Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
1 malicious · 3 files
EXE86008a68af417d8b5272a5ea76e43d49AsyncRAT
Structure
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key D2973Fhuhuhuhuhuhuhuhuhuhuhu
Version 1huhuhuhu
Port 4huhuhuhu
Host 127huhuhuhu
ReconnectDelay 3huhuhuhu
SubDirectory Suhuhuhuhu
InstallName Clihuhuhuhu
Install 0huhuhuhu
Startup 0huhuhuhu
Mutex c16fc9huhuhuhuhuhuhuhuhuhuhu
StartupKey Quasarhuhuhuhuhuhuhuhuhuhuhu
HideFile 0huhuhuhu
EnableLogger 0huhuhuhu
Tag you huhuhuhu
LogDirectory Lhuhuhuhu
ServerSignature RGy32Chuhuhuhuhuhuhuhuhuhuhu
ServerCertificate MIIFEzhuhuhuhuhuhuhuhuhuhuhu
HideLogDirectory 0huhuhuhu
HideLogSubdirectory 0huhuhuhu
UnattendedMod 1huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Key (AES_256) -huhuhuhu
Pastebin -huhuhuhu
ServerSignature MOGaKehuhuhuhuhuhuhuhuhuhuhu
Install File Sbihuhuhuhu
Mutex cmdvhuhuhuhu
Group cmdvhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client
Full Name
Client
EntryPoint
System.Void ampzvwcpepobgsdhfhga.뇬阢棶춪㙩鴿喡㭏咂૯ꅪ娝ꥹ།嗟檫淽둓::Main(System.String[])
Scope Name
Client
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.7.1.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
1957
Main Method
System.Void ampzvwcpepobgsdhfhga.뇬阢棶춪㙩鴿喡㭏咂૯ꅪ娝ꥹ།嗟檫淽둓::Main(System.String[])
Main IL Instruction Count
20
Main IL 
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
ldnull <null>
ldftn System.Void ampzvwcpepobgsdhfhga.뇬阢棶춪㙩鴿喡㭏咂૯ꅪ娝ꥹ།嗟檫淽둓::黶虺䐬䴰譎駕O쏌蔽អ䀠䍧摟ꚮଁꮂ쟩죶﹚﬉(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void ampzvwcpepobgsdhfhga.뇬阢棶춪㙩鴿喡㭏咂૯ꅪ娝ꥹ།嗟檫淽둓::꒾蚊䄱뷝䌞ᱧ跲䛒⃤㇌ۭ▣睵iᕤ壮(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.Void ampzvwcpepobgsdhfhga.뇬阢棶춪㙩鴿喡㭏咂૯ꅪ娝ꥹ།嗟檫淽둓::苆㢲뒵鿗䅽珣蛳웻�畚牽ꡉ啾樒쯀짽龕젲놫⽭()
newobj System.Void ampzvwcpepobgsdhfhga.䥥ᄎ⟔ኳᾰ�슋㩲언琧့沔ɺ러::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
Module Name
Client
Full Name
Client
EntryPoint
System.Void ampzvwcpepobgsdhfhga.뇬阢棶춪㙩鴿喡㭏咂૯ꅪ娝ꥹ།嗟檫淽둓::Main(System.String[])
Scope Name
Client
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.7.1.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
1957
Main Method
System.Void ampzvwcpepobgsdhfhga.뇬阢棶춪㙩鴿喡㭏咂૯ꅪ娝ꥹ།嗟檫淽둓::Main(System.String[])
Main IL Instruction Count
20
Main IL 
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
ldnull <null>
ldftn System.Void ampzvwcpepobgsdhfhga.뇬阢棶춪㙩鴿喡㭏咂૯ꅪ娝ꥹ།嗟檫淽둓::黶虺䐬䴰譎駕O쏌蔽អ䀠䍧摟ꚮଁꮂ쟩죶﹚﬉(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void ampzvwcpepobgsdhfhga.뇬阢棶춪㙩鴿喡㭏咂૯ꅪ娝ꥹ།嗟檫淽둓::꒾蚊䄱뷝䌞ᱧ跲䛒⃤㇌ۭ▣睵iᕤ壮(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.Void ampzvwcpepobgsdhfhga.뇬阢棶춪㙩鴿喡㭏咂૯ꅪ娝ꥹ།嗟檫淽둓::苆㢲뒵鿗䅽珣蛳웻�畚牽ꡉ啾樒쯀짽龕젲놫⽭()
newobj System.Void ampzvwcpepobgsdhfhga.䥥ᄎ⟔ኳᾰ�슋㩲언琧့沔ɺ러::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
CnC CNCmalicious
127huhuhuhu
Port PORTmalicious
4huhuhuhu
Key (AES_256) MUTEXmalicious
-huhuhuhu
Mutex MUTEXmalicious
cmdvhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙