Suspicious
Suspect

7c2480ec00eab8362d98a3f6d02c0f6c

PE Executable
MD5: 7c2480ec00eab8362d98a3f6d02c0f6c
Size: 91.14 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 7c2480ec00eab8362d98a3f6d02c0f6c
Sha1 072b38be14596dfb99878aa8f3adfb6b0de94b26
Sha256 44c72781ace7db466106bb829afbad99fe03ac00b3c8d22e8ef3419e6dcec679
Sha384 1537a6d0aed5d2c81ee55270eba63640ef93edd987b35804d2c97d30cd35d8f6aef13413b410679f61396365ea0692ed
Sha512 b28a96c7fc444761ca292c74e1b0ec381fce137fe7752ec054539783a0f4875b4a49ec0e90f1aaae058cdc6105706b2cceccab5c75e74cc117bde93c094fa727
SSDeep 768:0qo2vNtcap5yquYr9knZeAz7pF/Fu9b4Ng7F:Do20QyzYr9kn4AP/Fu9b4Ng7F
TLSH 6E936233267553D6D564CB3C89BEB00B0EBE7C0568169246E845BFC977E0E4588F2F2A
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
7c2480ec00eab8362d98a3f6d02c0f6c
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0002
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
STICH beta

No STICH Path has been generated for this analysis yet.

1 structural branch were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 1
Name Value
Module Name
satoshi miner.exe
Full Name
satoshi miner.exe
EntryPoint
System.Void ConsoleApplication7.Program::Main(System.String[])
Scope Name
satoshi miner.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
satoshi miner
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Info
PE Detect: PeReader OK (file layout)
Total Strings
313
Main Method
System.Void ConsoleApplication7.Program::Main(System.String[])
Main IL Instruction Count
48
Main IL 
call System.Boolean ConsoleApplication7.Program::AlreadyRunning()
brfalse.s IL_000D: ldsfld System.Boolean ConsoleApplication7.Program::checkSleep
ldc.i4.1 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.Boolean ConsoleApplication7.Program::checkSleep
brfalse.s IL_0019: ldsfld System.Boolean ConsoleApplication7.Program::checkAdminPrivilage
call System.Void ConsoleApplication7.Program::sleepOutOfTempFolder()
ldsfld System.Boolean ConsoleApplication7.Program::checkAdminPrivilage
brfalse.s IL_002C: ldsfld System.Boolean ConsoleApplication7.Program::checkCopyRoaming
ldsfld System.String ConsoleApplication7.Program::processName
call System.Void ConsoleApplication7.Program::copyResistForAdmin(System.String)
br.s IL_003D: ldsfld System.Boolean ConsoleApplication7.Program::checkStartupFolder
ldsfld System.Boolean ConsoleApplication7.Program::checkCopyRoaming
brfalse.s IL_003D: ldsfld System.Boolean ConsoleApplication7.Program::checkStartupFolder
ldsfld System.String ConsoleApplication7.Program::processName
call System.Void ConsoleApplication7.Program::copyRoaming(System.String)
ldsfld System.Boolean ConsoleApplication7.Program::checkStartupFolder
brfalse.s IL_0049: call System.Void ConsoleApplication7.Program::lookForDirectories()
call System.Void ConsoleApplication7.Program::addLinkToStartup()
call System.Void ConsoleApplication7.Program::lookForDirectories()
ldsfld System.Boolean ConsoleApplication7.Program::checkAdminPrivilage
brfalse.s IL_0079: ldsfld System.Boolean ConsoleApplication7.Program::checkSpread
ldsfld System.Boolean ConsoleApplication7.Program::checkdeleteShadowCopies
brfalse.s IL_0061: ldsfld System.Boolean ConsoleApplication7.Program::checkdisableRecoveryMode
call System.Void ConsoleApplication7.Program::deleteShadowCopies()
ldsfld System.Boolean ConsoleApplication7.Program::checkdisableRecoveryMode
brfalse.s IL_006D: ldsfld System.Boolean ConsoleApplication7.Program::checkdeleteBackupCatalog
call System.Void ConsoleApplication7.Program::disableRecoveryMode()
ldsfld System.Boolean ConsoleApplication7.Program::checkdeleteBackupCatalog
brfalse.s IL_0079: ldsfld System.Boolean ConsoleApplication7.Program::checkSpread
call System.Void ConsoleApplication7.Program::deleteBackupCatalog()
ldsfld System.Boolean ConsoleApplication7.Program::checkSpread
brfalse.s IL_008A: call System.Void ConsoleApplication7.Program::addAndOpenNote()
ldsfld System.String ConsoleApplication7.Program::spreadName
call System.Void ConsoleApplication7.Program::spreadIt(System.String)
call System.Void ConsoleApplication7.Program::addAndOpenNote()
ldsfld System.String ConsoleApplication7.Program::base64Image
call System.Void ConsoleApplication7.Program::SetWallpaper(System.String)
ldsfld System.Threading.ThreadStart ConsoleApplication7.Program::CS$<>9__CachedAnonymousMethodDelegate1
brtrue.s IL_00B1: ldsfld System.Threading.ThreadStart ConsoleApplication7.Program::CS$<>9__CachedAnonymousMethodDelegate1
ldnull <null>
ldftn System.Void ConsoleApplication7.Program::<Main>b__0()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
stsfld System.Threading.ThreadStart ConsoleApplication7.Program::CS$<>9__CachedAnonymousMethodDelegate1
ldsfld System.Threading.ThreadStart ConsoleApplication7.Program::CS$<>9__CachedAnonymousMethodDelegate1
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
call System.Void System.Threading.Thread::Start()
ret <null>
Module Name
satoshi miner.exe
Full Name
satoshi miner.exe
EntryPoint
System.Void ConsoleApplication7.Program::Main(System.String[])
Scope Name
satoshi miner.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
satoshi miner
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
313
Main Method
System.Void ConsoleApplication7.Program::Main(System.String[])
Main IL Instruction Count
48
Main IL 
call System.Boolean ConsoleApplication7.Program::AlreadyRunning()
brfalse.s IL_000D: ldsfld System.Boolean ConsoleApplication7.Program::checkSleep
ldc.i4.1 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.Boolean ConsoleApplication7.Program::checkSleep
brfalse.s IL_0019: ldsfld System.Boolean ConsoleApplication7.Program::checkAdminPrivilage
call System.Void ConsoleApplication7.Program::sleepOutOfTempFolder()
ldsfld System.Boolean ConsoleApplication7.Program::checkAdminPrivilage
brfalse.s IL_002C: ldsfld System.Boolean ConsoleApplication7.Program::checkCopyRoaming
ldsfld System.String ConsoleApplication7.Program::processName
call System.Void ConsoleApplication7.Program::copyResistForAdmin(System.String)
br.s IL_003D: ldsfld System.Boolean ConsoleApplication7.Program::checkStartupFolder
ldsfld System.Boolean ConsoleApplication7.Program::checkCopyRoaming
brfalse.s IL_003D: ldsfld System.Boolean ConsoleApplication7.Program::checkStartupFolder
ldsfld System.String ConsoleApplication7.Program::processName
call System.Void ConsoleApplication7.Program::copyRoaming(System.String)
ldsfld System.Boolean ConsoleApplication7.Program::checkStartupFolder
brfalse.s IL_0049: call System.Void ConsoleApplication7.Program::lookForDirectories()
call System.Void ConsoleApplication7.Program::addLinkToStartup()
call System.Void ConsoleApplication7.Program::lookForDirectories()
ldsfld System.Boolean ConsoleApplication7.Program::checkAdminPrivilage
brfalse.s IL_0079: ldsfld System.Boolean ConsoleApplication7.Program::checkSpread
ldsfld System.Boolean ConsoleApplication7.Program::checkdeleteShadowCopies
brfalse.s IL_0061: ldsfld System.Boolean ConsoleApplication7.Program::checkdisableRecoveryMode
call System.Void ConsoleApplication7.Program::deleteShadowCopies()
ldsfld System.Boolean ConsoleApplication7.Program::checkdisableRecoveryMode
brfalse.s IL_006D: ldsfld System.Boolean ConsoleApplication7.Program::checkdeleteBackupCatalog
call System.Void ConsoleApplication7.Program::disableRecoveryMode()
ldsfld System.Boolean ConsoleApplication7.Program::checkdeleteBackupCatalog
brfalse.s IL_0079: ldsfld System.Boolean ConsoleApplication7.Program::checkSpread
call System.Void ConsoleApplication7.Program::deleteBackupCatalog()
ldsfld System.Boolean ConsoleApplication7.Program::checkSpread
brfalse.s IL_008A: call System.Void ConsoleApplication7.Program::addAndOpenNote()
ldsfld System.String ConsoleApplication7.Program::spreadName
call System.Void ConsoleApplication7.Program::spreadIt(System.String)
call System.Void ConsoleApplication7.Program::addAndOpenNote()
ldsfld System.String ConsoleApplication7.Program::base64Image
call System.Void ConsoleApplication7.Program::SetWallpaper(System.String)
ldsfld System.Threading.ThreadStart ConsoleApplication7.Program::CS$<>9__CachedAnonymousMethodDelegate1
brtrue.s IL_00B1: ldsfld System.Threading.ThreadStart ConsoleApplication7.Program::CS$<>9__CachedAnonymousMethodDelegate1
ldnull <null>
ldftn System.Void ConsoleApplication7.Program::<Main>b__0()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
stsfld System.Threading.ThreadStart ConsoleApplication7.Program::CS$<>9__CachedAnonymousMethodDelegate1
ldsfld System.Threading.ThreadStart ConsoleApplication7.Program::CS$<>9__CachedAnonymousMethodDelegate1
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
call System.Void System.Threading.Thread::Start()
ret <null>
7c2480ec00eab8362d98a3f6d02c0f6c
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0002
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙