Sign up free
Malicious
Malicious

18b00e76897a30521ecb8fc15bd6e251

Share on LinkedIn
Print
PE Executable
MD5: 18b00e76897a30521ecb8fc15bd6e251
Size: 216.58 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 211.5 KB PE Executable identified by Malva.RE as .NET Reflective Loader / XWorm (loader, crypter, rat). Static analysis extracted 14 embedded or derived files, a malware configuration (XWorm config.) and 1 command-and-control endpoint. It matches 19 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
a918ece64739fd805355df17b8cc8de205d8392e789a08a98648f383851d91fe
MD5
18b00e76897a30521ecb8fc15bd6e251
Verdict
Malicious
File type
PE Executable · 211.5 KB
Family
.NET Reflective LoaderXWorm
Category
Loader, Crypter, RAT
C2 (defanged)
103[.]118[.]252[.]177

Cite this report: https://app.malva.re/sha256/a918ece64739fd805355df17b8cc8de205d8392e789a08a98648f383851d91fe

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
216.58 KB · 216,576 B
First seen
2026-11-02 13:45 · 6 hours ago
Last seen
2026-11-02 13:45 · 6 hours ago
Last analysis
2026-11-02 13:45 · 6 hours ago
Hashes
MD5 18b00e76897a30521ecb8fc15bd6e251 Sha1 b1cdb9bc6d6bddacaf2ba2ae07a4a279a28ce95b Sha256 a918ece64739fd805355df17b8cc8de205d8392e789a08a98648f383851d91fe Sha384 083b792bc70c73ae0744055304d204aee01566c6081a497a9e3d7c9b94cd1bfa6f185053c6cbef7e4c64564883695c80 Sha512 a0bebd35a092fcffa92caebb315ac2d260bb5f0af2eb9f6ea8b5aca9516266f7471cc035677729e71fceb7f857b7eb22b0dc1bfe2c52f6ee33fafd6476fb7aad SSDeep 3072:Cvwz+gJdSxrQbNgMxLG/ealPkfkETwbJQ/HX1pr7+bvIUEDb9iy/eT:CvSU0NZxVapk1ssHr7+jIUA9iy TLSH C92401A8F3D58D64D87F87368D3D03580AB6FD975850D71B09CF886E2EE2AC4A524F90
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium

2 malicious · 15 files
EXE18b00e76897a30521ecb8fc15bd6e251XWorm
Structure
BIN.Net Reflective Loader
EXEr158286.dat [AES Decrypted]XWorm
Structure
BINOverlay_68c524f4.bin
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
3 / 3
Path pe:exe>pe:rsrc>img
Shape pe:exe>pe:rsrc>img
malicious 3 nodes
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes

Config. Field Value
Mutex WTvF1huhuhuhuhuhuhu
Hosts 127.0.huhuhuhuhuhuhu
Port 1huhuhuhu
KEY <12huhuhuhu
USBNM <Xwhuhuhuhu
LoggerPath %Thuhuhuhu
family xhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Name Value
Module Name
ClientHost.exe
Full Name
ClientHost.exe
EntryPoint
System.Void EMktujTAJ.TQPBpKDH::Main()
Scope Name
ClientHost.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
ClientHost
Assembly Version
7.8.1.49
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
319
Main Method
System.Void EMktujTAJ.TQPBpKDH::Main()
Main IL Instruction Count
193
Main IL 
call System.String[] System.Environment::GetCommandLineArgs()
stloc.s V_10
ldc.i4.0 <null>
stloc.s V_11
br.s IL_002C: ldloc.s V_11
ldloc.s V_10
ldloc.s V_11
ldelem.ref <null>
stloc.0 <null>
ldloc.0 <null>
ldstr -avkill
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_0026: ldloc.s V_11
call System.Void EMktujTAJ.TQPBpKDH::YaoGHEA()
leave.s IL_0040: ret
ldloc.s V_11
ldc.i4.1 <null>
add <null>
stloc.s V_11
ldloc.s V_11
ldloc.s V_10
ldlen <null>
conv.i4 <null>
blt.s IL_000C: ldloc.s V_10
call System.Boolean EMktujTAJ.TQPBpKDH::RDKncWuhI()
brfalse.s IL_0041: call System.Boolean EMktujTAJ.TQPBpKDH::NlyPEYR()
call System.Void EMktujTAJ.TQPBpKDH::MyjIZXc()
ret <null>
call System.Boolean EMktujTAJ.TQPBpKDH::NlyPEYR()
brfalse.s IL_004E: ldc.i4.m1
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldc.i4.m1 <null>
stloc.1 <null>
call System.String[] System.Environment::GetCommandLineArgs()
stloc.2 <null>
ldc.i4.0 <null>
stloc.3 <null>
br.s IL_007E: ldloc.3
ldloc.2 <null>
ldloc.3 <null>
ldelem.ref <null>
ldstr -r
callvirt System.Boolean System.String::StartsWith(System.String)
brfalse.s IL_007A: ldloc.3
ldloc.2 <null>
ldloc.3 <null>
ldelem.ref <null>
ldc.i4.2 <null>
callvirt System.String System.String::Substring(System.Int32)
ldloca.s V_1
call System.Boolean System.Int32::TryParse(System.String,System.Int32&)
pop <null>
ldloc.3 <null>
ldc.i4.1 <null>
add <null>
stloc.3 <null>
ldloc.3 <null>
ldloc.2 <null>
ldlen <null>
conv.i4 <null>
blt.s IL_005A: ldloc.2
ldloc.1 <null>
ldc.i4.0 <null>
bge.s IL_008E: ldstr "main role="
call System.Int32 EMktujTAJ.TQPBpKDH::McPIwVoob()
stloc.1 <null>
ldstr main role=
ldloc.1 <null>
box System.Int32
call System.String System.String::Concat(System.Object,System.Object)
call System.Void EMktujTAJ.TQPBpKDH::xolCln(System.String)
ldloc.1 <null>
ldc.i4.0 <null>
bge.s IL_00BE: call System.Boolean EMktujTAJ.TQPBpKDH::iIsoCWrG()
call System.Boolean EMktujTAJ.TQPBpKDH::iIsoCWrG()
brfalse.s IL_00BD: ret
ldc.i4 12000
call System.Void System.Threading.Thread::Sleep(System.Int32)
call System.Void EMktujTAJ.TQPBpKDH::xlnPexw()
ret <null>
call System.Boolean EMktujTAJ.TQPBpKDH::iIsoCWrG()
brtrue.s IL_00C6: ldc.i4.1
ret <null>
ldc.i4.1 <null>
ldstr š‡”¶™Œ§¯œ¼­¨µ
call System.String EMktujTAJ.TQPBpKDH::U(System.String)
ldloc.1 <null>
box System.Int32
call System.String System.String::Concat(System.Object,System.Object)
ldloca.s V_4
newobj System.Void System.Threading.Mutex::.ctor(System.Boolean,System.String,System.Boolean&)
stloc.s V_5
ldloc.s V_4
brtrue.s IL_00EE: ldstr "role "
leave IL_0040: ret
ldstr role 
ldloc.1 <null>
box System.Int32
ldstr  alive
call System.String System.String::Concat(System.Object,System.Object,System.Object)
call System.Void EMktujTAJ.TQPBpKDH::xolCln(System.String)
ldloc.1 <null>
brtrue IL_0216: ldnull
call System.Void EMktujTAJ.TQPBpKDH::oiLTzxoY()
call System.Void EMktujTAJ.TQPBpKDH::ZhdgGdJw()
call System.Void EMktujTAJ.TQPBpKDH::wNTTGk()
call System.Byte[] EMktujTAJ.TQPBpKDH::KUprdE()
stloc.s V_6
ldloc.s V_6
brtrue.s IL_012D: ldloc.s V_6
leave IL_0040: ret
ldloc.s V_6
call System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
stsfld System.Reflection.Assembly EMktujTAJ.TQPBpKDH::DMDphSgCC
ldsfld System.Reflection.Assembly EMktujTAJ.TQPBpKDH::DMDphSgCC
callvirt System.Reflection.MethodInfo System.Reflection.Assembly::get_EntryPoint()
stsfld System.Reflection.MethodInfo EMktujTAJ.TQPBpKDH::RsKZpmV
ldsfld System.Reflection.MethodInfo EMktujTAJ.TQPBpKDH::RsKZpmV
callvirt System.Reflection.ParameterInfo[] System.Reflection.MethodBase::GetParameters()
ldlen <null>
conv.i4 <null>
brfalse.s IL_016C: ldc.i4.0
ldc.i4.1 <null>
newarr System.Object
stloc.s V_12
ldloc.s V_12
ldc.i4.0 <null>
ldc.i4.0 <null>
newarr System.String
stelem.ref <null>
ldloc.s V_12
br.s IL_0172: stsfld System.Object[] EMktujTAJ.TQPBpKDH::elaiGzCj
ldc.i4.0 <null>
newarr System.Object
stsfld System.Object[] EMktujTAJ.TQPBpKDH::elaiGzCj
ldstr loaded 
ldsfld System.Reflection.Assembly EMktujTAJ.TQPBpKDH::DMDphSgCC
callvirt System.String System.Reflection.Assembly::get_FullName()
call System.String System.String::Concat(System.String,System.String)
call System.Void EMktujTAJ.TQPBpKDH::xolCln(System.String)
leave.s IL_01B4: ldnull
stloc.s V_7
ldstr load ex 
ldloc.s V_7
callvirt System.Type System.Exception::GetType()
callvirt System.String System.Reflection.MemberInfo::get_Name()
call System.String System.String::Concat(System.String,System.String)
call System.Void EMktujTAJ.TQPBpKDH::xolCln(System.String)
leave IL_0040: ret
ldnull <null>
ldftn System.Void EMktujTAJ.TQPBpKDH::ZycPIx()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stsfld System.Threading.Thread EMktujTAJ.TQPBpKDH::OmnmBn
ldsfld System.Threading.Thread EMktujTAJ.TQPBpKDH::OmnmBn
ldc.i4.0 <null>
callvirt System.Void System.Threading.Thread::set_IsBackground(System.Boolean)
ldsfld System.Threading.Thread EMktujTAJ.TQPBpKDH::OmnmBn
ldc.i4.0 <null>
callvirt System.Void System.Threading.Thread::SetApartmentState(System.Threading.ApartmentState)
ldsfld System.Threading.Thread EMktujTAJ.TQPBpKDH::OmnmBn
callvirt System.Void System.Threading.Thread::Start()
ldstr entry start
call System.Void EMktujTAJ.TQPBpKDH::xolCln(System.String)
ldnull <null>
ldftn System.Void EMktujTAJ.TQPBpKDH::FxQlKiF()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.s V_8
ldloc.s V_8
ldc.i4.1 <null>
callvirt System.Void System.Threading.Thread::set_IsBackground(System.Boolean)
ldloc.s V_8
callvirt System.Void System.Threading.Thread::Start()
ldnull <null>
ldftn System.Void EMktujTAJ.TQPBpKDH::WZygOi()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.s V_9
ldloc.s V_9
ldc.i4.1 <null>
callvirt System.Void System.Threading.Thread::set_IsBackground(System.Boolean)
ldloc.s V_9
callvirt System.Void System.Threading.Thread::Start()
ldc.i4 600000
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_0238: ldc.i4 600000
ldloc.s V_5
brfalse.s IL_024F: endfinally
ldloc.s V_5
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
Module Name
ClientHost.exe
Full Name
ClientHost.exe
EntryPoint
System.Void EMktujTAJ.TQPBpKDH::Main()
Scope Name
ClientHost.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
ClientHost
Assembly Version
7.8.1.49
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
319
Main Method
System.Void EMktujTAJ.TQPBpKDH::Main()
Main IL Instruction Count
193
Main IL 
call System.String[] System.Environment::GetCommandLineArgs()
stloc.s V_10
ldc.i4.0 <null>
stloc.s V_11
br.s IL_002C: ldloc.s V_11
ldloc.s V_10
ldloc.s V_11
ldelem.ref <null>
stloc.0 <null>
ldloc.0 <null>
ldstr -avkill
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_0026: ldloc.s V_11
call System.Void EMktujTAJ.TQPBpKDH::YaoGHEA()
leave.s IL_0040: ret
ldloc.s V_11
ldc.i4.1 <null>
add <null>
stloc.s V_11
ldloc.s V_11
ldloc.s V_10
ldlen <null>
conv.i4 <null>
blt.s IL_000C: ldloc.s V_10
call System.Boolean EMktujTAJ.TQPBpKDH::RDKncWuhI()
brfalse.s IL_0041: call System.Boolean EMktujTAJ.TQPBpKDH::NlyPEYR()
call System.Void EMktujTAJ.TQPBpKDH::MyjIZXc()
ret <null>
call System.Boolean EMktujTAJ.TQPBpKDH::NlyPEYR()
brfalse.s IL_004E: ldc.i4.m1
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldc.i4.m1 <null>
stloc.1 <null>
call System.String[] System.Environment::GetCommandLineArgs()
stloc.2 <null>
ldc.i4.0 <null>
stloc.3 <null>
br.s IL_007E: ldloc.3
ldloc.2 <null>
ldloc.3 <null>
ldelem.ref <null>
ldstr -r
callvirt System.Boolean System.String::StartsWith(System.String)
brfalse.s IL_007A: ldloc.3
ldloc.2 <null>
ldloc.3 <null>
ldelem.ref <null>
ldc.i4.2 <null>
callvirt System.String System.String::Substring(System.Int32)
ldloca.s V_1
call System.Boolean System.Int32::TryParse(System.String,System.Int32&)
pop <null>
ldloc.3 <null>
ldc.i4.1 <null>
add <null>
stloc.3 <null>
ldloc.3 <null>
ldloc.2 <null>
ldlen <null>
conv.i4 <null>
blt.s IL_005A: ldloc.2
ldloc.1 <null>
ldc.i4.0 <null>
bge.s IL_008E: ldstr "main role="
call System.Int32 EMktujTAJ.TQPBpKDH::McPIwVoob()
stloc.1 <null>
ldstr main role=
ldloc.1 <null>
box System.Int32
call System.String System.String::Concat(System.Object,System.Object)
call System.Void EMktujTAJ.TQPBpKDH::xolCln(System.String)
ldloc.1 <null>
ldc.i4.0 <null>
bge.s IL_00BE: call System.Boolean EMktujTAJ.TQPBpKDH::iIsoCWrG()
call System.Boolean EMktujTAJ.TQPBpKDH::iIsoCWrG()
brfalse.s IL_00BD: ret
ldc.i4 12000
call System.Void System.Threading.Thread::Sleep(System.Int32)
call System.Void EMktujTAJ.TQPBpKDH::xlnPexw()
ret <null>
call System.Boolean EMktujTAJ.TQPBpKDH::iIsoCWrG()
brtrue.s IL_00C6: ldc.i4.1
ret <null>
ldc.i4.1 <null>
ldstr š‡”¶™Œ§¯œ¼­¨µ
call System.String EMktujTAJ.TQPBpKDH::U(System.String)
ldloc.1 <null>
box System.Int32
call System.String System.String::Concat(System.Object,System.Object)
ldloca.s V_4
newobj System.Void System.Threading.Mutex::.ctor(System.Boolean,System.String,System.Boolean&)
stloc.s V_5
ldloc.s V_4
brtrue.s IL_00EE: ldstr "role "
leave IL_0040: ret
ldstr role 
ldloc.1 <null>
box System.Int32
ldstr  alive
call System.String System.String::Concat(System.Object,System.Object,System.Object)
call System.Void EMktujTAJ.TQPBpKDH::xolCln(System.String)
ldloc.1 <null>
brtrue IL_0216: ldnull
call System.Void EMktujTAJ.TQPBpKDH::oiLTzxoY()
call System.Void EMktujTAJ.TQPBpKDH::ZhdgGdJw()
call System.Void EMktujTAJ.TQPBpKDH::wNTTGk()
call System.Byte[] EMktujTAJ.TQPBpKDH::KUprdE()
stloc.s V_6
ldloc.s V_6
brtrue.s IL_012D: ldloc.s V_6
leave IL_0040: ret
ldloc.s V_6
call System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
stsfld System.Reflection.Assembly EMktujTAJ.TQPBpKDH::DMDphSgCC
ldsfld System.Reflection.Assembly EMktujTAJ.TQPBpKDH::DMDphSgCC
callvirt System.Reflection.MethodInfo System.Reflection.Assembly::get_EntryPoint()
stsfld System.Reflection.MethodInfo EMktujTAJ.TQPBpKDH::RsKZpmV
ldsfld System.Reflection.MethodInfo EMktujTAJ.TQPBpKDH::RsKZpmV
callvirt System.Reflection.ParameterInfo[] System.Reflection.MethodBase::GetParameters()
ldlen <null>
conv.i4 <null>
brfalse.s IL_016C: ldc.i4.0
ldc.i4.1 <null>
newarr System.Object
stloc.s V_12
ldloc.s V_12
ldc.i4.0 <null>
ldc.i4.0 <null>
newarr System.String
stelem.ref <null>
ldloc.s V_12
br.s IL_0172: stsfld System.Object[] EMktujTAJ.TQPBpKDH::elaiGzCj
ldc.i4.0 <null>
newarr System.Object
stsfld System.Object[] EMktujTAJ.TQPBpKDH::elaiGzCj
ldstr loaded 
ldsfld System.Reflection.Assembly EMktujTAJ.TQPBpKDH::DMDphSgCC
callvirt System.String System.Reflection.Assembly::get_FullName()
call System.String System.String::Concat(System.String,System.String)
call System.Void EMktujTAJ.TQPBpKDH::xolCln(System.String)
leave.s IL_01B4: ldnull
stloc.s V_7
ldstr load ex 
ldloc.s V_7
callvirt System.Type System.Exception::GetType()
callvirt System.String System.Reflection.MemberInfo::get_Name()
call System.String System.String::Concat(System.String,System.String)
call System.Void EMktujTAJ.TQPBpKDH::xolCln(System.String)
leave IL_0040: ret
ldnull <null>
ldftn System.Void EMktujTAJ.TQPBpKDH::ZycPIx()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stsfld System.Threading.Thread EMktujTAJ.TQPBpKDH::OmnmBn
ldsfld System.Threading.Thread EMktujTAJ.TQPBpKDH::OmnmBn
ldc.i4.0 <null>
callvirt System.Void System.Threading.Thread::set_IsBackground(System.Boolean)
ldsfld System.Threading.Thread EMktujTAJ.TQPBpKDH::OmnmBn
ldc.i4.0 <null>
callvirt System.Void System.Threading.Thread::SetApartmentState(System.Threading.ApartmentState)
ldsfld System.Threading.Thread EMktujTAJ.TQPBpKDH::OmnmBn
callvirt System.Void System.Threading.Thread::Start()
ldstr entry start
call System.Void EMktujTAJ.TQPBpKDH::xolCln(System.String)
ldnull <null>
ldftn System.Void EMktujTAJ.TQPBpKDH::FxQlKiF()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.s V_8
ldloc.s V_8
ldc.i4.1 <null>
callvirt System.Void System.Threading.Thread::set_IsBackground(System.Boolean)
ldloc.s V_8
callvirt System.Void System.Threading.Thread::Start()
ldnull <null>
ldftn System.Void EMktujTAJ.TQPBpKDH::WZygOi()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.s V_9
ldloc.s V_9
ldc.i4.1 <null>
callvirt System.Void System.Threading.Thread::set_IsBackground(System.Boolean)
ldloc.s V_9
callvirt System.Void System.Threading.Thread::Start()
ldc.i4 600000
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_0238: ldc.i4 600000
ldloc.s V_5
brfalse.s IL_024F: endfinally
ldloc.s V_5
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>

Mutex MUTEXmalicious
WTvF1huhuhuhuhuhuhu
CnC CNCmalicious
127huhuhuhu
CnC CNCmalicious
103.1huhuhuhuhuhuhu
Port PORTmalicious
1huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

An error has occurred. This application may no longer respond until reloaded. Reload 🗙