Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
1 malicious · 3 files
EXE9bca15ab41f9cafcd03bef32fb6d2259AsyncRAT
Structure
Config. Field Value
Key (AES_256) VmJGaFhuhuhuhuhuhuhuhuhuhuhu
Pastebin -huhuhuhu
Certificate MIIE4Dhuhuhuhuhuhuhuhuhuhuhu
ServerSignature a+/TCthuhuhuhuhuhuhuhuhuhuhu
Install fhuhuhuhu
BDOS fhuhuhuhu
Anti-VM fhuhuhuhu
Install-Folder %Aphuhuhuhu
Hosts lamohuhuhuhuhuhuhu
Ports 8huhuhuhu
Mutex u1Gohuhuhuhu
Version 0huhuhuhu
Delay 3huhuhuhu
Group Dehuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
CJTprBKZtGcic
Full Name
CJTprBKZtGcic
EntryPoint
System.Void CmvibddvCryv.xqaYQqqIRNWr::Main()
Scope Name
CJTprBKZtGcic
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
evClient
Assembly Version
7.16.638.9660
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
352
Main Method
System.Void CmvibddvCryv.xqaYQqqIRNWr::Main()
Main IL Instruction Count
69
Main IL 
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Reflection.Assembly CmvibddvCryv.xqaYQqqIRNWr::vgncqLtyHutx(System.Object,System.ResolveEventArgs)
newobj System.Void System.ResolveEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_AssemblyResolve(System.ResolveEventHandler)
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
call System.Boolean CmvibddvCryv.xqaYQqqIRNWr::OgtAzVaEfT()
brtrue IL_0041: ldc.i4.0
call System.Void CmvibddvCryv.xqaYQqqIRNWr::HcKgRFfftzUVR()
leave IL_003A: ldc.i4.0
pop <null>
leave IL_003A: ldc.i4.0
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ret <null>
ldc.i4.0 <null>
stloc.0 <null>
br IL_0056: ldloc.0
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
ldc.i4.1 <null>
add <null>
stloc.0 <null>
ldloc.0 <null>
ldsfld System.String CmvibddvCryv.irSoqKbDdUdXg::PPVJiVlfhZL
call System.Int32 System.Convert::ToInt32(System.String)
blt.s IL_0048: ldc.i4 1000
call System.Boolean CmvibddvCryv.irSoqKbDdUdXg::aluPTALObcU()
brtrue IL_0073: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Boolean NDsbAdTiUVDJ.MAAxxqgognL::riWxqjqerdatY()
brtrue IL_0084: ldsfld System.String CmvibddvCryv.irSoqKbDdUdXg::DBEUHKMZYvwlmY
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String CmvibddvCryv.irSoqKbDdUdXg::DBEUHKMZYvwlmY
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_0098: ldsfld System.String CmvibddvCryv.irSoqKbDdUdXg::YMbSAdPDwqZZ
call System.Void NDsbAdTiUVDJ.nciOhpFkCMCDpUxM::krMQMdtzCY()
ldsfld System.String CmvibddvCryv.irSoqKbDdUdXg::YMbSAdPDwqZZ
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_00AC: ldsfld System.String CmvibddvCryv.irSoqKbDdUdXg::cHUxRSmcARLiM
call System.Void lQALKSObXFQIBj.tKrcNqQJQXI::PAphnxVYqKE()
ldsfld System.String CmvibddvCryv.irSoqKbDdUdXg::cHUxRSmcARLiM
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_00CA: call System.Void NDsbAdTiUVDJ.uCokqabBsxw::NUeaLzSDzffOAe()
call System.Boolean NDsbAdTiUVDJ.uCokqabBsxw::ZITPCWstdOiWIr()
brfalse IL_00CA: call System.Void NDsbAdTiUVDJ.uCokqabBsxw::NUeaLzSDzffOAe()
call System.Void NDsbAdTiUVDJ.KLtZFpIlqaGzK::jXzZvpsaiBHLR()
call System.Void NDsbAdTiUVDJ.uCokqabBsxw::NUeaLzSDzffOAe()
ldstr pkeenpghpkeocnndbeclgeojlbnoebcd
call System.Void NDsbAdTiUVDJ.uCokqabBsxw::HYsTtpucvF(System.String)
leave IL_00E4: nop
pop <null>
leave IL_00E4: nop
nop <null>
call System.Boolean mTOkvghopZTUC.ZYDVaRVaxaEKqu::get_IsConnected()
brtrue IL_00F9: leave IL_0104
call System.Void mTOkvghopZTUC.ZYDVaRVaxaEKqu::ZKZtrcDKQLFXn()
call System.Void mTOkvghopZTUC.ZYDVaRVaxaEKqu::DMcXvIColkF()
leave IL_0104: ldc.i4 5000
pop <null>
leave IL_0104: ldc.i4 5000
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_00E4: nop
Module Name
CJTprBKZtGcic
Full Name
CJTprBKZtGcic
EntryPoint
System.Void CmvibddvCryv.xqaYQqqIRNWr::Main()
Scope Name
CJTprBKZtGcic
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
evClient
Assembly Version
7.16.638.9660
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
352
Main Method
System.Void CmvibddvCryv.xqaYQqqIRNWr::Main()
Main IL Instruction Count
69
Main IL 
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Reflection.Assembly CmvibddvCryv.xqaYQqqIRNWr::vgncqLtyHutx(System.Object,System.ResolveEventArgs)
newobj System.Void System.ResolveEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_AssemblyResolve(System.ResolveEventHandler)
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
call System.Boolean CmvibddvCryv.xqaYQqqIRNWr::OgtAzVaEfT()
brtrue IL_0041: ldc.i4.0
call System.Void CmvibddvCryv.xqaYQqqIRNWr::HcKgRFfftzUVR()
leave IL_003A: ldc.i4.0
pop <null>
leave IL_003A: ldc.i4.0
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ret <null>
ldc.i4.0 <null>
stloc.0 <null>
br IL_0056: ldloc.0
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
ldc.i4.1 <null>
add <null>
stloc.0 <null>
ldloc.0 <null>
ldsfld System.String CmvibddvCryv.irSoqKbDdUdXg::PPVJiVlfhZL
call System.Int32 System.Convert::ToInt32(System.String)
blt.s IL_0048: ldc.i4 1000
call System.Boolean CmvibddvCryv.irSoqKbDdUdXg::aluPTALObcU()
brtrue IL_0073: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Boolean NDsbAdTiUVDJ.MAAxxqgognL::riWxqjqerdatY()
brtrue IL_0084: ldsfld System.String CmvibddvCryv.irSoqKbDdUdXg::DBEUHKMZYvwlmY
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String CmvibddvCryv.irSoqKbDdUdXg::DBEUHKMZYvwlmY
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_0098: ldsfld System.String CmvibddvCryv.irSoqKbDdUdXg::YMbSAdPDwqZZ
call System.Void NDsbAdTiUVDJ.nciOhpFkCMCDpUxM::krMQMdtzCY()
ldsfld System.String CmvibddvCryv.irSoqKbDdUdXg::YMbSAdPDwqZZ
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_00AC: ldsfld System.String CmvibddvCryv.irSoqKbDdUdXg::cHUxRSmcARLiM
call System.Void lQALKSObXFQIBj.tKrcNqQJQXI::PAphnxVYqKE()
ldsfld System.String CmvibddvCryv.irSoqKbDdUdXg::cHUxRSmcARLiM
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_00CA: call System.Void NDsbAdTiUVDJ.uCokqabBsxw::NUeaLzSDzffOAe()
call System.Boolean NDsbAdTiUVDJ.uCokqabBsxw::ZITPCWstdOiWIr()
brfalse IL_00CA: call System.Void NDsbAdTiUVDJ.uCokqabBsxw::NUeaLzSDzffOAe()
call System.Void NDsbAdTiUVDJ.KLtZFpIlqaGzK::jXzZvpsaiBHLR()
call System.Void NDsbAdTiUVDJ.uCokqabBsxw::NUeaLzSDzffOAe()
ldstr pkeenpghpkeocnndbeclgeojlbnoebcd
call System.Void NDsbAdTiUVDJ.uCokqabBsxw::HYsTtpucvF(System.String)
leave IL_00E4: nop
pop <null>
leave IL_00E4: nop
nop <null>
call System.Boolean mTOkvghopZTUC.ZYDVaRVaxaEKqu::get_IsConnected()
brtrue IL_00F9: leave IL_0104
call System.Void mTOkvghopZTUC.ZYDVaRVaxaEKqu::ZKZtrcDKQLFXn()
call System.Void mTOkvghopZTUC.ZYDVaRVaxaEKqu::DMcXvIColkF()
leave IL_0104: ldc.i4 5000
pop <null>
leave IL_0104: ldc.i4 5000
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_00E4: nop
Key (AES_256) MUTEXmalicious
VmJGaFhuhuhuhuhuhuhuhuhuhuhu
CnC CNCmalicious
lamohuhuhuhuhuhuhu
Ports PORTmalicious
8huhuhuhu
Mutex MUTEXmalicious
u1Gohuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙