Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5: 1a0c632f7e9409efbca74245f8e99283
Size: 356.35 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 1a0c632f7e9409efbca74245f8e99283
Sha1 78554277391c28163255b456dd9bf40b39f9b31d
Sha256 92478c525daf58642a221dfda3782d6414d2040976fea242effffbdc854e813c
Sha384 d273195af8e9cbbaafa59d72ddcfd8189c9e81c533c36180a6f5ec4f6d6991655a7248b8498b790a6bfe3cf8f902bb0c
Sha512 0d5efd820343f524bd184467e33205ab348af2fdfa0ad21092982d41995ed5b2166099266e77fc9ab5bfd01811a7c47e925fcc58c7645ee98d182efd5d7862cd
SSDeep 6144:++NHXf500Mr5d2HIIIIIw9dVcXbRa/g2BxZKkZnwn6m8g2:1d50oG0jBxZKkZwn6m8g2
TLSH A2748C1333A4E93BD1BE277AE03206154BB9D507B616E38F9A6855B82C533C68D913B3
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
1a0c632f7e9409efbca74245f8e99283
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
xClient.Properties.Resources.resources
information
[NBF]root.Data
[NBF]root.Data-preview.png
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key eVC3EAhuhuhuhuhuhuhu
Version 1.huhuhuhu
Port 1huhuhuhu
Host 193.huhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
Key 1WvgEMhuhuhuhuhuhuhu
AuthKey NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory Suhuhuhuhu
InstallName Clihuhuhuhu
Install 1huhuhuhu
Startup 0huhuhuhu
Mutex QSR_Mhuhuhuhuhuhuhu
StartupKey Quasahuhuhuhuhuhuhu
HideFile 0huhuhuhu
EnableLogger 0huhuhuhu
Tag Ofhuhuhuhu
LogDirectory Lhuhuhuhu
HideLogDirectory 0huhuhuhu
HideLogSubdirectory 0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::㑥ͪ껼먈ꕜᶾ�Ǐ䗉䡍渥ྵ丵ﺧ槯過ꘓ(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 떺䭈䒍뿣᳭鞯偛䂜聂順襧Ќꊃ麝�耋븄్ᝂ싔::‴ﻒ滭䒔捌ఫ袃꺓⃸ꅚ⪁얕햣詤젟�ញ()
brfalse.s IL_0040: call System.Void �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::庝ㄛⷔᚸ槆某﹐뜔滆�ႈ䞹䅙녲슳瞰�믤㞓萅()
call System.Boolean �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::氙旅䰣隖퐶釪ꛪⅮ爐ͪᾱ寘⧁ม䷅䊞ⳝ()
brfalse.s IL_0040: call System.Void �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::庝ㄛⷔᚸ槆某﹐뜔滆�ႈ䞹䅙녲슳瞰�믤㞓萅()
call System.Boolean ⋞䣀곯ᔍɘ䠒藧틒씱⮀皏Ṣ宷聂陉꜉::get_Exiting()
brtrue.s IL_0040: call System.Void �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::庝ㄛⷔᚸ槆某﹐뜔滆�ႈ䞹䅙녲슳瞰�믤㞓萅()
ldsfld ⋞䣀곯ᔍɘ䠒藧틒씱⮀皏Ṣ宷聂陉꜉ �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::癤ືⷪ䜶ᬑ謹땁劙踝ࠚ寞ᖠᕑ뾏⤙ힴ鉉释㦘῔
callvirt System.Void ⋞䣀곯ᔍɘ䠒藧틒씱⮀皏Ṣ宷聂陉꜉::肒ղク窗➼뽂ퟖ獻짿㝆靅䀋ꮡ腤ﹺҠ䳍ꊓ朻()
call System.Void �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::庝ㄛⷔᚸ槆某﹐뜔滆�ႈ䞹䅙녲슳瞰�믤㞓萅()
call System.Void �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::᥮⡆毂ʭԹ㐾㡧欼⓹띣ℬڤ승╲쉮ᘺ⡐濐쑏Ů()
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::㑥ͪ껼먈ꕜᶾ�Ǐ䗉䡍渥ྵ丵ﺧ槯過ꘓ(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 떺䭈䒍뿣᳭鞯偛䂜聂順襧Ќꊃ麝�耋븄్ᝂ싔::‴ﻒ滭䒔捌ఫ袃꺓⃸ꅚ⪁얕햣詤젟�ញ()
brfalse.s IL_0040: call System.Void �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::庝ㄛⷔᚸ槆某﹐뜔滆�ႈ䞹䅙녲슳瞰�믤㞓萅()
call System.Boolean �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::氙旅䰣隖퐶釪ꛪⅮ爐ͪᾱ寘⧁ม䷅䊞ⳝ()
brfalse.s IL_0040: call System.Void �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::庝ㄛⷔᚸ槆某﹐뜔滆�ႈ䞹䅙녲슳瞰�믤㞓萅()
call System.Boolean ⋞䣀곯ᔍɘ䠒藧틒씱⮀皏Ṣ宷聂陉꜉::get_Exiting()
brtrue.s IL_0040: call System.Void �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::庝ㄛⷔᚸ槆某﹐뜔滆�ႈ䞹䅙녲슳瞰�믤㞓萅()
ldsfld ⋞䣀곯ᔍɘ䠒藧틒씱⮀皏Ṣ宷聂陉꜉ �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::癤ືⷪ䜶ᬑ謹땁劙踝ࠚ寞ᖠᕑ뾏⤙ힴ鉉释㦘῔
callvirt System.Void ⋞䣀곯ᔍɘ䠒藧틒씱⮀皏Ṣ宷聂陉꜉::肒ղク窗➼뽂ퟖ獻짿㝆靅䀋ꮡ腤ﹺҠ䳍ꊓ朻()
call System.Void �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::庝ㄛⷔᚸ槆某﹐뜔滆�ႈ䞹䅙녲슳瞰�믤㞓萅()
call System.Void �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::᥮⡆毂ʭԹ㐾㡧欼⓹띣ℬڤ승╲쉮ᘺ⡐濐쑏Ů()
ret <null>
CnC CNCmalicious
193.huhuhuhuhuhuhu
Port PORTmalicious
1huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙