Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
1 malicious · 3 files
EXE17f16ce3c2dc504192c7a4947ecdb2cfAsyncRAT
Structure
Config. Field Value
Key (AES_256) N2dnZnhuhuhuhuhuhuhuhuhuhuhu
Pastebin -huhuhuhu
Certificate MIIE8jhuhuhuhuhuhuhuhuhuhuhu
ServerSignature nTkRwlhuhuhuhuhuhuhuhuhuhuhu
Install fhuhuhuhu
BDOS fhuhuhuhu
Anti-VM thuhuhuhu
Install-Folder %Aphuhuhuhu
Hosts newslbhuhuhuhuhuhuhuhuhuhuhu
Ports 3huhuhuhu
Mutex lihuhuhuhu
Group FlowPrhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
JyDBBKycLkbj
Full Name
JyDBBKycLkbj
EntryPoint
System.Void EcmDBsQPVak.BjCQyTmfVJT::Main()
Scope Name
JyDBBKycLkbj
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
3608
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
625
Main Method
System.Void EcmDBsQPVak.BjCQyTmfVJT::Main()
Main IL Instruction Count
81
Main IL 
ldc.i4.0 <null>
stloc.0 <null>
br.s IL_0012: ldloc.0
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
ldc.i4.1 <null>
add <null>
stloc.0 <null>
ldloc.0 <null>
ldsfld System.String EcmDBsQPVak.lQdbJxQZIv::eHYRzJXqfLGp
call System.Int32 System.Convert::ToInt32(System.String)
blt.s IL_0004: ldc.i4 1000
call System.Boolean EcmDBsQPVak.lQdbJxQZIv::HweQLhgamezJ()
brtrue.s IL_002C: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Boolean jdGfLGPSpCq.MCBXdPhqrPqkQ::EIygeLIeeGB()
brtrue.s IL_003A: ldsfld System.String EcmDBsQPVak.lQdbJxQZIv::LlsReXDMmBbv
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String EcmDBsQPVak.lQdbJxQZIv::LlsReXDMmBbv
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_004B: ldsfld System.String EcmDBsQPVak.lQdbJxQZIv::ByaKZndKQoNyNI
call System.Void jdGfLGPSpCq.kBDhHPSDho::bmPPHKTFgVWe()
ldsfld System.String EcmDBsQPVak.lQdbJxQZIv::ByaKZndKQoNyNI
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_005C: ldsfld System.String EcmDBsQPVak.lQdbJxQZIv::lnepGRLWLtcd
call System.Void EmXdwCblgpIrJT.KvOaSbLdplmG::ICySvsSLHypo()
ldsfld System.String EcmDBsQPVak.lQdbJxQZIv::lnepGRLWLtcd
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_0074: call System.Void jdGfLGPSpCq.TpwWgnnCSIwT::NUUuSwyKAP()
call System.Boolean jdGfLGPSpCq.TpwWgnnCSIwT::DPsYbBCDNCR()
brfalse.s IL_0074: call System.Void jdGfLGPSpCq.TpwWgnnCSIwT::NUUuSwyKAP()
call System.Void jdGfLGPSpCq.cBOsNAUSnZu::OnQHlhzpKTXHsA()
call System.Void jdGfLGPSpCq.TpwWgnnCSIwT::NUUuSwyKAP()
ldnull <null>
ldftn System.Void jdGfLGPSpCq.TpwWgnnCSIwT::OkhcqrwKzw()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
callvirt System.Void System.Threading.Thread::Start()
ldsfld System.String EcmDBsQPVak.lQdbJxQZIv::lPCZQaLhOdYi
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_00B1: ldsfld System.String EcmDBsQPVak.lQdbJxQZIv::XLXHeCCYfphPQr
ldnull <null>
ldftn System.Void jdGfLGPSpCq.QLHZuLvpasBAJ::rtDxNzrWHEeTVkt()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
callvirt System.Void System.Threading.Thread::Start()
ldsfld System.String EcmDBsQPVak.lQdbJxQZIv::XLXHeCCYfphPQr
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_00ED: leave.s IL_00F2
ldsfld System.Threading.ThreadStart EcmDBsQPVak.BjCQyTmfVJT/lJPVjYCChR::XrpoZXmeLMhrqdV
dup <null>
brtrue.s IL_00DC: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
pop <null>
ldsfld EcmDBsQPVak.BjCQyTmfVJT/lJPVjYCChR EcmDBsQPVak.BjCQyTmfVJT/lJPVjYCChR::pqTosrlgGuWcg
ldftn System.Void EcmDBsQPVak.BjCQyTmfVJT/lJPVjYCChR::<Main>b__1_0()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.ThreadStart EcmDBsQPVak.BjCQyTmfVJT/lJPVjYCChR::XrpoZXmeLMhrqdV
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Threading.Thread::set_IsBackground(System.Boolean)
callvirt System.Void System.Threading.Thread::Start()
leave.s IL_00F2: nop
pop <null>
leave.s IL_00F2: nop
nop <null>
call System.Boolean BKdsccubhyY.RdnLyMGKQqnHoMA::get_IsConnected()
brtrue.s IL_0104: leave.s IL_0109
call System.Void BKdsccubhyY.RdnLyMGKQqnHoMA::LwZDVFMtYQMHGZ()
call System.Void BKdsccubhyY.RdnLyMGKQqnHoMA::LZfNwuUfpG()
leave.s IL_0109: ldc.i4 5000
pop <null>
leave.s IL_0109: ldc.i4 5000
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_00F2: nop
Module Name
JyDBBKycLkbj
Full Name
JyDBBKycLkbj
EntryPoint
System.Void EcmDBsQPVak.BjCQyTmfVJT::Main()
Scope Name
JyDBBKycLkbj
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
3608
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
625
Main Method
System.Void EcmDBsQPVak.BjCQyTmfVJT::Main()
Main IL Instruction Count
81
Main IL 
ldc.i4.0 <null>
stloc.0 <null>
br.s IL_0012: ldloc.0
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
ldc.i4.1 <null>
add <null>
stloc.0 <null>
ldloc.0 <null>
ldsfld System.String EcmDBsQPVak.lQdbJxQZIv::eHYRzJXqfLGp
call System.Int32 System.Convert::ToInt32(System.String)
blt.s IL_0004: ldc.i4 1000
call System.Boolean EcmDBsQPVak.lQdbJxQZIv::HweQLhgamezJ()
brtrue.s IL_002C: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Boolean jdGfLGPSpCq.MCBXdPhqrPqkQ::EIygeLIeeGB()
brtrue.s IL_003A: ldsfld System.String EcmDBsQPVak.lQdbJxQZIv::LlsReXDMmBbv
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String EcmDBsQPVak.lQdbJxQZIv::LlsReXDMmBbv
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_004B: ldsfld System.String EcmDBsQPVak.lQdbJxQZIv::ByaKZndKQoNyNI
call System.Void jdGfLGPSpCq.kBDhHPSDho::bmPPHKTFgVWe()
ldsfld System.String EcmDBsQPVak.lQdbJxQZIv::ByaKZndKQoNyNI
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_005C: ldsfld System.String EcmDBsQPVak.lQdbJxQZIv::lnepGRLWLtcd
call System.Void EmXdwCblgpIrJT.KvOaSbLdplmG::ICySvsSLHypo()
ldsfld System.String EcmDBsQPVak.lQdbJxQZIv::lnepGRLWLtcd
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_0074: call System.Void jdGfLGPSpCq.TpwWgnnCSIwT::NUUuSwyKAP()
call System.Boolean jdGfLGPSpCq.TpwWgnnCSIwT::DPsYbBCDNCR()
brfalse.s IL_0074: call System.Void jdGfLGPSpCq.TpwWgnnCSIwT::NUUuSwyKAP()
call System.Void jdGfLGPSpCq.cBOsNAUSnZu::OnQHlhzpKTXHsA()
call System.Void jdGfLGPSpCq.TpwWgnnCSIwT::NUUuSwyKAP()
ldnull <null>
ldftn System.Void jdGfLGPSpCq.TpwWgnnCSIwT::OkhcqrwKzw()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
callvirt System.Void System.Threading.Thread::Start()
ldsfld System.String EcmDBsQPVak.lQdbJxQZIv::lPCZQaLhOdYi
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_00B1: ldsfld System.String EcmDBsQPVak.lQdbJxQZIv::XLXHeCCYfphPQr
ldnull <null>
ldftn System.Void jdGfLGPSpCq.QLHZuLvpasBAJ::rtDxNzrWHEeTVkt()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
callvirt System.Void System.Threading.Thread::Start()
ldsfld System.String EcmDBsQPVak.lQdbJxQZIv::XLXHeCCYfphPQr
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_00ED: leave.s IL_00F2
ldsfld System.Threading.ThreadStart EcmDBsQPVak.BjCQyTmfVJT/lJPVjYCChR::XrpoZXmeLMhrqdV
dup <null>
brtrue.s IL_00DC: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
pop <null>
ldsfld EcmDBsQPVak.BjCQyTmfVJT/lJPVjYCChR EcmDBsQPVak.BjCQyTmfVJT/lJPVjYCChR::pqTosrlgGuWcg
ldftn System.Void EcmDBsQPVak.BjCQyTmfVJT/lJPVjYCChR::<Main>b__1_0()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.ThreadStart EcmDBsQPVak.BjCQyTmfVJT/lJPVjYCChR::XrpoZXmeLMhrqdV
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Threading.Thread::set_IsBackground(System.Boolean)
callvirt System.Void System.Threading.Thread::Start()
leave.s IL_00F2: nop
pop <null>
leave.s IL_00F2: nop
nop <null>
call System.Boolean BKdsccubhyY.RdnLyMGKQqnHoMA::get_IsConnected()
brtrue.s IL_0104: leave.s IL_0109
call System.Void BKdsccubhyY.RdnLyMGKQqnHoMA::LwZDVFMtYQMHGZ()
call System.Void BKdsccubhyY.RdnLyMGKQqnHoMA::LZfNwuUfpG()
leave.s IL_0109: ldc.i4 5000
pop <null>
leave.s IL_0109: ldc.i4 5000
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_00F2: nop
Key (AES_256) MUTEXmalicious
N2dnZnhuhuhuhuhuhuhuhuhuhuhu
CnC CNCmalicious
newslbhuhuhuhuhuhuhu
CnC CNCmalicious
lbnewhuhuhuhuhuhuhu
Ports PORTmalicious
3huhuhuhu
Mutex MUTEXmalicious
lihuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙