Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium
1 malicious · 9 files
EXE624a47d18769f1024bfa2bff040c41aaAsyncRAT
Structure
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key D2973Fhuhuhuhuhuhuhuhuhuhuhu
Version 1huhuhuhu
Port 4huhuhuhu
Host phuhuhuhu
ReconnectDelay 3huhuhuhu
Key Suhuhuhuhu
SubDirectory Clihuhuhuhu
InstallName 0huhuhuhu
Install 0huhuhuhu
Startup 820059huhuhuhuhuhuhuhuhuhuhu
Mutex Quasahuhuhuhuhuhuhu
StartupKey 0huhuhuhu
HideFile 0huhuhuhu
EnableLogger Ofhuhuhuhu
EncryptionKey Lhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Key (AES_256) -huhuhuhu
Pastebin -huhuhuhu
ServerSignature kklmx3huhuhuhuhuhuhuhuhuhuhu
Install File Sbihuhuhuhu
Mutex cmdvhuhuhuhu
Group cmdvhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client
Full Name
Client
EntryPoint
System.Void bnqzbdmegkwnlgtplmod.䢢뼹柾璭ᨐ₼坌晰鬡妡溒㧗螋뀅뉷⅕䃀::Main(System.String[])
Scope Name
Client
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.7.1.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
1957
Main Method
System.Void bnqzbdmegkwnlgtplmod.䢢뼹柾璭ᨐ₼坌晰鬡妡溒㧗螋뀅뉷⅕䃀::Main(System.String[])
Main IL Instruction Count
20
Main IL 
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
ldnull <null>
ldftn System.Void bnqzbdmegkwnlgtplmod.䢢뼹柾璭ᨐ₼坌晰鬡妡溒㧗螋뀅뉷⅕䃀::툔负凊⓵嘲땮귆쌴䅎۫탯푰좒౪Ӣ臽(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void bnqzbdmegkwnlgtplmod.䢢뼹柾璭ᨐ₼坌晰鬡妡溒㧗螋뀅뉷⅕䃀::ꋞ讪릿십次ﻂ끐薃嶱爥䷿䡇哭ᔓ⅖딜(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.Void bnqzbdmegkwnlgtplmod.䢢뼹柾璭ᨐ₼坌晰鬡妡溒㧗螋뀅뉷⅕䃀::狅펈⠉绐䄿롽踊챟ᛕ�꘷ꌻ�ꔉ倊䇄颷()
newobj System.Void bnqzbdmegkwnlgtplmod.烐쮍졜יִ쑐ꄇ夲䴟粫꣡᥶꽜㌿�넚ড僯꙯::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
Module Name
Client
Full Name
Client
EntryPoint
System.Void bnqzbdmegkwnlgtplmod.䢢뼹柾璭ᨐ₼坌晰鬡妡溒㧗螋뀅뉷⅕䃀::Main(System.String[])
Scope Name
Client
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.7.1.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
1957
Main Method
System.Void bnqzbdmegkwnlgtplmod.䢢뼹柾璭ᨐ₼坌晰鬡妡溒㧗螋뀅뉷⅕䃀::Main(System.String[])
Main IL Instruction Count
20
Main IL 
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
ldnull <null>
ldftn System.Void bnqzbdmegkwnlgtplmod.䢢뼹柾璭ᨐ₼坌晰鬡妡溒㧗螋뀅뉷⅕䃀::툔负凊⓵嘲땮귆쌴䅎۫탯푰좒౪Ӣ臽(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void bnqzbdmegkwnlgtplmod.䢢뼹柾璭ᨐ₼坌晰鬡妡溒㧗螋뀅뉷⅕䃀::ꋞ讪릿십次ﻂ끐薃嶱爥䷿䡇哭ᔓ⅖딜(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.Void bnqzbdmegkwnlgtplmod.䢢뼹柾璭ᨐ₼坌晰鬡妡溒㧗螋뀅뉷⅕䃀::狅펈⠉绐䄿롽踊챟ᛕ�꘷ꌻ�ꔉ倊䇄颷()
newobj System.Void bnqzbdmegkwnlgtplmod.烐쮍졜יִ쑐ꄇ夲䴟粫꣡᥶꽜㌿�넚ড僯꙯::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
CnC CNCmalicious
phuhuhuhu
Port PORTmalicious
4huhuhuhu
Key (AES_256) MUTEXmalicious
-huhuhuhu
Mutex MUTEXmalicious
cmdvhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙