Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium
1 malicious · 9 files
EXE6a7f89acd7d179701d6f56252a982c55AsyncRAT
Structure
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key D2973Fhuhuhuhuhuhuhuhuhuhuhu
Version 1huhuhuhu
Port 8huhuhuhu
Host 158.huhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
Key Suhuhuhuhu
SubDirectory Clihuhuhuhu
InstallName 0huhuhuhu
Install 0huhuhuhu
Startup d64809huhuhuhuhuhuhuhuhuhuhu
Mutex Quasahuhuhuhuhuhuhu
StartupKey 0huhuhuhu
HideFile 0huhuhuhu
EnableLogger Ofhuhuhuhu
EncryptionKey Lhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Key (AES_256) -huhuhuhu
Pastebin -huhuhuhu
ServerSignature tphKP1huhuhuhuhuhuhuhuhuhuhu
Install File Sbihuhuhuhu
Install-Folder /BOXsbhuhuhuhuhuhuhuhuhuhuhu
Mutex cmdvhuhuhuhu
Group cmdvhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client
Full Name
Client
EntryPoint
System.Void zevmspscbwkohwnhoinj.ྭኞա剫ണ챼籜嚀㠅멕찥延朑啖枧룙蓪::Main(System.String[])
Scope Name
Client
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.7.1.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
1957
Main Method
System.Void zevmspscbwkohwnhoinj.ྭኞա剫ണ챼籜嚀㠅멕찥延朑啖枧룙蓪::Main(System.String[])
Main IL Instruction Count
20
Main IL 
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
ldnull <null>
ldftn System.Void zevmspscbwkohwnhoinj.ྭኞա剫ണ챼籜嚀㠅멕찥延朑啖枧룙蓪::᭖쨙撜㺱黙羺ꥉ藷⪇汫譧뽎긱콿䆇尽御᫽ק(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void zevmspscbwkohwnhoinj.ྭኞա剫ണ챼籜嚀㠅멕찥延朑啖枧룙蓪::ઇᕶ�列ﵒ誛鬱ၨ䎹꤈漆ꀟ낼廎◸䐿䜘녤䄡(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.Void zevmspscbwkohwnhoinj.ྭኞա剫ണ챼籜嚀㠅멕찥延朑啖枧룙蓪::䗩ᒋ슃뿇ݱ髁콌♧᠂饔ࣘ炱ﳌ鏏カ()
newobj System.Void zevmspscbwkohwnhoinj.ၷ들᳀⼴姢ᛚ䛣畛訏愬㬻ꘃ㚖ꌓ�㍵툹拹::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
Module Name
Client
Full Name
Client
EntryPoint
System.Void zevmspscbwkohwnhoinj.ྭኞա剫ണ챼籜嚀㠅멕찥延朑啖枧룙蓪::Main(System.String[])
Scope Name
Client
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.7.1.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
1957
Main Method
System.Void zevmspscbwkohwnhoinj.ྭኞա剫ണ챼籜嚀㠅멕찥延朑啖枧룙蓪::Main(System.String[])
Main IL Instruction Count
20
Main IL 
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
ldnull <null>
ldftn System.Void zevmspscbwkohwnhoinj.ྭኞա剫ണ챼籜嚀㠅멕찥延朑啖枧룙蓪::᭖쨙撜㺱黙羺ꥉ藷⪇汫譧뽎긱콿䆇尽御᫽ק(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void zevmspscbwkohwnhoinj.ྭኞա剫ണ챼籜嚀㠅멕찥延朑啖枧룙蓪::ઇᕶ�列ﵒ誛鬱ၨ䎹꤈漆ꀟ낼廎◸䐿䜘녤䄡(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.Void zevmspscbwkohwnhoinj.ྭኞա剫ണ챼籜嚀㠅멕찥延朑啖枧룙蓪::䗩ᒋ슃뿇ݱ髁콌♧᠂饔ࣘ炱ﳌ鏏カ()
newobj System.Void zevmspscbwkohwnhoinj.ၷ들᳀⼴姢ᛚ䛣畛訏愬㬻ꘃ㚖ꌓ�㍵툹拹::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
CnC CNCmalicious
158.huhuhuhuhuhuhu
Port PORTmalicious
8huhuhuhu
Key (AES_256) MUTEXmalicious
-huhuhuhu
Mutex MUTEXmalicious
cmdvhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙