Malicious
Malicious

1e9090349f01f39cbe780a4002ecf7ec

PE Executable
MD5: 1e9090349f01f39cbe780a4002ecf7ec
Size: 376.84 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 1e9090349f01f39cbe780a4002ecf7ec
Sha1 9724b1e12395a4134bf1f2475719908988307d9b
Sha256 be1b8d91eb146f3dd6157e8b4ea0c0d47a39f9a19a3d89a597df3b7a57e399aa
Sha384 197f44d9136e5d1d397413a7401f300a48636034dc8fce1e893de775b2531a2884955464fd63ce6187e2d77c515f9df3
Sha512 22d1163f4a181932e2ad6c067cecb04da73cd5d56b49ad90621834bea0f2258e7f00115990cfb1c45947a082e6e53ee5117286b0ff7ff60ff878e96391a5eff2
SSDeep 6144:Q46bPXhLApfpwc4FBGuVKbofr9Pn2jhOeRPPxnR:JmhApL4FBXxr9P2jMeRnxnR
TLSH 06849D6777A8E93BD1FD1736E432061547B0D407BA12F38B6A6C55B86E233868D813B3
PeID
Microsoft Visual C# / Basic .NET
1e9090349f01f39cbe780a4002ecf7ec
Malicious
[Rebuild from dump]_10de8af7.exe
Malicious
.Net Resources
xClient.Properties.Resources.resources
information
[NBF]root.Data
[NBF]root.Data-preview.png
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key aLOO2Jhuhuhuhuhuhuhu
Version 1.huhuhuhu
Port azharhuhuhuhuhuhuhu
Host azharhuhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
Key 1WvgEMhuhuhuhuhuhuhu
AuthKey NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory shuhuhuhu
InstallName sethuhuhuhu
Install 0huhuhuhu
Startup 1huhuhuhu
Mutex QSR_Mhuhuhuhuhuhuhu
StartupKey Sthuhuhuhu
HideFile 0huhuhuhu
EnableLogger 1huhuhuhu
Tag shuhuhuhu
LogDirectory Lhuhuhuhu
HideLogDirectory 0huhuhuhu
HideLogSubdirectory 0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Info
PE Detect: PeReader FAIL, AsmResolver Mapped OK
Info
Remap: Mapped -> FileLayout (RAM only) as [Rebuild from dump]_10de8af7.exe
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::悦謬薠ꋏ�ཥ䄞υᜒ퉬쌵欄❫焗묫쟰鉅襨鉞(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 뼺坓໗Ꮍị㶲⣥罦挂떉莇鰜ౌ쯣㢛귩忨::俰Ὠ變䣥䦈㻄缃뵉்䕇⭋睬錻攓詚浗૜឵폲귎()
brfalse.s IL_0040: call System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::ᛣ嗍㊀ⓥ썲⦁�젪姞�ﷁ죜⨜뜜碼�쥏�()
call System.Boolean ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::ⅻⰡ셢틂㺱‡ꨜ㶱캿祪锩콷⡪遬딶鬶䙛◪()
brfalse.s IL_0040: call System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::ᛣ嗍㊀ⓥ썲⦁�젪姞�ﷁ죜⨜뜜碼�쥏�()
call System.Boolean 誃⏅程﫢齉혫奡伎Ⅲ稜ᨍ犫ꖕ✒浐廱ಓ::get_Exiting()
brtrue.s IL_0040: call System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::ᛣ嗍㊀ⓥ썲⦁�젪姞�ﷁ죜⨜뜜碼�쥏�()
ldsfld 誃⏅程﫢齉혫奡伎Ⅲ稜ᨍ犫ꖕ✒浐廱ಓ ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::틸뵁豮嬕仄ᙴ掆魊닆ᙪ넍ﳊ倽颏�࿂ᖂ낹ⓟパ
callvirt System.Void 誃⏅程﫢齉혫奡伎Ⅲ稜ᨍ犫ꖕ✒浐廱ಓ::옹쌙ꏭ撝䔷ᖐ始腨昧⿴놰ﶊ಩꒜쿪픍摬虾칖룣()
call System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::ᛣ嗍㊀ⓥ썲⦁�젪姞�ﷁ죜⨜뜜碼�쥏�()
call System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::ꔩ뛤퐱㗻풩㫽썓⌐믡⤧䜾弦襘䢙שׂꛆ狛麎锎()
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::悦謬薠ꋏ�ཥ䄞υᜒ퉬쌵欄❫焗묫쟰鉅襨鉞(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 뼺坓໗Ꮍị㶲⣥罦挂떉莇鰜ౌ쯣㢛귩忨::俰Ὠ變䣥䦈㻄缃뵉்䕇⭋睬錻攓詚浗૜឵폲귎()
brfalse.s IL_0040: call System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::ᛣ嗍㊀ⓥ썲⦁�젪姞�ﷁ죜⨜뜜碼�쥏�()
call System.Boolean ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::ⅻⰡ셢틂㺱‡ꨜ㶱캿祪锩콷⡪遬딶鬶䙛◪()
brfalse.s IL_0040: call System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::ᛣ嗍㊀ⓥ썲⦁�젪姞�ﷁ죜⨜뜜碼�쥏�()
call System.Boolean 誃⏅程﫢齉혫奡伎Ⅲ稜ᨍ犫ꖕ✒浐廱ಓ::get_Exiting()
brtrue.s IL_0040: call System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::ᛣ嗍㊀ⓥ썲⦁�젪姞�ﷁ죜⨜뜜碼�쥏�()
ldsfld 誃⏅程﫢齉혫奡伎Ⅲ稜ᨍ犫ꖕ✒浐廱ಓ ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::틸뵁豮嬕仄ᙴ掆魊닆ᙪ넍ﳊ倽颏�࿂ᖂ낹ⓟパ
callvirt System.Void 誃⏅程﫢齉혫奡伎Ⅲ稜ᨍ犫ꖕ✒浐廱ಓ::옹쌙ꏭ撝䔷ᖐ始腨昧⿴놰ﶊ಩꒜쿪픍摬虾칖룣()
call System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::ᛣ嗍㊀ⓥ썲⦁�젪姞�ﷁ죜⨜뜜碼�쥏�()
call System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::ꔩ뛤퐱㗻풩㫽썓⌐믡⤧䜾弦襘䢙שׂꛆ狛麎锎()
ret <null>
CnC CNCmalicious
azharhuhuhuhuhuhuhu
Port PORTmalicious
azharhuhuhuhuhuhuhu
PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
CnC CNCmalicious
azharhuhuhuhuhuhuhu
Port PORTmalicious
azharhuhuhuhuhuhuhu
PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
1e9090349f01f39cbe780a4002ecf7ec
Malicious
[Rebuild from dump]_10de8af7.exe
Malicious
.Net Resources
xClient.Properties.Resources.resources
information
[NBF]root.Data
[NBF]root.Data-preview.png
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key aLOO2Jhuhuhuhuhuhuhu
Version 1.huhuhuhu
Port azharhuhuhuhuhuhuhu
Host azharhuhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
Key 1WvgEMhuhuhuhuhuhuhu
AuthKey NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory shuhuhuhu
InstallName sethuhuhuhu
Install 0huhuhuhu
Startup 1huhuhuhu
Mutex QSR_Mhuhuhuhuhuhuhu
StartupKey Sthuhuhuhu
HideFile 0huhuhuhu
EnableLogger 1huhuhuhu
Tag shuhuhuhu
LogDirectory Lhuhuhuhu
HideLogDirectory 0huhuhuhu
HideLogSubdirectory 0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
CnC CNCmalicious
azharhuhuhuhuhuhuhu
1e9090349f01f39cbe780a4002ecf7ec
Port PORTmalicious
azharhuhuhuhuhuhuhu
1e9090349f01f39cbe780a4002ecf7ec
PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
1e9090349f01f39cbe780a4002ecf7ec
CnC CNCmalicious
azharhuhuhuhuhuhuhu
1e9090349f01f39cbe780a4002ecf7ec › [Rebuild from dump]_10de8af7.exe
Port PORTmalicious
azharhuhuhuhuhuhuhu
1e9090349f01f39cbe780a4002ecf7ec › [Rebuild from dump]_10de8af7.exe
PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
1e9090349f01f39cbe780a4002ecf7ec › [Rebuild from dump]_10de8af7.exe
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙