98c1ac9f792a7c87e5757d7e77e983a3

PE Executable

MD5: 98c1ac9f792a7c87e5757d7e77e983a3

Size: 2.55 MB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Low

MD5	98c1ac9f792a7c87e5757d7e77e983a3
Sha1	e7d084b83b84eb8e7a1c4000d69e7a93ff8250a2
Sha256	732e1cf62adca86360caf2a13fcf7f54976ff43daca9374f5f00afb6b5d0011f
Sha384	0c68108327615e83b2db160c9937192ec017fc1ac746edc9476c87173468119ce6b700a8d8726f21a2991eacf2a563fa
Sha512	138eab549a59b85b18b95ef4e57fbe2b55fd93f4e1dc4179300fb9a90f3fbdb66912be6830407b304097431f0ba4148b1f2d93f15fbb364df33867b11f91db45
SSDeep	49152:K9EeNSPwEW3cFSI4Tfm3hvbHsjAJcAMkPRUiPzmE6GnU:K9Nzm31PMoRHmz
TLSH	FBC5BF4AB3B8019CD5BBC17DC627670BE7B174061710ABDF16A086AA2F23FD5567E320

PeID

HQR data fileMicrosoft Visual C++ DLLMicrosoft Visual C++ v6.0Microsoft Visual C++ v6.0 DLL

STICH beta

No STICH Path has been generated for this analysis yet.

5 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 4img 1

Name	Value
Module Name	WindowsHostManager.exe
Full Name	WindowsHostManager.exe
Info	PE Detect: PeReader OK (file layout)
EntryPoint	System.Void Stealer.Program::Main(System.String[])
Scope Name	WindowsHostManager.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	WindowsHostManager
Assembly Version	10.0.22621.1
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6.2
Total Strings	1820
Main Method	System.Void Stealer.Program::Main(System.String[])
Main IL Instruction Count	57
Main IL	call System.AppDomain System.AppDomain::get_CurrentDomain() ldsfld System.UnhandledExceptionEventHandler Stealer.Program/<>c::<>9__14_0 dup <null> brtrue.s IL_0024: callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) pop <null> ldsfld Stealer.Program/<>c Stealer.Program/<>c::<>9 ldftn System.Void Stealer.Program/<>c::<Main>b__14_0(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.UnhandledExceptionEventHandler Stealer.Program/<>c::<>9__14_0 callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Void Stealer.Utils.Config::Initialize() call System.String System.Environment::get_MachineName() ldstr _ call System.String System.Environment::get_UserName() call System.String System.String::Concat(System.String,System.String,System.String) stsfld System.String Stealer.Program::_clientId call System.Void Stealer.Utils.Persistence::Install() leave.s IL_0051: ldsfld System.String Stealer.Program::_clientId pop <null> leave.s IL_0051: ldsfld System.String Stealer.Program::_clientId ldsfld System.String Stealer.Program::_clientId ldsfld System.Action`1<System.String> Stealer.Program/<>O::<0>__HandleCommand dup <null> brtrue.s IL_0071: call System.Void Stealer.Utils.C2Client::Connect(System.String,System.Action`1<System.String>) pop <null> ldnull <null> ldftn System.Void Stealer.Program::HandleCommand(System.String) newobj System.Void System.Action`1<System.String>::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Action`1<System.String> Stealer.Program/<>O::<0>__HandleCommand call System.Void Stealer.Utils.C2Client::Connect(System.String,System.Action`1<System.String>) leave.s IL_00B3: ldc.i4 60000 stloc.0 <null> ldsfld System.String Stealer.Program::CrashLog call System.DateTime System.DateTime::get_Now() stloc.1 <null> ldloca.s V_1 call System.String System.DateTime::ToString() ldstr MAIN ERR: ldloc.0 <null> dup <null> brtrue.s IL_0098: callvirt System.String System.Object::ToString() pop <null> ldnull <null> br.s IL_009D: ldstr "\r\n" callvirt System.String System.Object::ToString() ldstr call System.String System.String::Concat(System.String,System.String,System.String,System.String) call System.Void System.IO.File::AppendAllText(System.String,System.String) leave.s IL_00B1: leave.s IL_00B3 pop <null> leave.s IL_00B1: leave.s IL_00B3 leave.s IL_00B3: ldc.i4 60000 ldc.i4 60000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_00B3: ldc.i4 60000
Info	PDB Path: ?

No malware configuration was found at this point.

You must be signed in to view YARA rules.