Suspicious
Suspect

3c63ad84c686d4c2a8cacf7ab492aaee

Share on LinkedIn
Print
PE Executable
MD5: 3c63ad84c686d4c2a8cacf7ab492aaee
Size: 4.22 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score High
MD5 3c63ad84c686d4c2a8cacf7ab492aaee
Sha1 57de833436de237499accb14ef0b0aba962f1256
Sha256 10441b79973377e8ba1bf0fa16919566a7286ecfa771a1530df2d10eaeb3724b
Sha384 6ddd8f9ccacc9ce75b594ff4b2a808fac8efbdfa82ac28c6cc84d2903d0eea1d36c0c38d0c7fb2764fbdd7d9a8db9e35
Sha512 38253eb2bced71e4546cdceef654867d724c07f36d188db92b5354a3d357bc928a4bc51b1d91c8a18de5f7daaff73c6f1e89c8327d08b5ba4f49ba5097a941bb
SSDeep 49152:DWrZGwP4z+OEc+8w21BiHYZwnOT+BDWrmu:DWrvHYZwnOT+krmu
TLSH 2816F3C05BB0D662C07584FD76737F209199C3B197A2DDAFB5406B3A2EE918CCE0E991
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
3c63ad84c686d4c2a8cacf7ab492aaee
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
GLCYEnaDWMdXdj.jZBTBXbgTvIF.resources
IypiFkqtLnoaAo.WinForms.Gui.gCNpmyWtQGXb.resources
IypiFkqtLnoaAo.WinForms.Gui.zIFebeEfyqrW.resources
$this.DefaultModifiers
$this.GridSize
$this.Language
IypiFkqtLnoaAo.WinForms.Gui.dISaVaZKsb.resources
FxResources.RxOGjAgsnAMsn.Buffers.jZBTBXbgTvIF.resources
FxResources.RxOGjAgsnAMsn.Memory.jZBTBXbgTvIF.resources
FxResources.RxOGjAgsnAMsn.Numerics.AgsHhjnXSZyOxs.jZBTBXbgTvIF.resources
FxResources.RxOGjAgsnAMsn.Resources.wMeyFgmQEOdsE.jZBTBXbgTvIF.resources
ILLink.Substitutions.xml
FxResources.RxOGjAgsnAMsn.Security.AccessControl.jZBTBXbgTvIF.resources
RxOGjAgsnAMsn.Security.Principal.Windows.xml
STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Obfuscator_Protect By Red3v1l
Full Name
Obfuscator_Protect By Red3v1l
EntryPoint
System.Void hwzwVzKezCT.mXWrOARhhDV::<t.me/GhostHackersNetwork>0JcAZujxwJkuThKWMfMv()
Scope Name
Obfuscator_Protect By Red3v1l
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
XLoaderClient
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
3119
Main Method
System.Void hwzwVzKezCT.mXWrOARhhDV::<t.me/GhostHackersNetwork>0JcAZujxwJkuThKWMfMv()
Main IL Instruction Count
65
Main IL 
call System.Int32 <Module>::<t.me/GhostHackersNetwork>4miOHgS0kFTKyIhoR()
stloc.0 <null>
br.s IL_002D: ldloc.0
nop <null>
call System.Int32 <Module>::<t.me/GhostHackersNetwork>8Ujoct)()
call System.Int32 <Module>::<t.me/GhostHackersNetwork>(hNuXA()
add <null>
call System.Int32 <Module>::<t.me/GhostHackersNetwork>quaTjCe0hcWKg()
sub <null>
call System.Int32 <Module>::<t.me/GhostHackersNetwork>#(nmOhaWvDyD()
add <null>
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
call System.Int32 <Module>::<t.me/GhostHackersNetwork>19iPzK()
add <null>
stloc.0 <null>
ldloc.0 <null>
ldsfld System.String hwzwVzKezCT.iIHuLINqajQqk::#IAQuY0AvsV)&g7!ly77t.me/GhostHackersNetwork
call System.Int32 System.Convert::ToInt32(System.String)
blt.s IL_0008: nop
call System.Boolean hwzwVzKezCT.iIHuLINqajQqk::<t.me/GhostHackersNetwork>t9j3m(asA3f#Tbvp)obH()
brtrue.s IL_004B: nop
call System.Int32 <Module>::<t.me/GhostHackersNetwork>yd1pzJWyWj70SE()
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Boolean WMGIXZriXbu.NDJrkToVMEC::<t.me/GhostHackersNetwork>ihxvSU20I$R5u5OKERwh()
brtrue.s IL_005D: ldsfld System.String hwzwVzKezCT.iIHuLINqajQqk::rE)qMmJX(J!63BY9qC0qt.me/GhostHackersNetwork
call System.Int32 <Module>::<t.me/GhostHackersNetwork>V#xb1#(nWV!7TqzJ()
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String hwzwVzKezCT.iIHuLINqajQqk::rE)qMmJX(J!63BY9qC0qt.me/GhostHackersNetwork
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_006E: ldsfld System.String hwzwVzKezCT.iIHuLINqajQqk::jn&g?XyW5Tn(9n3!zPLLt.me/GhostHackersNetwork
call System.Void WMGIXZriXbu.DDGgNNYKzKic::<t.me/GhostHackersNetwork>QGfiQitV1svyqpUMZtyo()
ldsfld System.String hwzwVzKezCT.iIHuLINqajQqk::jn&g?XyW5Tn(9n3!zPLLt.me/GhostHackersNetwork
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_007F: ldsfld System.String hwzwVzKezCT.iIHuLINqajQqk::k&Hvj)jXTlM6&1aI5nzUt.me/GhostHackersNetwork
call System.Void lgIKiETLAfZiv.PIimyFpCvdr::<t.me/GhostHackersNetwork>ufs3g0dHMr1#feHvfIHC()
ldsfld System.String hwzwVzKezCT.iIHuLINqajQqk::k&Hvj)jXTlM6&1aI5nzUt.me/GhostHackersNetwork
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_0097: call System.Void WMGIXZriXbu.dzCkFmmMZrUT::<t.me/GhostHackersNetwork>ENOpE1TZLBw7$$cPlA#%()
call System.Boolean WMGIXZriXbu.dzCkFmmMZrUT::<t.me/GhostHackersNetwork>REfRM7ntl2#Wa93uvOWd()
brfalse.s IL_0097: call System.Void WMGIXZriXbu.dzCkFmmMZrUT::<t.me/GhostHackersNetwork>ENOpE1TZLBw7$$cPlA#%()
call System.Void WMGIXZriXbu.GeHnudFvVkJol::<t.me/GhostHackersNetwork>sFvhcmv84$N9CAgEqo9T()
call System.Void WMGIXZriXbu.dzCkFmmMZrUT::<t.me/GhostHackersNetwork>ENOpE1TZLBw7$$cPlA#%()
leave.s IL_00A1: nop
pop <null>
leave.s IL_00A1: nop
nop <null>
call System.Boolean xPOcWTADrcqDn.LiZfJZSJAjkQyhk::k2SSMXa4Uo)((jvT7?bc()
brtrue.s IL_00B3: leave.s IL_00B8
call System.Void xPOcWTADrcqDn.LiZfJZSJAjkQyhk::<t.me/GhostHackersNetwork>KVOhsQ89LraoBUDkzAvO()
call System.Void xPOcWTADrcqDn.LiZfJZSJAjkQyhk::<t.me/GhostHackersNetwork>i0uTV1(zIt#la?dx12Z0()
leave.s IL_00B8: nop
pop <null>
leave.s IL_00B8: nop
nop <null>
call System.Int32 <Module>::<t.me/GhostHackersNetwork>$lYIyGw()
call System.Int32 <Module>::<t.me/GhostHackersNetwork>XPVGpC75M2?()
add <null>
call System.Int32 <Module>::<t.me/GhostHackersNetwork>Y5Mg5EMlxgvI7G()
sub <null>
call System.Int32 <Module>::<t.me/GhostHackersNetwork>)mnWcjgoQRCg()
add <null>
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_00A1: nop
Module Name
Obfuscator_Protect By Red3v1l
Full Name
Obfuscator_Protect By Red3v1l
EntryPoint
System.Void hwzwVzKezCT.mXWrOARhhDV::<t.me/GhostHackersNetwork>0JcAZujxwJkuThKWMfMv()
Scope Name
Obfuscator_Protect By Red3v1l
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
XLoaderClient
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
3119
Main Method
System.Void hwzwVzKezCT.mXWrOARhhDV::<t.me/GhostHackersNetwork>0JcAZujxwJkuThKWMfMv()
Main IL Instruction Count
65
Main IL 
call System.Int32 <Module>::<t.me/GhostHackersNetwork>4miOHgS0kFTKyIhoR()
stloc.0 <null>
br.s IL_002D: ldloc.0
nop <null>
call System.Int32 <Module>::<t.me/GhostHackersNetwork>8Ujoct)()
call System.Int32 <Module>::<t.me/GhostHackersNetwork>(hNuXA()
add <null>
call System.Int32 <Module>::<t.me/GhostHackersNetwork>quaTjCe0hcWKg()
sub <null>
call System.Int32 <Module>::<t.me/GhostHackersNetwork>#(nmOhaWvDyD()
add <null>
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
call System.Int32 <Module>::<t.me/GhostHackersNetwork>19iPzK()
add <null>
stloc.0 <null>
ldloc.0 <null>
ldsfld System.String hwzwVzKezCT.iIHuLINqajQqk::#IAQuY0AvsV)&g7!ly77t.me/GhostHackersNetwork
call System.Int32 System.Convert::ToInt32(System.String)
blt.s IL_0008: nop
call System.Boolean hwzwVzKezCT.iIHuLINqajQqk::<t.me/GhostHackersNetwork>t9j3m(asA3f#Tbvp)obH()
brtrue.s IL_004B: nop
call System.Int32 <Module>::<t.me/GhostHackersNetwork>yd1pzJWyWj70SE()
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Boolean WMGIXZriXbu.NDJrkToVMEC::<t.me/GhostHackersNetwork>ihxvSU20I$R5u5OKERwh()
brtrue.s IL_005D: ldsfld System.String hwzwVzKezCT.iIHuLINqajQqk::rE)qMmJX(J!63BY9qC0qt.me/GhostHackersNetwork
call System.Int32 <Module>::<t.me/GhostHackersNetwork>V#xb1#(nWV!7TqzJ()
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String hwzwVzKezCT.iIHuLINqajQqk::rE)qMmJX(J!63BY9qC0qt.me/GhostHackersNetwork
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_006E: ldsfld System.String hwzwVzKezCT.iIHuLINqajQqk::jn&g?XyW5Tn(9n3!zPLLt.me/GhostHackersNetwork
call System.Void WMGIXZriXbu.DDGgNNYKzKic::<t.me/GhostHackersNetwork>QGfiQitV1svyqpUMZtyo()
ldsfld System.String hwzwVzKezCT.iIHuLINqajQqk::jn&g?XyW5Tn(9n3!zPLLt.me/GhostHackersNetwork
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_007F: ldsfld System.String hwzwVzKezCT.iIHuLINqajQqk::k&Hvj)jXTlM6&1aI5nzUt.me/GhostHackersNetwork
call System.Void lgIKiETLAfZiv.PIimyFpCvdr::<t.me/GhostHackersNetwork>ufs3g0dHMr1#feHvfIHC()
ldsfld System.String hwzwVzKezCT.iIHuLINqajQqk::k&Hvj)jXTlM6&1aI5nzUt.me/GhostHackersNetwork
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_0097: call System.Void WMGIXZriXbu.dzCkFmmMZrUT::<t.me/GhostHackersNetwork>ENOpE1TZLBw7$$cPlA#%()
call System.Boolean WMGIXZriXbu.dzCkFmmMZrUT::<t.me/GhostHackersNetwork>REfRM7ntl2#Wa93uvOWd()
brfalse.s IL_0097: call System.Void WMGIXZriXbu.dzCkFmmMZrUT::<t.me/GhostHackersNetwork>ENOpE1TZLBw7$$cPlA#%()
call System.Void WMGIXZriXbu.GeHnudFvVkJol::<t.me/GhostHackersNetwork>sFvhcmv84$N9CAgEqo9T()
call System.Void WMGIXZriXbu.dzCkFmmMZrUT::<t.me/GhostHackersNetwork>ENOpE1TZLBw7$$cPlA#%()
leave.s IL_00A1: nop
pop <null>
leave.s IL_00A1: nop
nop <null>
call System.Boolean xPOcWTADrcqDn.LiZfJZSJAjkQyhk::k2SSMXa4Uo)((jvT7?bc()
brtrue.s IL_00B3: leave.s IL_00B8
call System.Void xPOcWTADrcqDn.LiZfJZSJAjkQyhk::<t.me/GhostHackersNetwork>KVOhsQ89LraoBUDkzAvO()
call System.Void xPOcWTADrcqDn.LiZfJZSJAjkQyhk::<t.me/GhostHackersNetwork>i0uTV1(zIt#la?dx12Z0()
leave.s IL_00B8: nop
pop <null>
leave.s IL_00B8: nop
nop <null>
call System.Int32 <Module>::<t.me/GhostHackersNetwork>$lYIyGw()
call System.Int32 <Module>::<t.me/GhostHackersNetwork>XPVGpC75M2?()
add <null>
call System.Int32 <Module>::<t.me/GhostHackersNetwork>Y5Mg5EMlxgvI7G()
sub <null>
call System.Int32 <Module>::<t.me/GhostHackersNetwork>)mnWcjgoQRCg()
add <null>
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_00A1: nop
An error has occurred. This application may no longer respond until reloaded. Reload 🗙