|
Hash | Hash Value |
|---|---|
| MD5 | 7f0028ed74089543b62b2cf305df54b9
|
| Sha1 | 6940472ac3d4bc73e7e7fbad8c705f8f6e4c059f
|
| Sha256 | 8f5bb49ef2c1178c113d477f70856b3d59a107a6f5a551199fb5ea0be911c496
|
| Sha384 | beb7e015e285c3f35a0f0cb286048b2f8441b736df7a7a7bb2667e5a987964fbfa8f713cf18e24b1876d8cdaffcba134
|
| Sha512 | 6aa2e92ed327b58800df0f88fdac1a18dece9905f61ec85607e51c632ff31b4302c332b7ca2fc03801f63baa415826eb42d39e90cc473616910ee138b677c4e3
|
| SSDeep | 1536:eUXNwcxKHXwzCtmPMV9TeoqKMSAIYH1bU/ytCHQzcyLVclN:eUXicxK8WmPMV9Tl0dH1bUqoQjBY
|
| TLSH | 5D7349053BD88D26E2AE4BF9BDF251074AF4D1576012CE5E3CC844CD6A67BC58A036EA
|
PeID
|
Name0 | Value |
|---|---|
| Module Name | Monotone.exe |
| Full Name | Monotone.exe |
| EntryPoint | System.Void Client.Program::Main() |
| Scope Name | Monotone.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v4.0.30319 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | Monotone |
| Assembly Version | 6.0.1.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | .NETFramework,Version=v4.0 |
| Total Strings | 252 |
| Main Method | System.Void Client.Program::Main() |
| Main IL Instruction Count | 94 |
| Main IL | ldc.i4.s 26 call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) ldstr MyData call System.String System.IO.Path::Combine(System.String,System.String) call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldsfld Params.KeylogParams Client.Keylogger::Params callvirt System.Void Params.KeylogParams::LoadFromFile() ldc.i4.1 <null> call System.Void System.Net.ServicePointManager::set_Expect100Continue(System.Boolean) ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldc.i4 9999 call System.Void System.Net.ServicePointManager::set_DefaultConnectionLimit(System.Int32) ldc.i4.0 <null> stloc.0 <null> br IL_0050: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::De_lay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0042: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_006D: call System.Void Client.Helper.SetRegistry::InitRegistry() ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Client.Helper.SetRegistry::InitRegistry() ldsfld System.String Client.Settings::An_ti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0086: leave IL_0091 call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() leave IL_0091: call System.Void Client.Helper.A::B() pop <null> leave IL_0091: call System.Void Client.Helper.A::B() call System.Void Client.Helper.A::B() call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_00A6: leave IL_00B1 ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) leave IL_00B1: nop pop <null> leave IL_00B1: nop nop <null> ldsfld System.String Client.Settings::Anti_Process call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_00C6: leave IL_00D1 call System.Void Client.Helper.AntiProcess::StartBlock() leave IL_00D1: nop pop <null> leave IL_00D1: nop nop <null> ldsfld System.String Client.Settings::BS_OD call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_00F0: leave IL_00FB call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_00F0: leave IL_00FB call System.Void Client.Helper.ProcessCritical::Set() leave IL_00FB: nop pop <null> leave IL_00FB: nop nop <null> ldsfld System.String Client.Settings::In_stall call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0110: leave IL_011B call System.Void Client.Install.NormalStartup::Install() leave IL_011B: call System.Void Client.Helper.Methods::PreventSleep() pop <null> leave IL_011B: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_012F: leave IL_013A call System.Void Client.Helper.Methods::ClearSetting() leave IL_013A: ldsfld System.Threading.ThreadStart Client.Program/<>c::<>9__0_0 pop <null> leave IL_013A: ldsfld System.Threading.ThreadStart Client.Program/<>c::<>9__0_0 ldsfld System.Threading.ThreadStart Client.Program/<>c::<>9__0_0 dup <null> brtrue IL_015C: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) pop <null> ldsfld Client.Program/<>c Client.Program/<>c::<>9 ldftn System.Void Client.Program/<>c::<Main>b__0_0() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Threading.ThreadStart Client.Program/<>c::<>9__0_0 newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) call System.Void System.Threading.Thread::Start() call System.Void Client.Keylogger::Run() call System.Void System.Windows.Forms.Application::Run() ret <null> |
| Module Name | Monotone.exe |
| Full Name | Monotone.exe |
| EntryPoint | System.Void Client.Program::Main() |
| Scope Name | Monotone.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v4.0.30319 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | Monotone |
| Assembly Version | 6.0.1.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | .NETFramework,Version=v4.0 |
| Total Strings | 252 |
| Main Method | System.Void Client.Program::Main() |
| Main IL Instruction Count | 94 |
| Main IL | ldc.i4.s 26 call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) ldstr MyData call System.String System.IO.Path::Combine(System.String,System.String) call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldsfld Params.KeylogParams Client.Keylogger::Params callvirt System.Void Params.KeylogParams::LoadFromFile() ldc.i4.1 <null> call System.Void System.Net.ServicePointManager::set_Expect100Continue(System.Boolean) ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldc.i4 9999 call System.Void System.Net.ServicePointManager::set_DefaultConnectionLimit(System.Int32) ldc.i4.0 <null> stloc.0 <null> br IL_0050: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::De_lay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0042: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_006D: call System.Void Client.Helper.SetRegistry::InitRegistry() ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Client.Helper.SetRegistry::InitRegistry() ldsfld System.String Client.Settings::An_ti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0086: leave IL_0091 call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() leave IL_0091: call System.Void Client.Helper.A::B() pop <null> leave IL_0091: call System.Void Client.Helper.A::B() call System.Void Client.Helper.A::B() call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_00A6: leave IL_00B1 ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) leave IL_00B1: nop pop <null> leave IL_00B1: nop nop <null> ldsfld System.String Client.Settings::Anti_Process call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_00C6: leave IL_00D1 call System.Void Client.Helper.AntiProcess::StartBlock() leave IL_00D1: nop pop <null> leave IL_00D1: nop nop <null> ldsfld System.String Client.Settings::BS_OD call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_00F0: leave IL_00FB call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_00F0: leave IL_00FB call System.Void Client.Helper.ProcessCritical::Set() leave IL_00FB: nop pop <null> leave IL_00FB: nop nop <null> ldsfld System.String Client.Settings::In_stall call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0110: leave IL_011B call System.Void Client.Install.NormalStartup::Install() leave IL_011B: call System.Void Client.Helper.Methods::PreventSleep() pop <null> leave IL_011B: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_012F: leave IL_013A call System.Void Client.Helper.Methods::ClearSetting() leave IL_013A: ldsfld System.Threading.ThreadStart Client.Program/<>c::<>9__0_0 pop <null> leave IL_013A: ldsfld System.Threading.ThreadStart Client.Program/<>c::<>9__0_0 ldsfld System.Threading.ThreadStart Client.Program/<>c::<>9__0_0 dup <null> brtrue IL_015C: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) pop <null> ldsfld Client.Program/<>c Client.Program/<>c::<>9 ldftn System.Void Client.Program/<>c::<Main>b__0_0() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Threading.ThreadStart Client.Program/<>c::<>9__0_0 newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) call System.Void System.Threading.Thread::Start() call System.Void Client.Keylogger::Run() call System.Void System.Windows.Forms.Application::Run() ret <null> |
|
Name0 | Value |
|---|---|
| Embedded Resources | 0 |
| Suspicious Type Names (1-2 chars) | 1 |
|
Name0 | Value | Location |
|---|---|---|
| Embedded Resources | 0 |
7f0028ed74089543b62b2cf305df54b9 |
| Suspicious Type Names (1-2 chars) | 1 |
7f0028ed74089543b62b2cf305df54b9 |