Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very low
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
5ebcca94d3f5cc27af932f493a22053d
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_MANIFEST
ID:0001
ID:0
Config. Field Value
DisKey Fhuhuhuhu
PasteE Fhuhuhuhu
PASTEBIN
Sched Thuhuhuhu
SCHEDNAME Chrohuhuhuhu
BOT_TOKEN
CHAT_ID
ANYRUN Thuhuhuhu
CryptoClipperx Fhuhuhuhu
CryptoClipper_BTC
CryptoClipper_ETH
CryptoClipper_TRC
Bypass MoUsoChuhuhuhuhuhuhu
TaskMGR Fhuhuhuhu
Melty Fhuhuhuhu
KProc Fhuhuhuhu
Proc Wirehuhuhuhuhuhuhu
SLP 0huhuhuhu
packet_size [b] 5huhuhuhu
BD [BD] Fhuhuhuhu
directory [DR] Thuhuhuhu
SCREAM ohuhuhuhu
WINMIN ohuhuhuhu
executable_name [EXE] svchuhuhuhu
cnc_host [H] 104.2huhuhuhuhuhuhu
is_dir_defined [Idr] Thuhuhuhu
Anti_CH Fhuhuhuhu
is_startup_folder [IsF] Thuhuhuhu
USB_SP Fhuhuhuhu
is_user_reg [Isu] Fhuhuhuhu
cnc_port [P] 1huhuhuhu
reg_key [RG] svchuhuhuhu
reg_path [sf] Softwahuhuhuhuhuhuhuhuhuhuhu
victim_name [VN] Vihuhuhuhu
NTTA WhyYouhuhuhuhuhuhuhuhuhuhuhu
version [VR] Plhuhuhuhu
splitter [Y] |Ghuhuhuhu
BOT_KILL Fhuhuhuhu
HIDE_ME Thuhuhuhu
Persis Fhuhuhuhu
MSGE Dihuhuhuhu
MSGSYM vbChuhuhuhu
MSGT Systhuhuhuhu
MSGB The syhuhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Application.exe
Full Name
Application.exe
EntryPoint
System.Void j.A::main()
Scope Name
Application.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Application
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
624
Main Method
System.Void j.A::main()
Main IL Instruction Count
159
Main IL 
nop <null>
nop <null>
newobj System.Void j.A/_Closure$__1-0::.ctor()
stloc.0 <null>
ldloc.0 <null>
call System.String j.A::??????????()
callvirt System.String System.String::Trim()
stfld System.String j.A/_Closure$__1-0::$VB$Local_??????????
ldloc.0 <null>
ldfld System.String j.A/_Closure$__1-0::$VB$Local_??????????
call System.Boolean System.String::IsNullOrWhiteSpace(System.String)
brtrue IL_01AA: ldc.i4.1
ldloc.0 <null>
ldfld System.String j.A/_Closure$__1-0::$VB$Local_??????????
ldstr ^\d+$
call System.Boolean System.Text.RegularExpressions.Regex::IsMatch(System.String,System.String)
brtrue IL_01AA: ldc.i4.1
ldloc.0 <null>
ldfld System.String j.A/_Closure$__1-0::$VB$Local_??????????
ldstr ^\d+\s*$
call System.Boolean System.Text.RegularExpressions.Regex::IsMatch(System.String,System.String)
brtrue IL_01AA: ldc.i4.1
ldloc.0 <null>
ldfld System.String j.A/_Closure$__1-0::$VB$Local_??????????
ldstr ^(.)\1+$
call System.Boolean System.Text.RegularExpressions.Regex::IsMatch(System.String,System.String)
brtrue IL_01AA: ldc.i4.1
ldloc.0 <null>
ldfld System.String j.A/_Closure$__1-0::$VB$Local_??????????
ldc.i4.4 <null>
call System.Boolean j.A::??????????(System.String,System.Int32)
brtrue IL_01AA: ldc.i4.1
ldloc.0 <null>
ldfld System.String j.A/_Closure$__1-0::$VB$Local_??????????
ldstr 0123456789|abcdefghijklmnopqrstuvwxyz|ABCDEFGHIJKLMNOPQRSTUVWXYZ
call System.Boolean System.Text.RegularExpressions.Regex::IsMatch(System.String,System.String)
brtrue IL_01AA: ldc.i4.1
ldloc.0 <null>
ldfld System.String j.A/_Closure$__1-0::$VB$Local_??????????
ldstr ^(\d)([-\s]?\1)+$
call System.Boolean System.Text.RegularExpressions.Regex::IsMatch(System.String,System.String)
brtrue IL_01AA: ldc.i4.1
ldloc.0 <null>
ldfld System.String j.A/_Closure$__1-0::$VB$Local_??????????
ldstr [^A-Za-z0-9\s-]
call System.Boolean System.Text.RegularExpressions.Regex::IsMatch(System.String,System.String)
brtrue IL_01AA: ldc.i4.1
ldloc.0 <null>
ldfld System.String j.A/_Closure$__1-0::$VB$Local_??????????
ldsfld System.Func`2<System.Char,System.Boolean> j.A/_Closure$__::$I1-0
brfalse.s IL_00CB: ldsfld j.A/_Closure$__ j.A/_Closure$__::$I
ldsfld System.Func`2<System.Char,System.Boolean> j.A/_Closure$__::$I1-0
br.s IL_00E1: call System.Int32 System.Linq.Enumerable::Count<System.Char>(System.Collections.Generic.IEnumerable`1<System.Char>,System.Func`2<System.Char,System.Boolean>)
ldsfld j.A/_Closure$__ j.A/_Closure$__::$I
ldftn System.Boolean j.A/_Closure$__::_Lambda$__1-0(System.Char)
newobj System.Void System.Func`2<System.Char,System.Boolean>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Char,System.Boolean> j.A/_Closure$__::$I1-0
call System.Int32 System.Linq.Enumerable::Count<System.Char>(System.Collections.Generic.IEnumerable`1<System.Char>,System.Func`2<System.Char,System.Boolean>)
ldc.i4.5 <null>
bgt IL_01AA: ldc.i4.1
ldloc.0 <null>
ldfld System.String j.A/_Closure$__1-0::$VB$Local_??????????
ldstr (.)\1{4,}
call System.Boolean System.Text.RegularExpressions.Regex::IsMatch(System.String,System.String)
brtrue IL_01AA: ldc.i4.1
ldloc.0 <null>
ldfld System.String j.A/_Closure$__1-0::$VB$Local_??????????
ldstr ^[A-Z0-9]{8,12}$
call System.Boolean System.Text.RegularExpressions.Regex::IsMatch(System.String,System.String)
brtrue IL_01AA: ldc.i4.1
ldloc.0 <null>
ldfld System.String j.A/_Closure$__1-0::$VB$Local_??????????
callvirt System.Int32 System.String::get_Length()
ldc.i4.5 <null>
blt IL_01AA: ldc.i4.1
ldloc.0 <null>
ldfld System.String j.A/_Closure$__1-0::$VB$Local_??????????
callvirt System.Int32 System.String::get_Length()
ldc.i4.s 50
bgt.s IL_01AA: ldc.i4.1
ldc.i4.s 11
newarr System.String
dup <null>
ldc.i4.0 <null>
ldstr VGNZPL985D
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
ldstr Virtual Machine
stelem.ref <null>
dup <null>
ldc.i4.2 <null>
ldstr VM
stelem.ref <null>
dup <null>
ldc.i4.3 <null>
ldstr Virtual
stelem.ref <null>
dup <null>
ldc.i4.4 <null>
ldstr Test
stelem.ref <null>
dup <null>
ldc.i4.5 <null>
ldstr Hyper
stelem.ref <null>
dup <null>
ldc.i4.6 <null>
ldstr Sandbox
stelem.ref <null>
dup <null>
ldc.i4.7 <null>
ldstr Temp
stelem.ref <null>
dup <null>
ldc.i4.8 <null>
ldstr Debug
stelem.ref <null>
dup <null>
ldc.i4.s 9
ldstr Default
stelem.ref <null>
dup <null>
ldc.i4.s 10
ldstr Trial
stelem.ref <null>
ldloc.0 <null>
ldftn System.Boolean j.A/_Closure$__1-0::_Lambda$__1(System.String)
newobj System.Void System.Func`2<System.String,System.Boolean>::.ctor(System.Object,System.IntPtr)
call System.Boolean System.Linq.Enumerable::Any<System.String>(System.Collections.Generic.IEnumerable`1<System.String>,System.Func`2<System.String,System.Boolean>)
br.s IL_01AB: stloc.1
ldc.i4.1 <null>
stloc.1 <null>
ldloc.1 <null>
brfalse.s IL_01BD: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::EndApp()
nop <null>
nop <null>
nop <null>
leave.s IL_01DC: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.2 <null>
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::EndApp()
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_01DC: nop
nop <null>
call System.Void j.OK::ko()
nop <null>
ret <null>
Module Name
Application.exe
Full Name
Application.exe
EntryPoint
System.Void j.A::main()
Scope Name
Application.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Application
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
624
Main Method
System.Void j.A::main()
Main IL Instruction Count
159
Main IL 
nop <null>
nop <null>
newobj System.Void j.A/_Closure$__1-0::.ctor()
stloc.0 <null>
ldloc.0 <null>
call System.String j.A::??????????()
callvirt System.String System.String::Trim()
stfld System.String j.A/_Closure$__1-0::$VB$Local_??????????
ldloc.0 <null>
ldfld System.String j.A/_Closure$__1-0::$VB$Local_??????????
call System.Boolean System.String::IsNullOrWhiteSpace(System.String)
brtrue IL_01AA: ldc.i4.1
ldloc.0 <null>
ldfld System.String j.A/_Closure$__1-0::$VB$Local_??????????
ldstr ^\d+$
call System.Boolean System.Text.RegularExpressions.Regex::IsMatch(System.String,System.String)
brtrue IL_01AA: ldc.i4.1
ldloc.0 <null>
ldfld System.String j.A/_Closure$__1-0::$VB$Local_??????????
ldstr ^\d+\s*$
call System.Boolean System.Text.RegularExpressions.Regex::IsMatch(System.String,System.String)
brtrue IL_01AA: ldc.i4.1
ldloc.0 <null>
ldfld System.String j.A/_Closure$__1-0::$VB$Local_??????????
ldstr ^(.)\1+$
call System.Boolean System.Text.RegularExpressions.Regex::IsMatch(System.String,System.String)
brtrue IL_01AA: ldc.i4.1
ldloc.0 <null>
ldfld System.String j.A/_Closure$__1-0::$VB$Local_??????????
ldc.i4.4 <null>
call System.Boolean j.A::??????????(System.String,System.Int32)
brtrue IL_01AA: ldc.i4.1
ldloc.0 <null>
ldfld System.String j.A/_Closure$__1-0::$VB$Local_??????????
ldstr 0123456789|abcdefghijklmnopqrstuvwxyz|ABCDEFGHIJKLMNOPQRSTUVWXYZ
call System.Boolean System.Text.RegularExpressions.Regex::IsMatch(System.String,System.String)
brtrue IL_01AA: ldc.i4.1
ldloc.0 <null>
ldfld System.String j.A/_Closure$__1-0::$VB$Local_??????????
ldstr ^(\d)([-\s]?\1)+$
call System.Boolean System.Text.RegularExpressions.Regex::IsMatch(System.String,System.String)
brtrue IL_01AA: ldc.i4.1
ldloc.0 <null>
ldfld System.String j.A/_Closure$__1-0::$VB$Local_??????????
ldstr [^A-Za-z0-9\s-]
call System.Boolean System.Text.RegularExpressions.Regex::IsMatch(System.String,System.String)
brtrue IL_01AA: ldc.i4.1
ldloc.0 <null>
ldfld System.String j.A/_Closure$__1-0::$VB$Local_??????????
ldsfld System.Func`2<System.Char,System.Boolean> j.A/_Closure$__::$I1-0
brfalse.s IL_00CB: ldsfld j.A/_Closure$__ j.A/_Closure$__::$I
ldsfld System.Func`2<System.Char,System.Boolean> j.A/_Closure$__::$I1-0
br.s IL_00E1: call System.Int32 System.Linq.Enumerable::Count<System.Char>(System.Collections.Generic.IEnumerable`1<System.Char>,System.Func`2<System.Char,System.Boolean>)
ldsfld j.A/_Closure$__ j.A/_Closure$__::$I
ldftn System.Boolean j.A/_Closure$__::_Lambda$__1-0(System.Char)
newobj System.Void System.Func`2<System.Char,System.Boolean>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Char,System.Boolean> j.A/_Closure$__::$I1-0
call System.Int32 System.Linq.Enumerable::Count<System.Char>(System.Collections.Generic.IEnumerable`1<System.Char>,System.Func`2<System.Char,System.Boolean>)
ldc.i4.5 <null>
bgt IL_01AA: ldc.i4.1
ldloc.0 <null>
ldfld System.String j.A/_Closure$__1-0::$VB$Local_??????????
ldstr (.)\1{4,}
call System.Boolean System.Text.RegularExpressions.Regex::IsMatch(System.String,System.String)
brtrue IL_01AA: ldc.i4.1
ldloc.0 <null>
ldfld System.String j.A/_Closure$__1-0::$VB$Local_??????????
ldstr ^[A-Z0-9]{8,12}$
call System.Boolean System.Text.RegularExpressions.Regex::IsMatch(System.String,System.String)
brtrue IL_01AA: ldc.i4.1
ldloc.0 <null>
ldfld System.String j.A/_Closure$__1-0::$VB$Local_??????????
callvirt System.Int32 System.String::get_Length()
ldc.i4.5 <null>
blt IL_01AA: ldc.i4.1
ldloc.0 <null>
ldfld System.String j.A/_Closure$__1-0::$VB$Local_??????????
callvirt System.Int32 System.String::get_Length()
ldc.i4.s 50
bgt.s IL_01AA: ldc.i4.1
ldc.i4.s 11
newarr System.String
dup <null>
ldc.i4.0 <null>
ldstr VGNZPL985D
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
ldstr Virtual Machine
stelem.ref <null>
dup <null>
ldc.i4.2 <null>
ldstr VM
stelem.ref <null>
dup <null>
ldc.i4.3 <null>
ldstr Virtual
stelem.ref <null>
dup <null>
ldc.i4.4 <null>
ldstr Test
stelem.ref <null>
dup <null>
ldc.i4.5 <null>
ldstr Hyper
stelem.ref <null>
dup <null>
ldc.i4.6 <null>
ldstr Sandbox
stelem.ref <null>
dup <null>
ldc.i4.7 <null>
ldstr Temp
stelem.ref <null>
dup <null>
ldc.i4.8 <null>
ldstr Debug
stelem.ref <null>
dup <null>
ldc.i4.s 9
ldstr Default
stelem.ref <null>
dup <null>
ldc.i4.s 10
ldstr Trial
stelem.ref <null>
ldloc.0 <null>
ldftn System.Boolean j.A/_Closure$__1-0::_Lambda$__1(System.String)
newobj System.Void System.Func`2<System.String,System.Boolean>::.ctor(System.Object,System.IntPtr)
call System.Boolean System.Linq.Enumerable::Any<System.String>(System.Collections.Generic.IEnumerable`1<System.String>,System.Func`2<System.String,System.Boolean>)
br.s IL_01AB: stloc.1
ldc.i4.1 <null>
stloc.1 <null>
ldloc.1 <null>
brfalse.s IL_01BD: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::EndApp()
nop <null>
nop <null>
nop <null>
leave.s IL_01DC: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.2 <null>
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::EndApp()
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_01DC: nop
nop <null>
call System.Void j.OK::ko()
nop <null>
ret <null>
CnC CNCmalicious
104.2huhuhuhuhuhuhu
Port PORTmalicious
1huhuhuhu
Embedded Resources UNKNWOWN
0huhuhuhu
Suspicious Type Names (1-2 chars) UNKNWOWNsuspect
3huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙