Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
1 malicious · 3 files
EXE4e0006b06c3e828cd89844e3fa14f372AsyncRAT
Structure
Config. Field Value
Key (AES_256) UUl2RThuhuhuhuhuhuhuhuhuhuhu
Pastebin -huhuhuhu
Certificate MIIE8jhuhuhuhuhuhuhuhuhuhuhu
ServerSignature gO94z1huhuhuhuhuhuhuhuhuhuhu
Install fhuhuhuhu
BDOS fhuhuhuhu
Anti-VM thuhuhuhu
Install-Folder %Aphuhuhuhu
Ports 6606huhuhuhuhuhuhu
Mutex Asynchuhuhuhuhuhuhu
Delay 3huhuhuhu
Group fhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
CtGBSBEUHsq
Full Name
CtGBSBEUHsq
EntryPoint
System.Void IpRjFynUMfIc.LsGyIXidMgWL::Main()
Scope Name
CtGBSBEUHsq
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
AsyncClient
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
461
Main Method
System.Void IpRjFynUMfIc.LsGyIXidMgWL::Main()
Main IL Instruction Count
67
Main IL 
call System.Void RtbYkJaNhfYV.zgFSDSgdhb::VeGBosPeKaP()
call System.Void RtbYkJaNhfYV.zgFSDSgdhb::WWXrcZKhRP()
call System.Void RtbYkJaNhfYV.zgFSDSgdhb::fVEGQRGJvcVT()
ldc.i4.0 <null>
stloc.0 <null>
br IL_0024: ldloc.0
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
ldc.i4.1 <null>
add <null>
stloc.0 <null>
ldloc.0 <null>
ldsfld System.String IpRjFynUMfIc.zHImMtuJlGToj::arvdSeugMSpp
call System.Int32 System.Convert::ToInt32(System.String)
blt.s IL_0016: ldc.i4 1000
call System.Boolean IpRjFynUMfIc.zHImMtuJlGToj::DEHribPezzmJ()
brtrue IL_0041: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Boolean RtbYkJaNhfYV.LxjItcQAmVI::EYkMvVKbgyK()
brtrue IL_0052: ldsfld System.String IpRjFynUMfIc.zHImMtuJlGToj::uqbMXJIyhrfOh
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String IpRjFynUMfIc.zHImMtuJlGToj::uqbMXJIyhrfOh
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_0066: ldsfld System.String IpRjFynUMfIc.zHImMtuJlGToj::yNzqfztGXVNxYKT
call System.Void RtbYkJaNhfYV.pGpWYNbCnfwSQM::aUmqQSwfjpSDOHicp()
ldsfld System.String IpRjFynUMfIc.zHImMtuJlGToj::yNzqfztGXVNxYKT
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_007A: ldsfld System.String IpRjFynUMfIc.zHImMtuJlGToj::ppgtXtzZuEWy
call System.Void NCdjvnTIaxlvsY.aejqELEnzbNugEE::YRPNTJICVHfrd()
ldsfld System.String IpRjFynUMfIc.zHImMtuJlGToj::ppgtXtzZuEWy
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_0098: call System.Void RtbYkJaNhfYV.CzeGkasZMpt::bYdzfNFaZN()
call System.Boolean RtbYkJaNhfYV.CzeGkasZMpt::xaDqXdFxyZRMW()
brfalse IL_0098: call System.Void RtbYkJaNhfYV.CzeGkasZMpt::bYdzfNFaZN()
call System.Void RtbYkJaNhfYV.GMppGXLfueb::cPApbJJrLwIVXvpi()
call System.Void RtbYkJaNhfYV.CzeGkasZMpt::bYdzfNFaZN()
ldnull <null>
ldftn System.Void RtbYkJaNhfYV.CzeGkasZMpt::XToHrzxmyUFJ()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
callvirt System.Void System.Threading.Thread::Start()
ldsfld System.String IpRjFynUMfIc.zHImMtuJlGToj::tDnrMsbvMJFLC
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_00D8: leave IL_00E3
ldnull <null>
ldftn System.Void RtbYkJaNhfYV.CywFIdvgQePzaOM::iczkalbkKjnzfa()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
callvirt System.Void System.Threading.Thread::Start()
leave IL_00E3: nop
pop <null>
leave IL_00E3: nop
nop <null>
call System.Boolean RQFdeFafTKI.EGVWDQvQrT::get_IsConnected()
brtrue IL_00F8: leave IL_0103
call System.Void RQFdeFafTKI.EGVWDQvQrT::YVtwMgxCSOZcaJi()
call System.Void RQFdeFafTKI.EGVWDQvQrT::UYfdINTTIzk()
leave IL_0103: ldc.i4 5000
pop <null>
leave IL_0103: ldc.i4 5000
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_00E3: nop
Module Name
CtGBSBEUHsq
Full Name
CtGBSBEUHsq
EntryPoint
System.Void IpRjFynUMfIc.LsGyIXidMgWL::Main()
Scope Name
CtGBSBEUHsq
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
AsyncClient
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
461
Main Method
System.Void IpRjFynUMfIc.LsGyIXidMgWL::Main()
Main IL Instruction Count
67
Main IL 
call System.Void RtbYkJaNhfYV.zgFSDSgdhb::VeGBosPeKaP()
call System.Void RtbYkJaNhfYV.zgFSDSgdhb::WWXrcZKhRP()
call System.Void RtbYkJaNhfYV.zgFSDSgdhb::fVEGQRGJvcVT()
ldc.i4.0 <null>
stloc.0 <null>
br IL_0024: ldloc.0
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
ldc.i4.1 <null>
add <null>
stloc.0 <null>
ldloc.0 <null>
ldsfld System.String IpRjFynUMfIc.zHImMtuJlGToj::arvdSeugMSpp
call System.Int32 System.Convert::ToInt32(System.String)
blt.s IL_0016: ldc.i4 1000
call System.Boolean IpRjFynUMfIc.zHImMtuJlGToj::DEHribPezzmJ()
brtrue IL_0041: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Boolean RtbYkJaNhfYV.LxjItcQAmVI::EYkMvVKbgyK()
brtrue IL_0052: ldsfld System.String IpRjFynUMfIc.zHImMtuJlGToj::uqbMXJIyhrfOh
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String IpRjFynUMfIc.zHImMtuJlGToj::uqbMXJIyhrfOh
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_0066: ldsfld System.String IpRjFynUMfIc.zHImMtuJlGToj::yNzqfztGXVNxYKT
call System.Void RtbYkJaNhfYV.pGpWYNbCnfwSQM::aUmqQSwfjpSDOHicp()
ldsfld System.String IpRjFynUMfIc.zHImMtuJlGToj::yNzqfztGXVNxYKT
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_007A: ldsfld System.String IpRjFynUMfIc.zHImMtuJlGToj::ppgtXtzZuEWy
call System.Void NCdjvnTIaxlvsY.aejqELEnzbNugEE::YRPNTJICVHfrd()
ldsfld System.String IpRjFynUMfIc.zHImMtuJlGToj::ppgtXtzZuEWy
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_0098: call System.Void RtbYkJaNhfYV.CzeGkasZMpt::bYdzfNFaZN()
call System.Boolean RtbYkJaNhfYV.CzeGkasZMpt::xaDqXdFxyZRMW()
brfalse IL_0098: call System.Void RtbYkJaNhfYV.CzeGkasZMpt::bYdzfNFaZN()
call System.Void RtbYkJaNhfYV.GMppGXLfueb::cPApbJJrLwIVXvpi()
call System.Void RtbYkJaNhfYV.CzeGkasZMpt::bYdzfNFaZN()
ldnull <null>
ldftn System.Void RtbYkJaNhfYV.CzeGkasZMpt::XToHrzxmyUFJ()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
callvirt System.Void System.Threading.Thread::Start()
ldsfld System.String IpRjFynUMfIc.zHImMtuJlGToj::tDnrMsbvMJFLC
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_00D8: leave IL_00E3
ldnull <null>
ldftn System.Void RtbYkJaNhfYV.CywFIdvgQePzaOM::iczkalbkKjnzfa()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
callvirt System.Void System.Threading.Thread::Start()
leave IL_00E3: nop
pop <null>
leave IL_00E3: nop
nop <null>
call System.Boolean RQFdeFafTKI.EGVWDQvQrT::get_IsConnected()
brtrue IL_00F8: leave IL_0103
call System.Void RQFdeFafTKI.EGVWDQvQrT::YVtwMgxCSOZcaJi()
call System.Void RQFdeFafTKI.EGVWDQvQrT::UYfdINTTIzk()
leave IL_0103: ldc.i4 5000
pop <null>
leave IL_0103: ldc.i4 5000
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_00E3: nop
Key (AES_256) MUTEXmalicious
UUl2RThuhuhuhuhuhuhuhuhuhuhu
Ports PORTmalicious
6huhuhuhu
Ports PORTmalicious
7huhuhuhu
Ports PORTmalicious
8huhuhuhu
Mutex MUTEXmalicious
Asynchuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙