.똚㊆螫⿝ꅭ䪻뱕骴방ㅉ臈、繉ㅜ䶙텿::Main(System.String[])
Scope Name
Client
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.7.1.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
1957
Main Method
System.Void vmvosvupgnqrydqoqqpi.똚㊆螫⿝ꅭ䪻뱕骴방ㅉ臈、繉ㅜ䶙텿::Main(System.String[])
Main IL Instruction Count
20
Main IL 
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
ldnull <null>
ldftn System.Void vmvosvupgnqrydqoqqpi.똚㊆螫⿝ꅭ䪻뱕骴방ㅉ臈、繉ㅜ䶙텿::봁⨯卑✌ꦪ탖ḧꘫꉴ㌁∈殰ⲧ𣏕ϐܨ蓬(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void vmvosvupgnqrydqoqqpi.똚㊆螫⿝ꅭ䪻뱕骴방ㅉ臈、繉ㅜ䶙텿::䟟㏄涇惍념⿯튑滩ﻓ텵윲졭Ẁ꯰胝뷱⚒罭仕(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.Void vmvosvupgnqrydqoqqpi.똚㊆螫⿝ꅭ䪻뱕骴방ㅉ臈、繉ㅜ䶙텿::䡙숃炶㵌諾⨚ﮖᨻᅩ搼舘᭍跩곎箪轑糶䴕蠩()
newobj System.Void vmvosvupgnqrydqoqqpi.춎ശ៤鹪梴댾鰰矼犰㹤䬡킬綛䱃ᴱၚỺ뿥濓॥::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
CnC CNCmalicious
aimbothuhuhuhuhuhuhuhuhuhuhu
Port PORTmalicious
4huhuhuhu
Key (AES_256) MUTEXmalicious
-huhuhuhu
Mutex MUTEXmalicious
cmdvhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙