42a19a7fbb7819d7f37c4d90069ef873

PE Executable

MD5: 42a19a7fbb7819d7f37c4d90069ef873

Size: 75.78 KB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Low

MD5	42a19a7fbb7819d7f37c4d90069ef873
Sha1	42f3d88c93c5f3306b3d7a0dd476149f9ea10532
Sha256	04a811a447f78c2abfd60d8562c4be77104ca29a3dcf9a8e59b398cb517224e4
Sha384	8a6c53fd93a46d1a373eafc68786f4e00c35fa1232f57bd7c170b9640a6ddde4ed467fd5fd01ba87252fe9c1afffe430
Sha512	4976ac7b97576d4744cb3421a3ba0f663ac80cf10743d9c3ac6db472a0d79bdbf727c0159573cc76f9b28b7a916f88c4eacdd4de919386f34fe16f66d3794569
SSDeep	1536:UU7AcxOIWC72PMVoB787IQH1bt/DQzcOLVclN:UUscxONo2PMVoN8xH1btLQHBY
TLSH	7C736C013BD88926F2AE4BB9BDF252074EF4D5576112CD5E3CC800DD5A67BC68A037EA

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

STICH beta

No STICH Path has been generated for this analysis yet.

1 structural branch were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 1

Name	Value
Module Name	Cnt.exe
Full Name	Cnt.exe
EntryPoint	System.Void Client.Program::Main()
Scope Name	Cnt.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Cnt
Assembly Version	6.0.1.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Info	PE Detect: PeReader OK (file layout)
Total Strings	252
Main Method	System.Void Client.Program::Main()
Main IL Instruction Count	94
Main IL	ldc.i4.s 26 call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) ldstr MyData call System.String System.IO.Path::Combine(System.String,System.String) call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldsfld Params.KeylogParams Client.Keylogger::Params callvirt System.Void Params.KeylogParams::LoadFromFile() ldc.i4.1 <null> call System.Void System.Net.ServicePointManager::set_Expect100Continue(System.Boolean) ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldc.i4 9999 call System.Void System.Net.ServicePointManager::set_DefaultConnectionLimit(System.Int32) ldc.i4.0 <null> stloc.0 <null> br IL_0050: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::De_lay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0042: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_006D: call System.Void Client.Helper.SetRegistry::InitRegistry() ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Client.Helper.SetRegistry::InitRegistry() ldsfld System.String Client.Settings::An_ti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0086: leave IL_0091 call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() leave IL_0091: call System.Void Client.Helper.A::B() pop <null> leave IL_0091: call System.Void Client.Helper.A::B() call System.Void Client.Helper.A::B() call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_00A6: leave IL_00B1 ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) leave IL_00B1: nop pop <null> leave IL_00B1: nop nop <null> ldsfld System.String Client.Settings::Anti_Process call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_00C6: leave IL_00D1 call System.Void Client.Helper.AntiProcess::StartBlock() leave IL_00D1: nop pop <null> leave IL_00D1: nop nop <null> ldsfld System.String Client.Settings::BS_OD call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_00F0: leave IL_00FB call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_00F0: leave IL_00FB call System.Void Client.Helper.ProcessCritical::Set() leave IL_00FB: nop pop <null> leave IL_00FB: nop nop <null> ldsfld System.String Client.Settings::In_stall call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0110: leave IL_011B call System.Void Client.Install.NormalStartup::Install() leave IL_011B: call System.Void Client.Helper.Methods::PreventSleep() pop <null> leave IL_011B: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_012F: leave IL_013A call System.Void Client.Helper.Methods::ClearSetting() leave IL_013A: ldsfld System.Threading.ThreadStart Client.Program/<>c::<>9__0_0 pop <null> leave IL_013A: ldsfld System.Threading.ThreadStart Client.Program/<>c::<>9__0_0 ldsfld System.Threading.ThreadStart Client.Program/<>c::<>9__0_0 dup <null> brtrue IL_015C: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) pop <null> ldsfld Client.Program/<>c Client.Program/<>c::<>9 ldftn System.Void Client.Program/<>c::<Main>b__0_0() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Threading.ThreadStart Client.Program/<>c::<>9__0_0 newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) call System.Void System.Threading.Thread::Start() call System.Void Client.Keylogger::Run() call System.Void System.Windows.Forms.Application::Run() ret <null>
Module Name	Cnt.exe
Full Name	Cnt.exe
EntryPoint	System.Void Client.Program::Main()
Scope Name	Cnt.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Cnt
Assembly Version	6.0.1.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	252
Main Method	System.Void Client.Program::Main()
Main IL Instruction Count	94
Main IL	ldc.i4.s 26 call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) ldstr MyData call System.String System.IO.Path::Combine(System.String,System.String) call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldsfld Params.KeylogParams Client.Keylogger::Params callvirt System.Void Params.KeylogParams::LoadFromFile() ldc.i4.1 <null> call System.Void System.Net.ServicePointManager::set_Expect100Continue(System.Boolean) ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldc.i4 9999 call System.Void System.Net.ServicePointManager::set_DefaultConnectionLimit(System.Int32) ldc.i4.0 <null> stloc.0 <null> br IL_0050: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::De_lay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0042: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_006D: call System.Void Client.Helper.SetRegistry::InitRegistry() ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Client.Helper.SetRegistry::InitRegistry() ldsfld System.String Client.Settings::An_ti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0086: leave IL_0091 call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() leave IL_0091: call System.Void Client.Helper.A::B() pop <null> leave IL_0091: call System.Void Client.Helper.A::B() call System.Void Client.Helper.A::B() call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_00A6: leave IL_00B1 ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) leave IL_00B1: nop pop <null> leave IL_00B1: nop nop <null> ldsfld System.String Client.Settings::Anti_Process call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_00C6: leave IL_00D1 call System.Void Client.Helper.AntiProcess::StartBlock() leave IL_00D1: nop pop <null> leave IL_00D1: nop nop <null> ldsfld System.String Client.Settings::BS_OD call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_00F0: leave IL_00FB call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_00F0: leave IL_00FB call System.Void Client.Helper.ProcessCritical::Set() leave IL_00FB: nop pop <null> leave IL_00FB: nop nop <null> ldsfld System.String Client.Settings::In_stall call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0110: leave IL_011B call System.Void Client.Install.NormalStartup::Install() leave IL_011B: call System.Void Client.Helper.Methods::PreventSleep() pop <null> leave IL_011B: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_012F: leave IL_013A call System.Void Client.Helper.Methods::ClearSetting() leave IL_013A: ldsfld System.Threading.ThreadStart Client.Program/<>c::<>9__0_0 pop <null> leave IL_013A: ldsfld System.Threading.ThreadStart Client.Program/<>c::<>9__0_0 ldsfld System.Threading.ThreadStart Client.Program/<>c::<>9__0_0 dup <null> brtrue IL_015C: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) pop <null> ldsfld Client.Program/<>c Client.Program/<>c::<>9 ldftn System.Void Client.Program/<>c::<Main>b__0_0() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Threading.ThreadStart Client.Program/<>c::<>9__0_0 newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) call System.Void System.Threading.Thread::Start() call System.Void Client.Keylogger::Run() call System.Void System.Windows.Forms.Application::Run() ret <null>

No malware configuration was found at this point.

You must be signed in to view YARA rules.