Malicious
Malicious

5f367a3bb57745d7b9973cb96084c575

PE Executable
|
MD5: 5f367a3bb57745d7b9973cb96084c575
|
Size: 404.99 KB
|
application/x-dosexec

Infection Chain
Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Low

Hash
 Hash Value
MD5
5f367a3bb57745d7b9973cb96084c575
Sha1
75b88d2c7bc320f781c4d8d41a930b54a4df3650
Sha256
93bf2ff2df8cc3647b056d883a94e6fefa8666ac0d853b62e229781eee31b313
Sha384
b1683eb155d1dc95a93c1b6ce27352f998f8ba0bc06502be13573ed6a1f3fe5bf8a5f18014b9091a1f78842df1ae4156
Sha512
ea79450f51f8805ea44bf8e9906e49a84c82750ebd4e5fd5efad7fe277704487753e49a47a7759f26fbcb5f32945efaced72c932ee7bfbb7d30e7b29f923beb6
SSDeep
768:vgZA/699tIN1wFs9jYOjhbbKnnnnnnnnnnnnnnnnnnnnnnnQInU2/gohN/yRUZZr:vg46fumFs9jYOjtPkccckcccccG
TLSH
3384610CB63AEC87E45E9F723E92E375847E2C038E619986B644FFFE5A3550193C8911

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
5f367a3bb57745d7b9973cb96084c575
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
ID:0006
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Malware Configuration - XWorm config.
Config. Field
 Value
Mutex

SnlZPO1Hp4LHBLsT
Hosts

5.136.108.102
Port

3389
KEY

<Xwormmm>
USBNM

132
family

xworm
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

презентация хуй.exe
Full Name

презентация хуй.exe
EntryPoint

System.Void Stub.Main::Main()
Scope Name

презентация хуй.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

презентация хуй
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

<null>
Total Strings

170
Main Method

System.Void Stub.Main::Main()
Main IL Instruction Count

67
Main IL

ldsfld System.Int32 Settings::Sleep ldc.i4 1000 mul.ovf <null> call System.Void System.Threading.Thread::Sleep(System.Int32) ldsfld System.String Settings::Hosts call System.Object Stub.AlgorithmAES::Decrypt(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String Settings::Hosts ldsfld System.String Settings::Port call System.Object Stub.AlgorithmAES::Decrypt(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String Settings::Port ldsfld System.String Settings::KEY call System.Object Stub.AlgorithmAES::Decrypt(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String Settings::KEY ldsfld System.String Settings::SPL call System.Object Stub.AlgorithmAES::Decrypt(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String Settings::SPL ldsfld System.String Settings::Groub call System.Object Stub.AlgorithmAES::Decrypt(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String Settings::Groub ldsfld System.String Settings::USBNM call System.Object Stub.AlgorithmAES::Decrypt(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String Settings::USBNM ldsfld System.String Settings::Token call System.Object Stub.AlgorithmAES::Decrypt(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String Settings::Token ldsfld System.String Settings::ChatID call System.Object Stub.AlgorithmAES::Decrypt(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String Settings::ChatID leave.s IL_00C6: call System.Boolean Stub.Helper::CreateMutex() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.2 <null> ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_00C6: call System.Boolean Stub.Helper::CreateMutex() call System.Boolean Stub.Helper::CreateMutex() brtrue.s IL_00D3: call System.Void Stub.Helper::PreventSleep() ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Stub.Helper::PreventSleep() call System.Void Stub.Main::SendBot() ldnull <null> ldftn System.Void Stub.Main::_Lambda$__1() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.0 <null> ldnull <null> ldftn System.Void Stub.Main::_Lambda$__2() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.1 <null> ldloc.0 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.1 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.1 <null> callvirt System.Void System.Threading.Thread::Join() ret <null>
Module Name

презентация хуй.exe
Full Name

презентация хуй.exe
EntryPoint

System.Void Stub.Main::Main()
Scope Name

презентация хуй.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

презентация хуй
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

<null>
Total Strings

170
Main Method

System.Void Stub.Main::Main()
Main IL Instruction Count

67
Main IL

ldsfld System.Int32 Settings::Sleep ldc.i4 1000 mul.ovf <null> call System.Void System.Threading.Thread::Sleep(System.Int32) ldsfld System.String Settings::Hosts call System.Object Stub.AlgorithmAES::Decrypt(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String Settings::Hosts ldsfld System.String Settings::Port call System.Object Stub.AlgorithmAES::Decrypt(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String Settings::Port ldsfld System.String Settings::KEY call System.Object Stub.AlgorithmAES::Decrypt(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String Settings::KEY ldsfld System.String Settings::SPL call System.Object Stub.AlgorithmAES::Decrypt(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String Settings::SPL ldsfld System.String Settings::Groub call System.Object Stub.AlgorithmAES::Decrypt(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String Settings::Groub ldsfld System.String Settings::USBNM call System.Object Stub.AlgorithmAES::Decrypt(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String Settings::USBNM ldsfld System.String Settings::Token call System.Object Stub.AlgorithmAES::Decrypt(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String Settings::Token ldsfld System.String Settings::ChatID call System.Object Stub.AlgorithmAES::Decrypt(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String Settings::ChatID leave.s IL_00C6: call System.Boolean Stub.Helper::CreateMutex() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.2 <null> ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_00C6: call System.Boolean Stub.Helper::CreateMutex() call System.Boolean Stub.Helper::CreateMutex() brtrue.s IL_00D3: call System.Void Stub.Helper::PreventSleep() ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Stub.Helper::PreventSleep() call System.Void Stub.Main::SendBot() ldnull <null> ldftn System.Void Stub.Main::_Lambda$__1() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.0 <null> ldnull <null> ldftn System.Void Stub.Main::_Lambda$__2() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.1 <null> ldloc.0 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.1 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.1 <null> callvirt System.Void System.Threading.Thread::Join() ret <null>
Artefacts
Name
 Value
Mutex

SnlZPO1Hp4LHBLsT
CnC

5.136.108.102
Port

3389
5f367a3bb57745d7b9973cb96084c575 (404.99 KB)
File Structure
5f367a3bb57745d7b9973cb96084c575
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
ID:0006
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Characteristics
Malware Configuration - XWorm config.
Config. Field
 Value
Mutex

SnlZPO1Hp4LHBLsT
Hosts

5.136.108.102
Port

3389
KEY

<Xwormmm>
USBNM

132
family

xworm
Artefacts
Name
 Value Location
Mutex

SnlZPO1Hp4LHBLsT

Malicious

5f367a3bb57745d7b9973cb96084c575
CnC

5.136.108.102

Malicious

5f367a3bb57745d7b9973cb96084c575
Port

3389

Malicious

5f367a3bb57745d7b9973cb96084c575
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙