Malicious
Malicious

16cc3e926a3ae25ff5e54c234f0a76fa

Share on LinkedIn
Print
PE Executable
MD5: 16cc3e926a3ae25ff5e54c234f0a76fa
Size: 376.84 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 16cc3e926a3ae25ff5e54c234f0a76fa
Sha1 e1b411b92b8936fb0960a372d817e913512c6bfd
Sha256 df36a38c7a47121fe7d7768163fd916fb3d1de9b8ed5e02ac040706cb2ccae8a
Sha384 c32d9a9e57f2b6d06175f26c77bb0738af58c7572207498db9b81a6af146f5b6880d709a8d71a4d000e9526b8eec81f0
Sha512 bb35a5d6798187a94a0c440657dac9033c81063aa696b6e8113175b801bae42194f235a34a4e030a5c6e2cab5829dcfb9b02e295e91d660273b3ef17ac7a02c5
SSDeep 6144:hLNHXf500MVn2ghtrJ1Db6oiKTfQzwFJPSCu:dd50DThxJ1iTKTozOJPju
TLSH 87848D13B7A4E93BD1FD1B3AE43207155BB0D587B616E38B6A5845BC2E133868E503B3
PeID
Microsoft Visual C# / Basic .NET
16cc3e926a3ae25ff5e54c234f0a76fa
Malicious
[Rebuild from dump]_d612a122.exe
Malicious
.Net Resources
xClient.Properties.Resources.resources
information
[NBF]root.Data
[NBF]root.Data-preview.png
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key 1wnC7chuhuhuhuhuhuhu
Version 1.huhuhuhu
Port 6huhuhuhu
Host 172.huhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
Key 1WvgEMhuhuhuhuhuhuhu
AuthKey NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory Suhuhuhuhu
InstallName Clihuhuhuhu
Install 0huhuhuhu
Startup 1huhuhuhu
Mutex QSR_Mhuhuhuhuhuhuhu
StartupKey Quasahuhuhuhuhuhuhu
HideFile 0huhuhuhu
EnableLogger 1huhuhuhu
Tag qhuhuhuhu
LogDirectory Lhuhuhuhu
HideLogDirectory 0huhuhuhu
HideLogSubdirectory 0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Info
PE Detect: PeReader FAIL, AsmResolver Mapped OK
Info
Remap: Mapped -> FileLayout (RAM only) as [Rebuild from dump]_d612a122.exe
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::�⚥氳࿤侅렧ส麁祣皴ㅔ耊䀦攍ᕪ韴簗�(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 䃵৽雗㩝�㙸栗결⿀탙匽η郏퐨鯴䠳‏僫::譥⡑⢷䕱�賊傞裚炿⸀쪳⾓얶ᶣ⎈��()
brfalse.s IL_0040: call System.Void ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::ʒ俨䳱픴䳵࿦赕픇ᚺ⵻괫Ꝅ�懽㇜ⱗ刨֩()
call System.Boolean ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::ಳ볷㴕嵏ค㶤贗訹灷갖༥鳟�骏䦠㦅鮟徲쵪()
brfalse.s IL_0040: call System.Void ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::ʒ俨䳱픴䳵࿦赕픇ᚺ⵻괫Ꝅ�懽㇜ⱗ刨֩()
call System.Boolean ᘆ鋵厙曮㬺䃒뙣⑗ᢖẛ쯤䊆ꅈ곴≒䃰㍼门::get_Exiting()
brtrue.s IL_0040: call System.Void ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::ʒ俨䳱픴䳵࿦赕픇ᚺ⵻괫Ꝅ�懽㇜ⱗ刨֩()
ldsfld ᘆ鋵厙曮㬺䃒뙣⑗ᢖẛ쯤䊆ꅈ곴≒䃰㍼门 ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::獏䷵⻛ĩຏ誊䂊㊡勤๬눵鐆액£늽ᔍ�푆
callvirt System.Void ᘆ鋵厙曮㬺䃒뙣⑗ᢖẛ쯤䊆ꅈ곴≒䃰㍼门::쨔奨ي쮍鈜睃꣞鱊㬉쑢쭠眆됄崫걱Ш꼡ﻐ꘦()
call System.Void ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::ʒ俨䳱픴䳵࿦赕픇ᚺ⵻괫Ꝅ�懽㇜ⱗ刨֩()
call System.Void ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::癥섹柪☎쫻푦鋓㐄˱韺㋚♇炕㨰螾Ⴀណꐅ()
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::�⚥氳࿤侅렧ส麁祣皴ㅔ耊䀦攍ᕪ韴簗�(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 䃵৽雗㩝�㙸栗결⿀탙匽η郏퐨鯴䠳‏僫::譥⡑⢷䕱�賊傞裚炿⸀쪳⾓얶ᶣ⎈��()
brfalse.s IL_0040: call System.Void ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::ʒ俨䳱픴䳵࿦赕픇ᚺ⵻괫Ꝅ�懽㇜ⱗ刨֩()
call System.Boolean ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::ಳ볷㴕嵏ค㶤贗訹灷갖༥鳟�骏䦠㦅鮟徲쵪()
brfalse.s IL_0040: call System.Void ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::ʒ俨䳱픴䳵࿦赕픇ᚺ⵻괫Ꝅ�懽㇜ⱗ刨֩()
call System.Boolean ᘆ鋵厙曮㬺䃒뙣⑗ᢖẛ쯤䊆ꅈ곴≒䃰㍼门::get_Exiting()
brtrue.s IL_0040: call System.Void ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::ʒ俨䳱픴䳵࿦赕픇ᚺ⵻괫Ꝅ�懽㇜ⱗ刨֩()
ldsfld ᘆ鋵厙曮㬺䃒뙣⑗ᢖẛ쯤䊆ꅈ곴≒䃰㍼门 ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::獏䷵⻛ĩຏ誊䂊㊡勤๬눵鐆액£늽ᔍ�푆
callvirt System.Void ᘆ鋵厙曮㬺䃒뙣⑗ᢖẛ쯤䊆ꅈ곴≒䃰㍼门::쨔奨ي쮍鈜睃꣞鱊㬉쑢쭠眆됄崫걱Ш꼡ﻐ꘦()
call System.Void ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::ʒ俨䳱픴䳵࿦赕픇ᚺ⵻괫Ꝅ�懽㇜ⱗ刨֩()
call System.Void ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::癥섹柪☎쫻푦鋓㐄˱韺㋚♇炕㨰螾Ⴀណꐅ()
ret <null>
CnC CNCmalicious
172.huhuhuhuhuhuhu
Port PORTmalicious
6huhuhuhu
PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
CnC CNCmalicious
172.huhuhuhuhuhuhu
Port PORTmalicious
6huhuhuhu
PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙