Suspicious
Suspect

1cf92442d8c4a6cc5535f8b450cf988f

PE Executable
MD5: 1cf92442d8c4a6cc5535f8b450cf988f
Size: 430.59 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 1cf92442d8c4a6cc5535f8b450cf988f
Sha1 6163e1ca729d7127b4aa03d14ae02a8002da7aad
Sha256 63a58a8d5cce2d17a2818f47e8c23ac080b6d4314369b56f31f2ad65f09384cf
Sha384 d8b7237c79ac96b751f9aae152b71f9a96adf5b1bc9112b56350adb9509913b0c46e826040ef0edb13b8afee658a6aaa
Sha512 3e1d56e71e06858223b7189cb256e4ed1fdabd5c9e0c0d23020d7bea94078f5b84c1aec1f77305067a9a30ece794c6a2f9a0d35d3b36eb1ab73bf56e003a7a8d
SSDeep 6144:tURbLI/rTvN1XFQgC9wz4ZoeETEW1gbpJA3KpSL0pDdNsmvUbsdN:tcbLI/rTvNJFQl9ULePJA3KY0pvx
TLSH C1945942B7D504B9E5BE867848726614A77AF8214B72EBDF168404ED0E33BC2DD34F62
PeID
MASM/TASM - sig4 (h)Microsoft Visual C++ DLLMicrosoft Visual C++ v6.0Microsoft Visual C++ v6.0 DLL
1cf92442d8c4a6cc5535f8b450cf988f
.Net Resources
Client.Helper.Stager.efi
Client.Resources.driver.sys
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
PAYLOAD
.pdata
Client.Resources.r77-x86.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.detourc
.detourd
.fptable
.reloc
Client.Resources.r77-x64.dll
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.detourc
.detourd
.fptable
.reloc
1r95qtsdp3ngvm39zxd9np
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rsrc
Resources
RT_VERSION
ID:0001
ID:0
ID:1033
RT_MANIFEST
ID:0001
ID:0
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 3 STICH kept: 1secondary ignored: 2
bin 2

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:dll
Shape pe:exe>pe:dll
2 nodes
Name Value
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void Client.Program::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
152.0.3.131
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
1370
Main Method
System.Void Client.Program::Main(System.String[])
Main IL Instruction Count
134
Main IL 
newobj System.Void Client.Program/<>c__DisplayClass2_0::.ctor()
stloc.0 <null>
ldloc.0 <null>
ldc.i4.0 <null>
stfld System.Boolean Client.Program/<>c__DisplayClass2_0::flag
ldloc.0 <null>
ldc.i4.0 <null>
stfld System.Boolean Client.Program/<>c__DisplayClass2_0::flag2
ldloc.0 <null>
ldc.i4.0 <null>
stfld System.Boolean Client.Program/<>c__DisplayClass2_0::flag3
ldloc.0 <null>
ldnull <null>
stfld System.String Client.Program/<>c__DisplayClass2_0::text
ldloc.0 <null>
ldnull <null>
stfld System.String Client.Program/<>c__DisplayClass2_0::text2
ldarg.0 <null>
brfalse IL_00F9: ldloc.0
ldarg.0 <null>
stloc.1 <null>
ldc.i4.0 <null>
stloc.2 <null>
br IL_00F0: ldloc.2
ldloc.1 <null>
ldloc.2 <null>
ldelem.ref <null>
stloc.3 <null>
ldloc.3 <null>
brtrue.s IL_0042: ldloc.3
ldnull <null>
br.s IL_004D: stloc.s V_4
ldloc.3 <null>
call System.String System.String::Trim()
callvirt System.String System.String::ToLowerInvariant()
stloc.s V_4
ldloc.s V_4
ldstr --no-antivm
call System.Boolean System.String::op_Equality(System.String,System.String)
brtrue.s IL_006B: ldloc.0
ldloc.s V_4
ldstr --vm
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_0072: ldloc.s V_4
ldloc.0 <null>
ldc.i4.1 <null>
stfld System.Boolean Client.Program/<>c__DisplayClass2_0::flag
ldloc.s V_4
ldstr --driver-infection
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_0087: ldloc.s V_4
ldloc.0 <null>
ldc.i4.1 <null>
stfld System.Boolean Client.Program/<>c__DisplayClass2_0::flag2
ldloc.s V_4
ldstr --elevated
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_009C: ldloc.s V_4
ldloc.0 <null>
ldc.i4.1 <null>
stfld System.Boolean Client.Program/<>c__DisplayClass2_0::flag3
ldloc.s V_4
brfalse.s IL_00C4: ldloc.s V_4
ldloc.s V_4
ldstr --host=
callvirt System.Boolean System.String::StartsWith(System.String)
brfalse.s IL_00C4: ldloc.s V_4
ldloc.0 <null>
ldloc.3 <null>
ldstr --host=
call System.Int32 System.String::get_Length()
callvirt System.String System.String::Substring(System.Int32)
stfld System.String Client.Program/<>c__DisplayClass2_0::text
ldloc.s V_4
brfalse.s IL_00EC: ldloc.2
ldloc.s V_4
ldstr --port=
callvirt System.Boolean System.String::StartsWith(System.String)
brfalse.s IL_00EC: ldloc.2
ldloc.0 <null>
ldloc.3 <null>
ldstr --port=
call System.Int32 System.String::get_Length()
callvirt System.String System.String::Substring(System.Int32)
stfld System.String Client.Program/<>c__DisplayClass2_0::text2
ldloc.2 <null>
ldc.i4.1 <null>
add <null>
stloc.2 <null>
ldloc.2 <null>
ldloc.1 <null>
ldlen <null>
conv.i4 <null>
blt IL_0038: ldloc.1
ldloc.0 <null>
ldfld System.Boolean Client.Program/<>c__DisplayClass2_0::flag
brfalse.s IL_0115: ldc.i4 3072
ldstr DISABLE_ANTIVIRTUAL
ldstr 1
call System.Void System.Environment::SetEnvironmentVariable(System.String,System.String)
leave.s IL_0115: ldc.i4 3072
pop <null>
leave.s IL_0115: ldc.i4 3072
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
call System.Void Client.Config::Init()
ldsfld System.String Client.Config::WindowsService
ldstr true
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_0159: ldloc.0
ldsfld System.String Client.Config::ServiceName
call System.Boolean System.String::IsNullOrEmpty(System.String)
brtrue.s IL_0159: ldloc.0
ldsfld System.String Client.Config::ServiceName
ldloc.0 <null>
ldftn System.Void Client.Program/<>c__DisplayClass2_0::<Main>b__0()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
call System.Void Client.Helper.WindowsService::RunAsService(System.String,System.Action)
br.s IL_017C: leave.s IL_0181
ldloc.0 <null>
ldfld System.Boolean Client.Program/<>c__DisplayClass2_0::flag
ldloc.0 <null>
ldfld System.Boolean Client.Program/<>c__DisplayClass2_0::flag2
ldloc.0 <null>
ldfld System.Boolean Client.Program/<>c__DisplayClass2_0::flag3
ldloc.0 <null>
ldfld System.String Client.Program/<>c__DisplayClass2_0::text
ldloc.0 <null>
ldfld System.String Client.Program/<>c__DisplayClass2_0::text2
call System.Void Client.Program::RunClient(System.Boolean,System.Boolean,System.Boolean,System.String,System.String)
leave.s IL_0181: ret
pop <null>
leave.s IL_0181: ret
ret <null>
Info
PE Detect: PeReader OK (file layout)
1cf92442d8c4a6cc5535f8b450cf988f
.Net Resources
Client.Helper.Stager.efi
Client.Resources.driver.sys
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
PAYLOAD
.pdata
Client.Resources.r77-x86.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.detourc
.detourd
.fptable
.reloc
Client.Resources.r77-x64.dll
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.detourc
.detourd
.fptable
.reloc
1r95qtsdp3ngvm39zxd9np
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rsrc
Resources
RT_VERSION
ID:0001
ID:0
ID:1033
RT_MANIFEST
ID:0001
ID:0
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙