Suspicious
Suspect

3c63ad84c686d4c2a8cacf7ab492aaee

PE Executable
MD5: 3c63ad84c686d4c2a8cacf7ab492aaee
Size: 4.22 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score High
MD5 3c63ad84c686d4c2a8cacf7ab492aaee
Sha1 57de833436de237499accb14ef0b0aba962f1256
Sha256 10441b79973377e8ba1bf0fa16919566a7286ecfa771a1530df2d10eaeb3724b
Sha384 6ddd8f9ccacc9ce75b594ff4b2a808fac8efbdfa82ac28c6cc84d2903d0eea1d36c0c38d0c7fb2764fbdd7d9a8db9e35
Sha512 38253eb2bced71e4546cdceef654867d724c07f36d188db92b5354a3d357bc928a4bc51b1d91c8a18de5f7daaff73c6f1e89c8327d08b5ba4f49ba5097a941bb
SSDeep 49152:DWrZGwP4z+OEc+8w21BiHYZwnOT+BDWrmu:DWrvHYZwnOT+krmu
TLSH 2816F3C05BB0D662C07584FD76737F209199C3B197A2DDAFB5406B3A2EE918CCE0E991
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
3c63ad84c686d4c2a8cacf7ab492aaee
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
GLCYEnaDWMdXdj.jZBTBXbgTvIF.resources
IypiFkqtLnoaAo.WinForms.Gui.gCNpmyWtQGXb.resources
IypiFkqtLnoaAo.WinForms.Gui.zIFebeEfyqrW.resources
$this.DefaultModifiers
$this.GridSize
$this.Language
IypiFkqtLnoaAo.WinForms.Gui.dISaVaZKsb.resources
FxResources.RxOGjAgsnAMsn.Buffers.jZBTBXbgTvIF.resources
FxResources.RxOGjAgsnAMsn.Memory.jZBTBXbgTvIF.resources
FxResources.RxOGjAgsnAMsn.Numerics.AgsHhjnXSZyOxs.jZBTBXbgTvIF.resources
FxResources.RxOGjAgsnAMsn.Resources.wMeyFgmQEOdsE.jZBTBXbgTvIF.resources
ILLink.Substitutions.xml
FxResources.RxOGjAgsnAMsn.Security.AccessControl.jZBTBXbgTvIF.resources
RxOGjAgsnAMsn.Security.Principal.Windows.xml
STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Obfuscator_Protect By Red3v1l
Full Name
Obfuscator_Protect By Red3v1l
EntryPoint
System.Void hwzwVzKezCT.mXWrOARhhDV::<t.me/GhostHackersNetwork>0JcAZujxwJkuThKWMfMv()
Scope Name
Obfuscator_Protect By Red3v1l
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
XLoaderClient
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
3119
Main Method
System.Void hwzwVzKezCT.mXWrOARhhDV::<t.me/GhostHackersNetwork>0JcAZujxwJkuThKWMfMv()
Main IL Instruction Count
65
Main IL 
call System.Int32 <Module>::<t.me/GhostHackersNetwork>4miOHgS0kFTKyIhoR()
stloc.0 <null>
br.s IL_002D: ldloc.0
nop <null>
call System.Int32 <Module>::<t.me/GhostHackersNetwork>8Ujoct)()
call System.Int32 <Module>::<t.me/GhostHackersNetwork>(hNuXA()
add <null>
call System.Int32 <Module>::<t.me/GhostHackersNetwork>quaTjCe0hcWKg()
sub <null>
call System.Int32 <Module>::<t.me/GhostHackersNetwork>#(nmOhaWvDyD()
add <null>
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
call System.Int32 <Module>::<t.me/GhostHackersNetwork>19iPzK()
add <null>
stloc.0 <null>
ldloc.0 <null>
ldsfld System.String hwzwVzKezCT.iIHuLINqajQqk::#IAQuY0AvsV)&g7!ly77t.me/GhostHackersNetwork
call System.Int32 System.Convert::ToInt32(System.String)
blt.s IL_0008: nop
call System.Boolean hwzwVzKezCT.iIHuLINqajQqk::<t.me/GhostHackersNetwork>t9j3m(asA3f#Tbvp)obH()
brtrue.s IL_004B: nop
call System.Int32 <Module>::<t.me/GhostHackersNetwork>yd1pzJWyWj70SE()
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Boolean WMGIXZriXbu.NDJrkToVMEC::<t.me/GhostHackersNetwork>ihxvSU20I$R5u5OKERwh()
brtrue.s IL_005D: ldsfld System.String hwzwVzKezCT.iIHuLINqajQqk::rE)qMmJX(J!63BY9qC0qt.me/GhostHackersNetwork
call System.Int32 <Module>::<t.me/GhostHackersNetwork>V#xb1#(nWV!7TqzJ()
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String hwzwVzKezCT.iIHuLINqajQqk::rE)qMmJX(J!63BY9qC0qt.me/GhostHackersNetwork
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_006E: ldsfld System.String hwzwVzKezCT.iIHuLINqajQqk::jn&g?XyW5Tn(9n3!zPLLt.me/GhostHackersNetwork
call System.Void WMGIXZriXbu.DDGgNNYKzKic::<t.me/GhostHackersNetwork>QGfiQitV1svyqpUMZtyo()
ldsfld System.String hwzwVzKezCT.iIHuLINqajQqk::jn&g?XyW5Tn(9n3!zPLLt.me/GhostHackersNetwork
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_007F: ldsfld System.String hwzwVzKezCT.iIHuLINqajQqk::k&Hvj)jXTlM6&1aI5nzUt.me/GhostHackersNetwork
call System.Void lgIKiETLAfZiv.PIimyFpCvdr::<t.me/GhostHackersNetwork>ufs3g0dHMr1#feHvfIHC()
ldsfld System.String hwzwVzKezCT.iIHuLINqajQqk::k&Hvj)jXTlM6&1aI5nzUt.me/GhostHackersNetwork
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_0097: call System.Void WMGIXZriXbu.dzCkFmmMZrUT::<t.me/GhostHackersNetwork>ENOpE1TZLBw7$$cPlA#%()
call System.Boolean WMGIXZriXbu.dzCkFmmMZrUT::<t.me/GhostHackersNetwork>REfRM7ntl2#Wa93uvOWd()
brfalse.s IL_0097: call System.Void WMGIXZriXbu.dzCkFmmMZrUT::<t.me/GhostHackersNetwork>ENOpE1TZLBw7$$cPlA#%()
call System.Void WMGIXZriXbu.GeHnudFvVkJol::<t.me/GhostHackersNetwork>sFvhcmv84$N9CAgEqo9T()
call System.Void WMGIXZriXbu.dzCkFmmMZrUT::<t.me/GhostHackersNetwork>ENOpE1TZLBw7$$cPlA#%()
leave.s IL_00A1: nop
pop <null>
leave.s IL_00A1: nop
nop <null>
call System.Boolean xPOcWTADrcqDn.LiZfJZSJAjkQyhk::k2SSMXa4Uo)((jvT7?bc()
brtrue.s IL_00B3: leave.s IL_00B8
call System.Void xPOcWTADrcqDn.LiZfJZSJAjkQyhk::<t.me/GhostHackersNetwork>KVOhsQ89LraoBUDkzAvO()
call System.Void xPOcWTADrcqDn.LiZfJZSJAjkQyhk::<t.me/GhostHackersNetwork>i0uTV1(zIt#la?dx12Z0()
leave.s IL_00B8: nop
pop <null>
leave.s IL_00B8: nop
nop <null>
call System.Int32 <Module>::<t.me/GhostHackersNetwork>$lYIyGw()
call System.Int32 <Module>::<t.me/GhostHackersNetwork>XPVGpC75M2?()
add <null>
call System.Int32 <Module>::<t.me/GhostHackersNetwork>Y5Mg5EMlxgvI7G()
sub <null>
call System.Int32 <Module>::<t.me/GhostHackersNetwork>)mnWcjgoQRCg()
add <null>
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_00A1: nop
Module Name
Obfuscator_Protect By Red3v1l
Full Name
Obfuscator_Protect By Red3v1l
EntryPoint
System.Void hwzwVzKezCT.mXWrOARhhDV::<t.me/GhostHackersNetwork>0JcAZujxwJkuThKWMfMv()
Scope Name
Obfuscator_Protect By Red3v1l
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
XLoaderClient
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
3119
Main Method
System.Void hwzwVzKezCT.mXWrOARhhDV::<t.me/GhostHackersNetwork>0JcAZujxwJkuThKWMfMv()
Main IL Instruction Count
65
Main IL 
call System.Int32 <Module>::<t.me/GhostHackersNetwork>4miOHgS0kFTKyIhoR()
stloc.0 <null>
br.s IL_002D: ldloc.0
nop <null>
call System.Int32 <Module>::<t.me/GhostHackersNetwork>8Ujoct)()
call System.Int32 <Module>::<t.me/GhostHackersNetwork>(hNuXA()
add <null>
call System.Int32 <Module>::<t.me/GhostHackersNetwork>quaTjCe0hcWKg()
sub <null>
call System.Int32 <Module>::<t.me/GhostHackersNetwork>#(nmOhaWvDyD()
add <null>
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
call System.Int32 <Module>::<t.me/GhostHackersNetwork>19iPzK()
add <null>
stloc.0 <null>
ldloc.0 <null>
ldsfld System.String hwzwVzKezCT.iIHuLINqajQqk::#IAQuY0AvsV)&g7!ly77t.me/GhostHackersNetwork
call System.Int32 System.Convert::ToInt32(System.String)
blt.s IL_0008: nop
call System.Boolean hwzwVzKezCT.iIHuLINqajQqk::<t.me/GhostHackersNetwork>t9j3m(asA3f#Tbvp)obH()
brtrue.s IL_004B: nop
call System.Int32 <Module>::<t.me/GhostHackersNetwork>yd1pzJWyWj70SE()
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Boolean WMGIXZriXbu.NDJrkToVMEC::<t.me/GhostHackersNetwork>ihxvSU20I$R5u5OKERwh()
brtrue.s IL_005D: ldsfld System.String hwzwVzKezCT.iIHuLINqajQqk::rE)qMmJX(J!63BY9qC0qt.me/GhostHackersNetwork
call System.Int32 <Module>::<t.me/GhostHackersNetwork>V#xb1#(nWV!7TqzJ()
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String hwzwVzKezCT.iIHuLINqajQqk::rE)qMmJX(J!63BY9qC0qt.me/GhostHackersNetwork
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_006E: ldsfld System.String hwzwVzKezCT.iIHuLINqajQqk::jn&g?XyW5Tn(9n3!zPLLt.me/GhostHackersNetwork
call System.Void WMGIXZriXbu.DDGgNNYKzKic::<t.me/GhostHackersNetwork>QGfiQitV1svyqpUMZtyo()
ldsfld System.String hwzwVzKezCT.iIHuLINqajQqk::jn&g?XyW5Tn(9n3!zPLLt.me/GhostHackersNetwork
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_007F: ldsfld System.String hwzwVzKezCT.iIHuLINqajQqk::k&Hvj)jXTlM6&1aI5nzUt.me/GhostHackersNetwork
call System.Void lgIKiETLAfZiv.PIimyFpCvdr::<t.me/GhostHackersNetwork>ufs3g0dHMr1#feHvfIHC()
ldsfld System.String hwzwVzKezCT.iIHuLINqajQqk::k&Hvj)jXTlM6&1aI5nzUt.me/GhostHackersNetwork
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_0097: call System.Void WMGIXZriXbu.dzCkFmmMZrUT::<t.me/GhostHackersNetwork>ENOpE1TZLBw7$$cPlA#%()
call System.Boolean WMGIXZriXbu.dzCkFmmMZrUT::<t.me/GhostHackersNetwork>REfRM7ntl2#Wa93uvOWd()
brfalse.s IL_0097: call System.Void WMGIXZriXbu.dzCkFmmMZrUT::<t.me/GhostHackersNetwork>ENOpE1TZLBw7$$cPlA#%()
call System.Void WMGIXZriXbu.GeHnudFvVkJol::<t.me/GhostHackersNetwork>sFvhcmv84$N9CAgEqo9T()
call System.Void WMGIXZriXbu.dzCkFmmMZrUT::<t.me/GhostHackersNetwork>ENOpE1TZLBw7$$cPlA#%()
leave.s IL_00A1: nop
pop <null>
leave.s IL_00A1: nop
nop <null>
call System.Boolean xPOcWTADrcqDn.LiZfJZSJAjkQyhk::k2SSMXa4Uo)((jvT7?bc()
brtrue.s IL_00B3: leave.s IL_00B8
call System.Void xPOcWTADrcqDn.LiZfJZSJAjkQyhk::<t.me/GhostHackersNetwork>KVOhsQ89LraoBUDkzAvO()
call System.Void xPOcWTADrcqDn.LiZfJZSJAjkQyhk::<t.me/GhostHackersNetwork>i0uTV1(zIt#la?dx12Z0()
leave.s IL_00B8: nop
pop <null>
leave.s IL_00B8: nop
nop <null>
call System.Int32 <Module>::<t.me/GhostHackersNetwork>$lYIyGw()
call System.Int32 <Module>::<t.me/GhostHackersNetwork>XPVGpC75M2?()
add <null>
call System.Int32 <Module>::<t.me/GhostHackersNetwork>Y5Mg5EMlxgvI7G()
sub <null>
call System.Int32 <Module>::<t.me/GhostHackersNetwork>)mnWcjgoQRCg()
add <null>
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_00A1: nop
3c63ad84c686d4c2a8cacf7ab492aaee
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
GLCYEnaDWMdXdj.jZBTBXbgTvIF.resources
IypiFkqtLnoaAo.WinForms.Gui.gCNpmyWtQGXb.resources
IypiFkqtLnoaAo.WinForms.Gui.zIFebeEfyqrW.resources
$this.DefaultModifiers
$this.GridSize
$this.Language
IypiFkqtLnoaAo.WinForms.Gui.dISaVaZKsb.resources
FxResources.RxOGjAgsnAMsn.Buffers.jZBTBXbgTvIF.resources
FxResources.RxOGjAgsnAMsn.Memory.jZBTBXbgTvIF.resources
FxResources.RxOGjAgsnAMsn.Numerics.AgsHhjnXSZyOxs.jZBTBXbgTvIF.resources
FxResources.RxOGjAgsnAMsn.Resources.wMeyFgmQEOdsE.jZBTBXbgTvIF.resources
ILLink.Substitutions.xml
FxResources.RxOGjAgsnAMsn.Security.AccessControl.jZBTBXbgTvIF.resources
RxOGjAgsnAMsn.Security.Principal.Windows.xml
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙