Malicious
Malicious

3a2c0219ff5ce2e58109691cf20f51eb

PE Executable
MD5: 3a2c0219ff5ce2e58109691cf20f51eb
Size: 1.98 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 3a2c0219ff5ce2e58109691cf20f51eb
Sha1 1a9ccb0f5eb138bbbf88afe63510e37eded413f2
Sha256 df66645cb25a87f72bdac4ee457e8b22aff036c2c6c2d3f1073088a96ecc1058
Sha384 8a02a62ad4c55a15e8752c2f670f0981dbc4e46a6181fcdf8b3d7a016f83d37eb2b2be711fe700d46dae07d2612d1aed
Sha512 85b2b75d6cf9d82d659409137fc4f79533d89263b5a258cf2998906b99b9bb8b0a16d20f0204f6d5ab22ac75f8da4137a1b777170413b00097372ab3a0fa5a38
SSDeep 49152:mfIW/a3a7anKy1S9/aOHRnMovgncO3JVO71O7t:mfIW/a3a7im/aOFgnRJK4
TLSH D895F04B76594874C069A63EC5DB8519E3F578456323E78F39C813A60E133EAED2E383
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET
2 malicious2 suspicious115 items
  • 3a2c0219ff5ce2e58109691cf20f51ebAgentTeslaRAT.Net Obfuscator
    • Structure
      • DosHeader
      • PE Header
      • Optional Header (x86)
      • Section Headers
        • .text
        • .rsrc
        • .reloc
    • Resources
      • RT_VERSION
        • ID:0001
          • ID:0
      • RT_MANIFEST
        • ID:0001
          • ID:0
    • .Net Resources
      • Syntex_Spoofer.Menu.resources
      • costura.costura.dll.compressed
      • costura.costura.dllSOS: 0.00Fody/Costura Packer
        • Structure
          • DosHeader
          • PE Header
          • Optional Header (x86)
          • Section Headers
            • .text
            • .rsrc
            • .reloc
        • Resources
          • RT_VERSION
            • ID:0001
              • ID:0
      • OsrueUFt7ujXNivqIa.s4HatZyP29FpvShWGr
      • costura.costura.pdb.compressed
      • costura.costura.pdbFody/Costura Packer
      • HKyXeAxsOH82TKNq3N.VT4UZCrb4bPn8rR7U6
      • costura.guna.ui2.dll.compressed
      • costura.guna.ui2.dllAgentTeslaRATSOS: 0.49
        • [Authenticode]_28203e69.p7b
        • Structure
          • DosHeader
          • PE Header
          • Optional Header (x86)
          • Section Headers
            • .text
            • .rsrc
            • .reloc
        • Resources
          • RT_VERSION
            • ID:0001
              • ID:0
        • .Net Resources
          • G22190F0D5B1120504B3E00280003060D0F0F4F38724F222206070B01020F0F27012B0C.resources
            • icon.Image
              • [NBF]root.Data
                • [NBF]root.Data-preview.png
          • Guna.UI2.Properties.Resources.resources
            • CheckedCheckbox_20px
              • [NBF]root.Data
                • [NBF]root.Data-preview.png
            • CheckedRadioButton_20px
              • [NBF]root.Data
                • [NBF]root.Data-preview.png
            • FullImage_64px
              • [NBF]root.Data
                • [NBF]root.Data-preview.png
            • ImageCalendar
              • [NBF]root.Data
                • [NBF]root.Data-preview.png
            • UncheckedCheckbox_20px
            • UncheckedRadioButton_20px
              • [NBF]root.Data
                • [NBF]root.Data-preview.png
            • ce_48px
              • [NBF]root.Data
                • [NBF]root.Data-preview.png
            • curv3
              • [NBF]root.Data
                • [NBF]root.Data-preview.png
            • curv3_w
              • [NBF]root.Data
                • [NBF]root.Data-preview.png
            • error
              • [NBF]root.Data
                • [NBF]root.Data-preview.png
            • info
              • [NBF]root.Data
                • [NBF]root.Data-preview.png
            • logo
              • [NBF]root.Data
                • [NBF]root.Data-preview.png
            • logo_w
              • [NBF]root.Data
                • [NBF]root.Data-preview.png
            • miring
              • [NBF]root.Data
                • [NBF]root.Data-preview.png
            • question
              • [NBF]root.Data
                • [NBF]root.Data-preview.png
            • warning
              • [NBF]root.Data
                • [NBF]root.Data-preview.png
          • G22190F0D5B1120504B250025230207091246250F300029390C06331B0E163B151735041C232100000E0B.resources
            • btDown.Image
            • btUp.Image
            • imageList1.ImageStream
              • [NBF]root.Data
      • costura.metadata
      • aR3nbf8dQp2feLmk31.lSfgApatkdxsVcGcrktoFd.resources
        • $this.Icon
          • [NBF]root.IconData
        • progressBar1.Modifiers
        • $this.Language
        • $this.GridSize
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
PDB Path: Syntex Spoofer.pdb
Module Name
Syntex Spoofer.exe
Full Name
Syntex Spoofer.exe
EntryPoint
System.Void shtrVLnNFGkUlfnSl6.lwUSp2Q9YOZxnmDJjA::V7IPVoMJP()
Scope Name
Syntex Spoofer.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Syntex Spoofer
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
44
Main Method
System.Void shtrVLnNFGkUlfnSl6.lwUSp2Q9YOZxnmDJjA::V7IPVoMJP()
Main IL Instruction Count
31
Main IL 
ldc.i4 2
stloc V_0
br IL_000E: ldloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_003F: ret
call System.Void InaZvlyKsh9JMloMNN5.IQFyMByPpADLwLFSf9F::tdLRyu84nc()
ldc.i4 4
br IL_0012: switch(IL_003F,IL_0040,IL_0050,IL_0030,IL_0074)
ret <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
ldc.i4 3
br IL_0012: switch(IL_003F,IL_0040,IL_0050,IL_0030,IL_0074)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4 1
ldsfld <Module>{ce1011b1-43ec-41e5-a50c-3371cc47829e} <Module>{ce1011b1-43ec-41e5-a50c-3371cc47829e}::m_fe5ba2a53ef940ec9057ae4e2fae8281
ldfld System.Int32 <Module>{ce1011b1-43ec-41e5-a50c-3371cc47829e}::m_2848777202514cd78e6cbcfbb1786d46
brtrue IL_0012: switch(IL_003F,IL_0040,IL_0050,IL_0030,IL_0074)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_003F,IL_0040,IL_0050,IL_0030,IL_0074)
newobj System.Void Syntex_Spoofer.Menu::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ldc.i4 0
ldsfld <Module>{ce1011b1-43ec-41e5-a50c-3371cc47829e} <Module>{ce1011b1-43ec-41e5-a50c-3371cc47829e}::m_fe5ba2a53ef940ec9057ae4e2fae8281
ldfld System.Int32 <Module>{ce1011b1-43ec-41e5-a50c-3371cc47829e}::m_fd521fe3de044b57910f3dcb735e02bf
brtrue IL_0012: switch(IL_003F,IL_0040,IL_0050,IL_0030,IL_0074)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_003F,IL_0040,IL_0050,IL_0030,IL_0074)
Module Name
Syntex Spoofer.exe
Full Name
Syntex Spoofer.exe
EntryPoint
System.Void shtrVLnNFGkUlfnSl6.lwUSp2Q9YOZxnmDJjA::V7IPVoMJP()
Scope Name
Syntex Spoofer.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Syntex Spoofer
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
44
Main Method
System.Void shtrVLnNFGkUlfnSl6.lwUSp2Q9YOZxnmDJjA::V7IPVoMJP()
Main IL Instruction Count
31
Main IL 
ldc.i4 2
stloc V_0
br IL_000E: ldloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_003F: ret
call System.Void InaZvlyKsh9JMloMNN5.IQFyMByPpADLwLFSf9F::tdLRyu84nc()
ldc.i4 4
br IL_0012: switch(IL_003F,IL_0040,IL_0050,IL_0030,IL_0074)
ret <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
ldc.i4 3
br IL_0012: switch(IL_003F,IL_0040,IL_0050,IL_0030,IL_0074)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4 1
ldsfld <Module>{ce1011b1-43ec-41e5-a50c-3371cc47829e} <Module>{ce1011b1-43ec-41e5-a50c-3371cc47829e}::m_fe5ba2a53ef940ec9057ae4e2fae8281
ldfld System.Int32 <Module>{ce1011b1-43ec-41e5-a50c-3371cc47829e}::m_2848777202514cd78e6cbcfbb1786d46
brtrue IL_0012: switch(IL_003F,IL_0040,IL_0050,IL_0030,IL_0074)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_003F,IL_0040,IL_0050,IL_0030,IL_0074)
newobj System.Void Syntex_Spoofer.Menu::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ldc.i4 0
ldsfld <Module>{ce1011b1-43ec-41e5-a50c-3371cc47829e} <Module>{ce1011b1-43ec-41e5-a50c-3371cc47829e}::m_fe5ba2a53ef940ec9057ae4e2fae8281
ldfld System.Int32 <Module>{ce1011b1-43ec-41e5-a50c-3371cc47829e}::m_fd521fe3de044b57910f3dcb735e02bf
brtrue IL_0012: switch(IL_003F,IL_0040,IL_0050,IL_0030,IL_0074)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_003F,IL_0040,IL_0050,IL_0030,IL_0074)
2 malicious2 suspicious115 items
  • 3a2c0219ff5ce2e58109691cf20f51ebAgentTeslaRAT.Net Obfuscator
    • .Net Resources
      • Syntex_Spoofer.Menu.resources
      • costura.costura.dll.compressed
      • OsrueUFt7ujXNivqIa.s4HatZyP29FpvShWGr
      • costura.costura.pdb.compressed
      • costura.costura.pdbFody/Costura Packer
      • HKyXeAxsOH82TKNq3N.VT4UZCrb4bPn8rR7U6
      • costura.guna.ui2.dll.compressed
      • costura.guna.ui2.dllAgentTeslaRATSOS: 0.49
        • [Authenticode]_28203e69.p7b
      • costura.metadata
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙