Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
1 malicious · 3 files
EXE3a98def1a2e05618b866aefee0622173AsyncRAT
Structure
Config. Field Value
Key (AES_256) UFZCekhuhuhuhuhuhuhuhuhuhuhu
Pastebin -huhuhuhu
Certificate MIIE8jhuhuhuhuhuhuhuhuhuhuhu
ServerSignature k06Az5huhuhuhuhuhuhuhuhuhuhu
Install fhuhuhuhu
BDOS fhuhuhuhu
Anti-VM thuhuhuhu
Install-Folder %Aphuhuhuhu
Hosts 185.2huhuhuhuhuhuhu
Ports 7huhuhuhu
Mutex Asynchuhuhuhuhuhuhu
Delay 3huhuhuhu
Group fhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
yCOPojkhrvtJIb
Full Name
yCOPojkhrvtJIb
EntryPoint
System.Void ERmoGAFygqMRQ.UnfLxzVsvKI::Main()
Scope Name
yCOPojkhrvtJIb
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
7706
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
461
Main Method
System.Void ERmoGAFygqMRQ.UnfLxzVsvKI::Main()
Main IL Instruction Count
67
Main IL 
call System.Void psNomyRUjD.YNmZIlpkZMi::dOAwAtpgcqdRC()
call System.Void psNomyRUjD.YNmZIlpkZMi::LiFPcIxPqKNfo()
call System.Void psNomyRUjD.YNmZIlpkZMi::GzQxohKojUTVSX()
ldc.i4.0 <null>
stloc.0 <null>
br IL_0024: ldloc.0
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
ldc.i4.1 <null>
add <null>
stloc.0 <null>
ldloc.0 <null>
ldsfld System.String ERmoGAFygqMRQ.liArlRIxETp::nfuQNelRyZoBC
call System.Int32 System.Convert::ToInt32(System.String)
blt.s IL_0016: ldc.i4 1000
call System.Boolean ERmoGAFygqMRQ.liArlRIxETp::ryGhkdVtYv()
brtrue IL_0041: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Boolean psNomyRUjD.agHcYvWvSCqX::YOtUgibQQib()
brtrue IL_0052: ldsfld System.String ERmoGAFygqMRQ.liArlRIxETp::DLVmfXUQWEIxo
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String ERmoGAFygqMRQ.liArlRIxETp::DLVmfXUQWEIxo
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_0066: ldsfld System.String ERmoGAFygqMRQ.liArlRIxETp::rSmqlXonpsaZJN
call System.Void psNomyRUjD.dglpyzANojeRKq::jxZdYccJbiOYjYJ()
ldsfld System.String ERmoGAFygqMRQ.liArlRIxETp::rSmqlXonpsaZJN
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_007A: ldsfld System.String ERmoGAFygqMRQ.liArlRIxETp::LPwwAiOcMJCB
call System.Void nzaIkpBWqTdJc.pNbjZXGlLREd::mJtVKTsyDiwU()
ldsfld System.String ERmoGAFygqMRQ.liArlRIxETp::LPwwAiOcMJCB
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_0098: call System.Void psNomyRUjD.TBTrtFQUvJw::BZPXqOswHQt()
call System.Boolean psNomyRUjD.TBTrtFQUvJw::UCXogGVQIxiEqcxb()
brfalse IL_0098: call System.Void psNomyRUjD.TBTrtFQUvJw::BZPXqOswHQt()
call System.Void psNomyRUjD.kkhkgygsQKZj::loKbvLwgZJps()
call System.Void psNomyRUjD.TBTrtFQUvJw::BZPXqOswHQt()
ldnull <null>
ldftn System.Void psNomyRUjD.TBTrtFQUvJw::IcHUVdVuQcoaHM()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
callvirt System.Void System.Threading.Thread::Start()
ldsfld System.String ERmoGAFygqMRQ.liArlRIxETp::OJIDnBKgPHmhM
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_00D8: leave IL_00E3
ldnull <null>
ldftn System.Void psNomyRUjD.gqaHQrgMvGe::ftnQOdeavEbB()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
callvirt System.Void System.Threading.Thread::Start()
leave IL_00E3: nop
pop <null>
leave IL_00E3: nop
nop <null>
call System.Boolean ieTFuOYrOeKMEoI.dcbnNDPZZr::get_IsConnected()
brtrue IL_00F8: leave IL_0103
call System.Void ieTFuOYrOeKMEoI.dcbnNDPZZr::uRvVuiZqbLgtsr()
call System.Void ieTFuOYrOeKMEoI.dcbnNDPZZr::vusfEnRaJoozD()
leave IL_0103: ldc.i4 5000
pop <null>
leave IL_0103: ldc.i4 5000
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_00E3: nop
Module Name
yCOPojkhrvtJIb
Full Name
yCOPojkhrvtJIb
EntryPoint
System.Void ERmoGAFygqMRQ.UnfLxzVsvKI::Main()
Scope Name
yCOPojkhrvtJIb
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
7706
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
461
Main Method
System.Void ERmoGAFygqMRQ.UnfLxzVsvKI::Main()
Main IL Instruction Count
67
Main IL 
call System.Void psNomyRUjD.YNmZIlpkZMi::dOAwAtpgcqdRC()
call System.Void psNomyRUjD.YNmZIlpkZMi::LiFPcIxPqKNfo()
call System.Void psNomyRUjD.YNmZIlpkZMi::GzQxohKojUTVSX()
ldc.i4.0 <null>
stloc.0 <null>
br IL_0024: ldloc.0
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
ldc.i4.1 <null>
add <null>
stloc.0 <null>
ldloc.0 <null>
ldsfld System.String ERmoGAFygqMRQ.liArlRIxETp::nfuQNelRyZoBC
call System.Int32 System.Convert::ToInt32(System.String)
blt.s IL_0016: ldc.i4 1000
call System.Boolean ERmoGAFygqMRQ.liArlRIxETp::ryGhkdVtYv()
brtrue IL_0041: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Boolean psNomyRUjD.agHcYvWvSCqX::YOtUgibQQib()
brtrue IL_0052: ldsfld System.String ERmoGAFygqMRQ.liArlRIxETp::DLVmfXUQWEIxo
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String ERmoGAFygqMRQ.liArlRIxETp::DLVmfXUQWEIxo
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_0066: ldsfld System.String ERmoGAFygqMRQ.liArlRIxETp::rSmqlXonpsaZJN
call System.Void psNomyRUjD.dglpyzANojeRKq::jxZdYccJbiOYjYJ()
ldsfld System.String ERmoGAFygqMRQ.liArlRIxETp::rSmqlXonpsaZJN
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_007A: ldsfld System.String ERmoGAFygqMRQ.liArlRIxETp::LPwwAiOcMJCB
call System.Void nzaIkpBWqTdJc.pNbjZXGlLREd::mJtVKTsyDiwU()
ldsfld System.String ERmoGAFygqMRQ.liArlRIxETp::LPwwAiOcMJCB
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_0098: call System.Void psNomyRUjD.TBTrtFQUvJw::BZPXqOswHQt()
call System.Boolean psNomyRUjD.TBTrtFQUvJw::UCXogGVQIxiEqcxb()
brfalse IL_0098: call System.Void psNomyRUjD.TBTrtFQUvJw::BZPXqOswHQt()
call System.Void psNomyRUjD.kkhkgygsQKZj::loKbvLwgZJps()
call System.Void psNomyRUjD.TBTrtFQUvJw::BZPXqOswHQt()
ldnull <null>
ldftn System.Void psNomyRUjD.TBTrtFQUvJw::IcHUVdVuQcoaHM()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
callvirt System.Void System.Threading.Thread::Start()
ldsfld System.String ERmoGAFygqMRQ.liArlRIxETp::OJIDnBKgPHmhM
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_00D8: leave IL_00E3
ldnull <null>
ldftn System.Void psNomyRUjD.gqaHQrgMvGe::ftnQOdeavEbB()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
callvirt System.Void System.Threading.Thread::Start()
leave IL_00E3: nop
pop <null>
leave IL_00E3: nop
nop <null>
call System.Boolean ieTFuOYrOeKMEoI.dcbnNDPZZr::get_IsConnected()
brtrue IL_00F8: leave IL_0103
call System.Void ieTFuOYrOeKMEoI.dcbnNDPZZr::uRvVuiZqbLgtsr()
call System.Void ieTFuOYrOeKMEoI.dcbnNDPZZr::vusfEnRaJoozD()
leave IL_0103: ldc.i4 5000
pop <null>
leave IL_0103: ldc.i4 5000
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_00E3: nop
Key (AES_256) MUTEXmalicious
UFZCekhuhuhuhuhuhuhuhuhuhuhu
CnC CNCmalicious
185.2huhuhuhuhuhuhu
Ports PORTmalicious
7huhuhuhu
Mutex MUTEXmalicious
Asynchuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙