Suspicious
Suspect

77bf486f282066d7a1eb49a2f05953cf

PE Executable
MD5: 77bf486f282066d7a1eb49a2f05953cf
Size: 2.62 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 77bf486f282066d7a1eb49a2f05953cf
Sha1 b60d3fe1de26fb1315d57a138d178c46cfcc715b
Sha256 fdd9b8a561ea13bcc3bb76a198a9eacdc3353f9d15fad6fd842addf4209f2c7f
Sha384 80143bf6393c47e075d73ccbeb2c68e7e90e3413438bec64f8dfc891138fc69ac38ac6b5df6f0ba95f1e9f505ffd7e8b
Sha512 51871217f01944e043ab5c162270163b6b2f9bb7737f20dd235d4e13a207c891e83d84e90fa8ac26e9ef163dd28e3e721d7a7a59fbd1e491d088366080a5b1c3
SSDeep 49152:IrOH6eRgBJbTpc8iYM57G+vSVMZ5i6BEC8ysTVeuK+hl:5H6eR69TFMYqZwhC2Y+
TLSH B4C51201EAE49D78C8AA1877FD1D9610F133AD7426A1C5EF2BDCAE4B9051CC04AD6F93
PeID
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ 7.0 - 8.0Microsoft Visual C++ v6.0 DLL
77bf486f282066d7a1eb49a2f05953cf
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
lgfcmCznklAA.LjdI7U6d.gus
lgfcmCznklAA.KhyZrJvb.mix
Overlay_bc35e469.bin
eQQ8CSK.bat
hater
7z.exe
7z-stream @ 0x000C6D78.7z
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.sxdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
cecho.exe
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
UPX0
UPX1
.rsrc
Resources
RT_MANIFEST
ID:0001
ID:1033
land.zip
nircmd.exe
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
Resources
RT_CURSOR
ID:0001
ID:1033
RT_DIALOG
ID:0066
ID:1037
ID:0070
ID:1037
RT_GROUP_CURSOR2
ID:0067
ID:1033
RT_VERSION
ID:0001
ID:1037
RT_MANIFEST
ID:0001
ID:1033
NSudoLG.exe
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
STRING
ID:07D1
ID:4
ID:7
ID:9
ID:10
ID:12
ID:1028
ID:1040
ID:07D2
ID:4
ID:7
ID:9
ID:10
ID:12
ID:1028
ID:1040
ID:07D3
ID:4
ID:7
ID:9
ID:10
ID:12
ID:1028
ID:1040
RT_ICON
ID:0001
ID:0
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
ID:0006
ID:0
ID:0007
ID:0
ID:0008
ID:0
ID:0-preview.png
RT_DIALOG
ID:0069
ID:0
ID:0084
ID:0
RT_GROUP_CURSOR4
ID:07D0
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.didat
.rsrc
.reloc
Resources
PNG
ID:0065
ID:1033
ID:1033-preview.png
ID:0066
ID:1033
ID:1033-preview.png
RT_ICON
ID:0001
ID:1033
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:0005
ID:1033
ID:0006
ID:1033
ID:0007
ID:1033
ID:1033-preview.png
RT_DIALOG
ID:0000
ID:1033
RT_STRING
ID:0007
ID:1033
ID:0008
ID:1033
ID:0009
ID:1033
ID:000A
ID:1033
ID:000B
ID:1033
ID:000C
ID:1033
ID:000D
ID:1033
ID:000E
ID:1033
ID:000F
ID:1033
ID:0010
ID:1033
RT_GROUP_CURSOR4
ID:0064
ID:1033
RT_MANIFEST
ID:0001
ID:1033
Name Value
Info
PE Detect: PeReader OK (file layout)
Info 
PDB Path: C:\10\boot\Downloader_win\DownloaderApp\DownloaderApp\obj\Release\DownloaderApp.pdb
Module Name
DownloaderApp.exe
Full Name
DownloaderApp.exe
EntryPoint
System.Void DownloaderApp.Program::Main(System.String[])
Scope Name
DownloaderApp.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
DownloaderApp
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
44
Main Method
System.Void DownloaderApp.Program::Main(System.String[])
Main IL Instruction Count
95
Main IL 
call System.Boolean DownloaderApp.Program::IsAdmin()
brtrue.s IL_0015: call System.Boolean System.Environment::get_UserInteractive()
call System.Void DownloaderApp.Program::RelaunchAsAdmin()
leave.s IL_0014: ret
pop <null>
leave IL_0121: ret
ret <null>
call System.Boolean System.Environment::get_UserInteractive()
brtrue.s IL_0027: ldstr "winloghelper.exe"
newobj System.Void DownloaderApp.ServiceHost::.ctor()
call System.Void System.ServiceProcess.ServiceBase::Run(System.ServiceProcess.ServiceBase)
ret <null>
ldstr winloghelper.exe
stloc.0 <null>
ldstr systemhelper.exe
stloc.1 <null>
ldstr WindowsLogsHelper
stloc.2 <null>
ldc.i4.s 36
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
dup <null>
ldloc.0 <null>
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.3 <null>
ldloc.1 <null>
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.s V_4
ldstr lgfcmCznklAA.LjdI7U6d.gus
ldloc.3 <null>
call System.Void DownloaderApp.Program::ExtractEmbeddedExe(System.String,System.String)
ldstr lgfcmCznklAA.KhyZrJvb.mix
ldloc.s V_4
call System.Void DownloaderApp.Program::ExtractEmbeddedExe(System.String,System.String)
ldloc.3 <null>
ldc.i4.6 <null>
call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes)
ldloc.s V_4
ldc.i4.6 <null>
call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes)
ldloc.3 <null>
call System.Void DownloaderApp.Program::SetNtfsProtection(System.String)
ldloc.s V_4
call System.Void DownloaderApp.Program::SetNtfsProtection(System.String)
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
callvirt System.String System.Reflection.Assembly::get_Location()
call System.Void DownloaderApp.Program::TryInstallService(System.String)
ldloc.3 <null>
ldloc.2 <null>
call System.Void DownloaderApp.Program::CreateScheduledTask(System.String,System.String)
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
dup <null>
ldstr cmd.exe
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
dup <null>
ldstr /c start "" "
ldloc.3 <null>
ldstr "
call System.String System.String::Concat(System.String,System.String,System.String)
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String)
dup <null>
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
dup <null>
ldstr cmd.exe
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
dup <null>
ldstr /c start "" "
ldloc.s V_4
ldstr "
call System.String System.String::Concat(System.String,System.String,System.String)
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String)
dup <null>
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
leave.s IL_0121: ret
pop <null>
leave.s IL_0121: ret
ret <null>
Module Name
DownloaderApp.exe
Full Name
DownloaderApp.exe
EntryPoint
System.Void DownloaderApp.Program::Main(System.String[])
Scope Name
DownloaderApp.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
DownloaderApp
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
44
Main Method
System.Void DownloaderApp.Program::Main(System.String[])
Main IL Instruction Count
95
Main IL 
call System.Boolean DownloaderApp.Program::IsAdmin()
brtrue.s IL_0015: call System.Boolean System.Environment::get_UserInteractive()
call System.Void DownloaderApp.Program::RelaunchAsAdmin()
leave.s IL_0014: ret
pop <null>
leave IL_0121: ret
ret <null>
call System.Boolean System.Environment::get_UserInteractive()
brtrue.s IL_0027: ldstr "winloghelper.exe"
newobj System.Void DownloaderApp.ServiceHost::.ctor()
call System.Void System.ServiceProcess.ServiceBase::Run(System.ServiceProcess.ServiceBase)
ret <null>
ldstr winloghelper.exe
stloc.0 <null>
ldstr systemhelper.exe
stloc.1 <null>
ldstr WindowsLogsHelper
stloc.2 <null>
ldc.i4.s 36
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
dup <null>
ldloc.0 <null>
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.3 <null>
ldloc.1 <null>
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.s V_4
ldstr lgfcmCznklAA.LjdI7U6d.gus
ldloc.3 <null>
call System.Void DownloaderApp.Program::ExtractEmbeddedExe(System.String,System.String)
ldstr lgfcmCznklAA.KhyZrJvb.mix
ldloc.s V_4
call System.Void DownloaderApp.Program::ExtractEmbeddedExe(System.String,System.String)
ldloc.3 <null>
ldc.i4.6 <null>
call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes)
ldloc.s V_4
ldc.i4.6 <null>
call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes)
ldloc.3 <null>
call System.Void DownloaderApp.Program::SetNtfsProtection(System.String)
ldloc.s V_4
call System.Void DownloaderApp.Program::SetNtfsProtection(System.String)
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
callvirt System.String System.Reflection.Assembly::get_Location()
call System.Void DownloaderApp.Program::TryInstallService(System.String)
ldloc.3 <null>
ldloc.2 <null>
call System.Void DownloaderApp.Program::CreateScheduledTask(System.String,System.String)
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
dup <null>
ldstr cmd.exe
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
dup <null>
ldstr /c start "" "
ldloc.3 <null>
ldstr "
call System.String System.String::Concat(System.String,System.String,System.String)
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String)
dup <null>
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
dup <null>
ldstr cmd.exe
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
dup <null>
ldstr /c start "" "
ldloc.s V_4
ldstr "
call System.String System.String::Concat(System.String,System.String,System.String)
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String)
dup <null>
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
leave.s IL_0121: ret
pop <null>
leave.s IL_0121: ret
ret <null>
77bf486f282066d7a1eb49a2f05953cf
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
lgfcmCznklAA.LjdI7U6d.gus
lgfcmCznklAA.KhyZrJvb.mix
Overlay_bc35e469.bin
eQQ8CSK.bat
hater
7z.exe
7z-stream @ 0x000C6D78.7z
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.sxdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
cecho.exe
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
UPX0
UPX1
.rsrc
Resources
RT_MANIFEST
ID:0001
ID:1033
land.zip
nircmd.exe
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
Resources
RT_CURSOR
ID:0001
ID:1033
RT_DIALOG
ID:0066
ID:1037
ID:0070
ID:1037
RT_GROUP_CURSOR2
ID:0067
ID:1033
RT_VERSION
ID:0001
ID:1037
RT_MANIFEST
ID:0001
ID:1033
NSudoLG.exe
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
STRING
ID:07D1
ID:4
ID:7
ID:9
ID:10
ID:12
ID:1028
ID:1040
ID:07D2
ID:4
ID:7
ID:9
ID:10
ID:12
ID:1028
ID:1040
ID:07D3
ID:4
ID:7
ID:9
ID:10
ID:12
ID:1028
ID:1040
RT_ICON
ID:0001
ID:0
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
ID:0006
ID:0
ID:0007
ID:0
ID:0008
ID:0
ID:0-preview.png
RT_DIALOG
ID:0069
ID:0
ID:0084
ID:0
RT_GROUP_CURSOR4
ID:07D0
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.didat
.rsrc
.reloc
Resources
PNG
ID:0065
ID:1033
ID:1033-preview.png
ID:0066
ID:1033
ID:1033-preview.png
RT_ICON
ID:0001
ID:1033
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:0005
ID:1033
ID:0006
ID:1033
ID:0007
ID:1033
ID:1033-preview.png
RT_DIALOG
ID:0000
ID:1033
RT_STRING
ID:0007
ID:1033
ID:0008
ID:1033
ID:0009
ID:1033
ID:000A
ID:1033
ID:000B
ID:1033
ID:000C
ID:1033
ID:000D
ID:1033
ID:000E
ID:1033
ID:000F
ID:1033
ID:0010
ID:1033
RT_GROUP_CURSOR4
ID:0064
ID:1033
RT_MANIFEST
ID:0001
ID:1033
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙