Malicious PE Executable analysis – 6b3e00151ae2

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Medium

1 malicious · 8 files

EXE6b3e00151ae2439a1d1ff0eca55512cc

Structure

BINResources

BIN.Net Resources

Name	Value
Module Name	xeno rat client.exe
Full Name	xeno rat client.exe
EntryPoint	System.Void gR6srnzAFKXDp3ANgd.qM5JZZiAJqeu8bqgFc::<Main>(System.String[])
Scope Name	xeno rat client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	xeno rat client
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.8
Total Strings	44
Main Method	System.Void gR6srnzAFKXDp3ANgd.qM5JZZiAJqeu8bqgFc::<Main>(System.String[])
Main IL Instruction Count	32
Main IL	br.s IL_0007: ldc.i4 3 call <null> ldc.i4 3 stloc V_1 br IL_0015: ldloc V_1 ldloc V_1 switch dnlib.DotNet.Emit.Instruction[] br IL_006F: ldloca.s V_0 call System.Void kLr59mW9muyxrccNUsF.B0ltpTW3w0RFO3OTAkt::TIpUmrkUTv() ldc.i4 2 br IL_0019: switch(IL_006F,IL_006E,IL_0042,IL_0033) ldarg.0 <null> call System.Threading.Tasks.Task gR6srnzAFKXDp3ANgd.qM5JZZiAJqeu8bqgFc::x1h57XfPFS(System.Object) callvirt System.Runtime.CompilerServices.TaskAwaiter System.Threading.Tasks.Task::GetAwaiter() stloc.s V_0 ldc.i4 0 ldsfld <Module>{d004fa41-51b1-4bfe-ba21-59fb1f144543} <Module>{d004fa41-51b1-4bfe-ba21-59fb1f144543}::m_d2171dc2a3e94343b0e66df7f7465d34 ldfld System.Int32 <Module>{d004fa41-51b1-4bfe-ba21-59fb1f144543}::m_e91d5dd12fe641f681ba2058f1104196 brtrue IL_0019: switch(IL_006F,IL_006E,IL_0042,IL_0033) pop <null> ldc.i4 0 br IL_0019: switch(IL_006F,IL_006E,IL_0042,IL_0033) ret <null> ldloca.s V_0 call System.Void System.Runtime.CompilerServices.TaskAwaiter::GetResult() ldc.i4 1 ldsfld <Module>{d004fa41-51b1-4bfe-ba21-59fb1f144543} <Module>{d004fa41-51b1-4bfe-ba21-59fb1f144543}::m_d2171dc2a3e94343b0e66df7f7465d34 ldfld System.Int32 <Module>{d004fa41-51b1-4bfe-ba21-59fb1f144543}::m_2c3df0d93dcb4af48975c9d53b46ddf3 brtrue IL_0019: switch(IL_006F,IL_006E,IL_0042,IL_0033) pop <null> ldc.i4 1 br IL_0019: switch(IL_006F,IL_006E,IL_0042,IL_0033)
Module Name	xeno rat client.exe
Full Name	xeno rat client.exe
EntryPoint	System.Void gR6srnzAFKXDp3ANgd.qM5JZZiAJqeu8bqgFc::<Main>(System.String[])
Scope Name	xeno rat client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	xeno rat client
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.8
Total Strings	44
Main Method	System.Void gR6srnzAFKXDp3ANgd.qM5JZZiAJqeu8bqgFc::<Main>(System.String[])
Main IL Instruction Count	32
Main IL	br.s IL_0007: ldc.i4 3 call <null> ldc.i4 3 stloc V_1 br IL_0015: ldloc V_1 ldloc V_1 switch dnlib.DotNet.Emit.Instruction[] br IL_006F: ldloca.s V_0 call System.Void kLr59mW9muyxrccNUsF.B0ltpTW3w0RFO3OTAkt::TIpUmrkUTv() ldc.i4 2 br IL_0019: switch(IL_006F,IL_006E,IL_0042,IL_0033) ldarg.0 <null> call System.Threading.Tasks.Task gR6srnzAFKXDp3ANgd.qM5JZZiAJqeu8bqgFc::x1h57XfPFS(System.Object) callvirt System.Runtime.CompilerServices.TaskAwaiter System.Threading.Tasks.Task::GetAwaiter() stloc.s V_0 ldc.i4 0 ldsfld <Module>{d004fa41-51b1-4bfe-ba21-59fb1f144543} <Module>{d004fa41-51b1-4bfe-ba21-59fb1f144543}::m_d2171dc2a3e94343b0e66df7f7465d34 ldfld System.Int32 <Module>{d004fa41-51b1-4bfe-ba21-59fb1f144543}::m_e91d5dd12fe641f681ba2058f1104196 brtrue IL_0019: switch(IL_006F,IL_006E,IL_0042,IL_0033) pop <null> ldc.i4 0 br IL_0019: switch(IL_006F,IL_006E,IL_0042,IL_0033) ret <null> ldloca.s V_0 call System.Void System.Runtime.CompilerServices.TaskAwaiter::GetResult() ldc.i4 1 ldsfld <Module>{d004fa41-51b1-4bfe-ba21-59fb1f144543} <Module>{d004fa41-51b1-4bfe-ba21-59fb1f144543}::m_d2171dc2a3e94343b0e66df7f7465d34 ldfld System.Int32 <Module>{d004fa41-51b1-4bfe-ba21-59fb1f144543}::m_2c3df0d93dcb4af48975c9d53b46ddf3 brtrue IL_0019: switch(IL_006F,IL_006E,IL_0042,IL_0033) pop <null> ldc.i4 1 br IL_0019: switch(IL_006F,IL_006E,IL_0042,IL_0033)