Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
1 malicious · 3 files
EXE2cf0b92cdfc2a7514c14126389f483c6AsyncRAT
Structure
Config. Field Value
Key (AES_256) VTV1bGhuhuhuhuhuhuhuhuhuhuhu
Pastebin -huhuhuhu
Certificate MIIE8jhuhuhuhuhuhuhuhuhuhuhu
ServerSignature H02a7Ahuhuhuhuhuhuhuhuhuhuhu
Install thuhuhuhu
BDOS thuhuhuhu
Anti-VM thuhuhuhu
Install File Chromhuhuhuhuhuhuhu
Install-Folder %Aphuhuhuhu
Version 0.huhuhuhu
Hosts hvihuhuhuhu
Ports 22,23,huhuhuhuhuhuhuhuhuhuhu
Mutex lejkyhuhuhuhuhuhuhu
Delay 5huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
LXEqSzCbTCJcx
Full Name
LXEqSzCbTCJcx
EntryPoint
System.Void NIRCWPgFJUO.yofQMcJgpM::Main()
Scope Name
LXEqSzCbTCJcx
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Stub
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
130
Main Method
System.Void NIRCWPgFJUO.yofQMcJgpM::Main()
Main IL Instruction Count
53
Main IL 
ldc.i4.0 <null>
stloc.0 <null>
br.s IL_0012: ldloc.0
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
ldc.i4.1 <null>
add <null>
stloc.0 <null>
ldloc.0 <null>
ldsfld System.String NIRCWPgFJUO.NOaNyzAhqyxI::devFafgetqOTT
call System.Int32 System.Convert::ToInt32(System.String)
blt.s IL_0004: ldc.i4 1000
call System.Boolean NIRCWPgFJUO.NOaNyzAhqyxI::yEsxwsHgNV()
brtrue.s IL_002C: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Boolean VsSzBuEBioXYJxHg.sqnPJnSEHgAqq::LsQOjdHlWvg()
brtrue.s IL_003A: ldsfld System.String NIRCWPgFJUO.NOaNyzAhqyxI::rcvffNdkpgIU
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String NIRCWPgFJUO.NOaNyzAhqyxI::rcvffNdkpgIU
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_004B: ldsfld System.String NIRCWPgFJUO.NOaNyzAhqyxI::QdbPRGordgYPjCt
call System.Void VsSzBuEBioXYJxHg.UOkyJpgvaq::vftQCSFwQQFqCsr()
ldsfld System.String NIRCWPgFJUO.NOaNyzAhqyxI::QdbPRGordgYPjCt
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_005C: ldsfld System.String NIRCWPgFJUO.NOaNyzAhqyxI::gnrYahxHNRtpu
call System.Void aOythYpLPSCo.ldUfxOsfABJLQ::aXWbMYWRGMxT()
ldsfld System.String NIRCWPgFJUO.NOaNyzAhqyxI::gnrYahxHNRtpu
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_0074: call System.Void VsSzBuEBioXYJxHg.WtVHghSYTEYHTtou::oHjppJpuOIhz()
call System.Boolean VsSzBuEBioXYJxHg.WtVHghSYTEYHTtou::HSascvjygEJNTqu()
brfalse.s IL_0074: call System.Void VsSzBuEBioXYJxHg.WtVHghSYTEYHTtou::oHjppJpuOIhz()
call System.Void VsSzBuEBioXYJxHg.nRIblrIyRjFPZK::YDLuNHyagmoS()
call System.Void VsSzBuEBioXYJxHg.WtVHghSYTEYHTtou::oHjppJpuOIhz()
newobj System.Void VsSzBuEBioXYJxHg.pZxLSAoYteZKuqcZ::.ctor()
call System.String VsSzBuEBioXYJxHg.pZxLSAoYteZKuqcZ::fiRoYnqAym()
pop <null>
leave.s IL_0089: call System.Boolean zsClfXuuYnJVm.sKcAUbQIFUqVtM::get_IsConnected()
pop <null>
leave.s IL_0089: call System.Boolean zsClfXuuYnJVm.sKcAUbQIFUqVtM::get_IsConnected()
call System.Boolean zsClfXuuYnJVm.sKcAUbQIFUqVtM::get_IsConnected()
brtrue.s IL_009A: newobj System.Void System.Random::.ctor()
call System.Void zsClfXuuYnJVm.sKcAUbQIFUqVtM::TdDSGGETLeIG()
call System.Void zsClfXuuYnJVm.sKcAUbQIFUqVtM::eDWluOLDsMhLlff()
newobj System.Void System.Random::.ctor()
ldc.i4 1000
ldc.i4 5000
callvirt System.Int32 System.Random::Next(System.Int32,System.Int32)
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_0089: call System.Boolean zsClfXuuYnJVm.sKcAUbQIFUqVtM::get_IsConnected()
Module Name
LXEqSzCbTCJcx
Full Name
LXEqSzCbTCJcx
EntryPoint
System.Void NIRCWPgFJUO.yofQMcJgpM::Main()
Scope Name
LXEqSzCbTCJcx
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Stub
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
130
Main Method
System.Void NIRCWPgFJUO.yofQMcJgpM::Main()
Main IL Instruction Count
53
Main IL 
ldc.i4.0 <null>
stloc.0 <null>
br.s IL_0012: ldloc.0
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
ldc.i4.1 <null>
add <null>
stloc.0 <null>
ldloc.0 <null>
ldsfld System.String NIRCWPgFJUO.NOaNyzAhqyxI::devFafgetqOTT
call System.Int32 System.Convert::ToInt32(System.String)
blt.s IL_0004: ldc.i4 1000
call System.Boolean NIRCWPgFJUO.NOaNyzAhqyxI::yEsxwsHgNV()
brtrue.s IL_002C: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Boolean VsSzBuEBioXYJxHg.sqnPJnSEHgAqq::LsQOjdHlWvg()
brtrue.s IL_003A: ldsfld System.String NIRCWPgFJUO.NOaNyzAhqyxI::rcvffNdkpgIU
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String NIRCWPgFJUO.NOaNyzAhqyxI::rcvffNdkpgIU
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_004B: ldsfld System.String NIRCWPgFJUO.NOaNyzAhqyxI::QdbPRGordgYPjCt
call System.Void VsSzBuEBioXYJxHg.UOkyJpgvaq::vftQCSFwQQFqCsr()
ldsfld System.String NIRCWPgFJUO.NOaNyzAhqyxI::QdbPRGordgYPjCt
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_005C: ldsfld System.String NIRCWPgFJUO.NOaNyzAhqyxI::gnrYahxHNRtpu
call System.Void aOythYpLPSCo.ldUfxOsfABJLQ::aXWbMYWRGMxT()
ldsfld System.String NIRCWPgFJUO.NOaNyzAhqyxI::gnrYahxHNRtpu
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_0074: call System.Void VsSzBuEBioXYJxHg.WtVHghSYTEYHTtou::oHjppJpuOIhz()
call System.Boolean VsSzBuEBioXYJxHg.WtVHghSYTEYHTtou::HSascvjygEJNTqu()
brfalse.s IL_0074: call System.Void VsSzBuEBioXYJxHg.WtVHghSYTEYHTtou::oHjppJpuOIhz()
call System.Void VsSzBuEBioXYJxHg.nRIblrIyRjFPZK::YDLuNHyagmoS()
call System.Void VsSzBuEBioXYJxHg.WtVHghSYTEYHTtou::oHjppJpuOIhz()
newobj System.Void VsSzBuEBioXYJxHg.pZxLSAoYteZKuqcZ::.ctor()
call System.String VsSzBuEBioXYJxHg.pZxLSAoYteZKuqcZ::fiRoYnqAym()
pop <null>
leave.s IL_0089: call System.Boolean zsClfXuuYnJVm.sKcAUbQIFUqVtM::get_IsConnected()
pop <null>
leave.s IL_0089: call System.Boolean zsClfXuuYnJVm.sKcAUbQIFUqVtM::get_IsConnected()
call System.Boolean zsClfXuuYnJVm.sKcAUbQIFUqVtM::get_IsConnected()
brtrue.s IL_009A: newobj System.Void System.Random::.ctor()
call System.Void zsClfXuuYnJVm.sKcAUbQIFUqVtM::TdDSGGETLeIG()
call System.Void zsClfXuuYnJVm.sKcAUbQIFUqVtM::eDWluOLDsMhLlff()
newobj System.Void System.Random::.ctor()
ldc.i4 1000
ldc.i4 5000
callvirt System.Int32 System.Random::Next(System.Int32,System.Int32)
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_0089: call System.Boolean zsClfXuuYnJVm.sKcAUbQIFUqVtM::get_IsConnected()
Key (AES_256) MUTEXmalicious
VTV1bGhuhuhuhuhuhuhuhuhuhuhu
CnC CNCmalicious
hvihuhuhuhu
Ports PORTmalicious
2huhuhuhu
Ports PORTmalicious
2huhuhuhu
Ports PORTmalicious
8huhuhuhu
Ports PORTmalicious
4huhuhuhu
Ports PORTmalicious
6huhuhuhu
Ports PORTmalicious
8huhuhuhu
Ports PORTmalicious
8huhuhuhu
Mutex MUTEXmalicious
lejkyhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙