Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
1 malicious · 3 files
EXEa92e1af89325326e99d7b79ad2ca917aXWorm
Structure
Config. Field Value
Mutex c5D4Yhuhuhuhuhuhuhu
Pastebin https:huhuhuhuhuhuhuhuhuhuhu
Hosts MRhuhuhuhu
KEY <Xwhuhuhuhu
USBNM ~3huhuhuhu
family xhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
svchost.exe
Full Name
svchost.exe
EntryPoint 
System.Void Stub.awjYcka0093Al7utN14hkCfZ6axWHQ4m1fJ2sl32WOFiH0SeUSoTUiDr6zlB::5rm11Yfn3ahA9OJYlQ07PzpLYg4Ijv65CfHVZMavtgg2AA1v38t8FlLrKV0O()
Scope Name
svchost.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
svchost
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
338
Main Method 
System.Void Stub.awjYcka0093Al7utN14hkCfZ6axWHQ4m1fJ2sl32WOFiH0SeUSoTUiDr6zlB::5rm11Yfn3ahA9OJYlQ07PzpLYg4Ijv65CfHVZMavtgg2AA1v38t8FlLrKV0O()
Main IL Instruction Count
109
Main IL 
ldsfld System.Int32 X6f15R07PVygiA7HAqZ1myzFVIGnT2j9FjBMAK8JXfhh3ndr5WVtqJAazcNy::RLq63ZbrAuX4ALIWmn6OYvvjc3gQVkgLAJMQy6yd6LIJEQf3UtX6lMwNjFtp
ldc.i4 1000
mul.ovf <null>
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldsfld System.String X6f15R07PVygiA7HAqZ1myzFVIGnT2j9FjBMAK8JXfhh3ndr5WVtqJAazcNy::uPkkf8Ejnc12vzYMBoEq3yI36bwtDgO4ylkIpHYQlz52gFaRSGAMdqxLTKcs
call System.Object Stub.7tohbIFIzTbPEtVASmFi5VFBkmR1CEy4foOqFmFn0XrhnsueKdAj000V1ERER8fF5Jk0uOWEN0vs9::JlOVr6glKgLWZYU02ItbNdkCDMiofWeICI2QuvtlBA1aO5mGNpUQrZWzTTdiR4D3CADj9wng5tgzd(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String X6f15R07PVygiA7HAqZ1myzFVIGnT2j9FjBMAK8JXfhh3ndr5WVtqJAazcNy::uPkkf8Ejnc12vzYMBoEq3yI36bwtDgO4ylkIpHYQlz52gFaRSGAMdqxLTKcs
ldsfld System.String X6f15R07PVygiA7HAqZ1myzFVIGnT2j9FjBMAK8JXfhh3ndr5WVtqJAazcNy::10PkgbLUAa60sJ0HqavOeh127otL0dXzSKljVQdop5ImIdPsRHeovOX7ZMdw
call System.Object Stub.7tohbIFIzTbPEtVASmFi5VFBkmR1CEy4foOqFmFn0XrhnsueKdAj000V1ERER8fF5Jk0uOWEN0vs9::JlOVr6glKgLWZYU02ItbNdkCDMiofWeICI2QuvtlBA1aO5mGNpUQrZWzTTdiR4D3CADj9wng5tgzd(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String X6f15R07PVygiA7HAqZ1myzFVIGnT2j9FjBMAK8JXfhh3ndr5WVtqJAazcNy::10PkgbLUAa60sJ0HqavOeh127otL0dXzSKljVQdop5ImIdPsRHeovOX7ZMdw
ldsfld System.String X6f15R07PVygiA7HAqZ1myzFVIGnT2j9FjBMAK8JXfhh3ndr5WVtqJAazcNy::kdQYEaNYc59yADH4Rt7UDT9dQSeZmyMuGZuW9OShNDky9XBNMiQpUt3ZKI6m
call System.Object Stub.7tohbIFIzTbPEtVASmFi5VFBkmR1CEy4foOqFmFn0XrhnsueKdAj000V1ERER8fF5Jk0uOWEN0vs9::JlOVr6glKgLWZYU02ItbNdkCDMiofWeICI2QuvtlBA1aO5mGNpUQrZWzTTdiR4D3CADj9wng5tgzd(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String X6f15R07PVygiA7HAqZ1myzFVIGnT2j9FjBMAK8JXfhh3ndr5WVtqJAazcNy::kdQYEaNYc59yADH4Rt7UDT9dQSeZmyMuGZuW9OShNDky9XBNMiQpUt3ZKI6m
ldsfld System.String X6f15R07PVygiA7HAqZ1myzFVIGnT2j9FjBMAK8JXfhh3ndr5WVtqJAazcNy::ThpmUAMSCjPLZkTCslmxWCXEzWfkNMxx5BO6jPjvgjeAjBBHRFFsRcLBC41E
call System.Object Stub.7tohbIFIzTbPEtVASmFi5VFBkmR1CEy4foOqFmFn0XrhnsueKdAj000V1ERER8fF5Jk0uOWEN0vs9::JlOVr6glKgLWZYU02ItbNdkCDMiofWeICI2QuvtlBA1aO5mGNpUQrZWzTTdiR4D3CADj9wng5tgzd(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String X6f15R07PVygiA7HAqZ1myzFVIGnT2j9FjBMAK8JXfhh3ndr5WVtqJAazcNy::ThpmUAMSCjPLZkTCslmxWCXEzWfkNMxx5BO6jPjvgjeAjBBHRFFsRcLBC41E
ldsfld System.String X6f15R07PVygiA7HAqZ1myzFVIGnT2j9FjBMAK8JXfhh3ndr5WVtqJAazcNy::zPRk8PPJh5myGlfGx6qR7CBECKnKxka4TbmlUrRkxc8nKoqqglloetn9aLDx
call System.Object Stub.7tohbIFIzTbPEtVASmFi5VFBkmR1CEy4foOqFmFn0XrhnsueKdAj000V1ERER8fF5Jk0uOWEN0vs9::JlOVr6glKgLWZYU02ItbNdkCDMiofWeICI2QuvtlBA1aO5mGNpUQrZWzTTdiR4D3CADj9wng5tgzd(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String X6f15R07PVygiA7HAqZ1myzFVIGnT2j9FjBMAK8JXfhh3ndr5WVtqJAazcNy::zPRk8PPJh5myGlfGx6qR7CBECKnKxka4TbmlUrRkxc8nKoqqglloetn9aLDx
ldsfld System.String X6f15R07PVygiA7HAqZ1myzFVIGnT2j9FjBMAK8JXfhh3ndr5WVtqJAazcNy::wwHsk4Gk9CO0lSSIEXcom6MALHjWHSDixIqBvpezQbgvaVYYgtexc9zrCDZ5
call System.Object Stub.7tohbIFIzTbPEtVASmFi5VFBkmR1CEy4foOqFmFn0XrhnsueKdAj000V1ERER8fF5Jk0uOWEN0vs9::JlOVr6glKgLWZYU02ItbNdkCDMiofWeICI2QuvtlBA1aO5mGNpUQrZWzTTdiR4D3CADj9wng5tgzd(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String X6f15R07PVygiA7HAqZ1myzFVIGnT2j9FjBMAK8JXfhh3ndr5WVtqJAazcNy::wwHsk4Gk9CO0lSSIEXcom6MALHjWHSDixIqBvpezQbgvaVYYgtexc9zrCDZ5
ldsfld System.String X6f15R07PVygiA7HAqZ1myzFVIGnT2j9FjBMAK8JXfhh3ndr5WVtqJAazcNy::FbxL8gQ9xzvzMWEf542bQlUQ4qEikOPfxN2pWC432mUyzFIVOvQmS46YTDsc
call System.Object Stub.7tohbIFIzTbPEtVASmFi5VFBkmR1CEy4foOqFmFn0XrhnsueKdAj000V1ERER8fF5Jk0uOWEN0vs9::JlOVr6glKgLWZYU02ItbNdkCDMiofWeICI2QuvtlBA1aO5mGNpUQrZWzTTdiR4D3CADj9wng5tgzd(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String X6f15R07PVygiA7HAqZ1myzFVIGnT2j9FjBMAK8JXfhh3ndr5WVtqJAazcNy::FbxL8gQ9xzvzMWEf542bQlUQ4qEikOPfxN2pWC432mUyzFIVOvQmS46YTDsc
leave.s IL_00B2: call System.Boolean Stub.CISSvtsBGC0g65eQC8hFEz80288Jhn4b76jzgNJDzTtgJR2W0VpfZjIwKCu1ttkGSXvaJjOVaPb3E::JTPVyUWsfBLUX9NDr5zZg6jkiPfgBeOsRDuRatkj2zcfTkg6f7fet4abpXjYE3()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.3 <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00B2: call System.Boolean Stub.CISSvtsBGC0g65eQC8hFEz80288Jhn4b76jzgNJDzTtgJR2W0VpfZjIwKCu1ttkGSXvaJjOVaPb3E::JTPVyUWsfBLUX9NDr5zZg6jkiPfgBeOsRDuRatkj2zcfTkg6f7fet4abpXjYE3()
call System.Boolean Stub.CISSvtsBGC0g65eQC8hFEz80288Jhn4b76jzgNJDzTtgJR2W0VpfZjIwKCu1ttkGSXvaJjOVaPb3E::JTPVyUWsfBLUX9NDr5zZg6jkiPfgBeOsRDuRatkj2zcfTkg6f7fet4abpXjYE3()
brtrue.s IL_00BF: call System.Void Stub.awjYcka0093Al7utN14hkCfZ6axWHQ4m1fJ2sl32WOFiH0SeUSoTUiDr6zlB::Bgg8722wBG7tafXjWtDSJrUt7Rtdptq1r9IzyPrg4p2MtotSWuMO0SpWQtzd()
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Stub.awjYcka0093Al7utN14hkCfZ6axWHQ4m1fJ2sl32WOFiH0SeUSoTUiDr6zlB::Bgg8722wBG7tafXjWtDSJrUt7Rtdptq1r9IzyPrg4p2MtotSWuMO0SpWQtzd()
leave.s IL_00D5: call System.Void Stub.awjYcka0093Al7utN14hkCfZ6axWHQ4m1fJ2sl32WOFiH0SeUSoTUiDr6zlB::TqUfx3xURNWHsS2zETEFMitixVeZ8043Bl4ZjUjaF4q95juMb4sExTpJGBpi()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_4
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00D5: call System.Void Stub.awjYcka0093Al7utN14hkCfZ6axWHQ4m1fJ2sl32WOFiH0SeUSoTUiDr6zlB::TqUfx3xURNWHsS2zETEFMitixVeZ8043Bl4ZjUjaF4q95juMb4sExTpJGBpi()
call System.Void Stub.awjYcka0093Al7utN14hkCfZ6axWHQ4m1fJ2sl32WOFiH0SeUSoTUiDr6zlB::TqUfx3xURNWHsS2zETEFMitixVeZ8043Bl4ZjUjaF4q95juMb4sExTpJGBpi()
ldsfld System.String X6f15R07PVygiA7HAqZ1myzFVIGnT2j9FjBMAK8JXfhh3ndr5WVtqJAazcNy::zPRk8PPJh5myGlfGx6qR7CBECKnKxka4TbmlUrRkxc8nKoqqglloetn9aLDx
call System.String Stub.awjYcka0093Al7utN14hkCfZ6axWHQ4m1fJ2sl32WOFiH0SeUSoTUiDr6zlB::5Da3PL5UkqbH2hIDZ0e7e3Gz28XYffy8qZWJzrPvPcHkYKUvJD9xx5PflZ9c(System.String)
stloc.0 <null>
ldloc.0 <null>
ldc.i4.1 <null>
newarr System.Char
stloc.s V_5
ldloc.s V_5
ldc.i4.0 <null>
ldc.i4.s 58
stelem.i2 <null>
ldloc.s V_5
callvirt System.String[] System.String::Split(System.Char[])
ldc.i4.0 <null>
ldelem.ref <null>
stsfld System.String X6f15R07PVygiA7HAqZ1myzFVIGnT2j9FjBMAK8JXfhh3ndr5WVtqJAazcNy::XXjPZ08aDm7a2NpZDfb6LcTexpBFLlw5SV8yfbABkCjGuEdW37d3JaEJihcT
ldloc.0 <null>
ldc.i4.1 <null>
newarr System.Char
stloc.s V_5
ldloc.s V_5
ldc.i4.0 <null>
ldc.i4.s 58
stelem.i2 <null>
ldloc.s V_5
callvirt System.String[] System.String::Split(System.Char[])
ldc.i4.1 <null>
ldelem.ref <null>
stsfld System.String X6f15R07PVygiA7HAqZ1myzFVIGnT2j9FjBMAK8JXfhh3ndr5WVtqJAazcNy::D340bvhmKPlK4ufrCUdOKGowAk326XGrOkAWFo2y0zH0zC1qaUkKxnFAkLqD
call System.Void Stub.CISSvtsBGC0g65eQC8hFEz80288Jhn4b76jzgNJDzTtgJR2W0VpfZjIwKCu1ttkGSXvaJjOVaPb3E::FLHk2H1WzdJYV3uYwxbGsDZAUnnxiJtyshuTE6ZyeuXlncYdwVfWKK5p20oe9h()
ldnull <null>
ldftn System.Void Stub.awjYcka0093Al7utN14hkCfZ6axWHQ4m1fJ2sl32WOFiH0SeUSoTUiDr6zlB::ePyfdgovM9UG8Yi8Ji34lXB2wx8MWqjzYkRMZZt2NUDoFQXlqmRAIAZv4TFK()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
callvirt System.Void System.Threading.Thread::Start()
call System.String Stub.ldSBkjss8rt3PKEBnsUEfHWNESI6NfppFJbkpsfmrN5pQeTGeRDL1O8BDzeH::pItkGlb6myT60CPEB9bW8PdQFnmlHYdini2aMMZFvkFI8QiUplzQ16mEtozp()
call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.String)
brfalse.s IL_014B: call System.Void Stub.awjYcka0093Al7utN14hkCfZ6axWHQ4m1fJ2sl32WOFiH0SeUSoTUiDr6zlB::gixfYvBKySfKU4ZFye4aPV67R4JU1RTHVpZFapV5hs84VWglFZ12ELCoQmOp()
call System.Void Stub.NRjTNy2Ucz7TdsuaWFnDmS9J9FwOQKqn20mccBffoGYo2p1AvJIczrjzdXtszBLZ2gsQU8I0OEK0I::NWyJrgjQwcDw8RgplIqkCUdru14jUCbv7RkmAqWD7DWqifnO36KvBPp3Saz2JyCF8zufgOuM0qCQo()
call System.Void Stub.awjYcka0093Al7utN14hkCfZ6axWHQ4m1fJ2sl32WOFiH0SeUSoTUiDr6zlB::gixfYvBKySfKU4ZFye4aPV67R4JU1RTHVpZFapV5hs84VWglFZ12ELCoQmOp()
ldnull <null>
ldftn System.Void Stub.awjYcka0093Al7utN14hkCfZ6axWHQ4m1fJ2sl32WOFiH0SeUSoTUiDr6zlB::eAR6M2rsLAjfwWtYWfFm0LC8Soc6UXquToC9JIfC8oIYvw4qc33x3hMi5Ftg()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.1 <null>
ldnull <null>
ldftn System.Void Stub.awjYcka0093Al7utN14hkCfZ6axWHQ4m1fJ2sl32WOFiH0SeUSoTUiDr6zlB::DCkwqt5LXfevKej73ZxgTRe4L8cR2qstBvcS3sBwMGLPuZD297889IHqVGA8()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.2 <null>
ldloc.1 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.2 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.2 <null>
callvirt System.Void System.Threading.Thread::Join()
ret <null>
Module Name
svchost.exe
Full Name
svchost.exe
EntryPoint 
System.Void Stub.awjYcka0093Al7utN14hkCfZ6axWHQ4m1fJ2sl32WOFiH0SeUSoTUiDr6zlB::5rm11Yfn3ahA9OJYlQ07PzpLYg4Ijv65CfHVZMavtgg2AA1v38t8FlLrKV0O()
Scope Name
svchost.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
svchost
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
338
Main Method 
System.Void Stub.awjYcka0093Al7utN14hkCfZ6axWHQ4m1fJ2sl32WOFiH0SeUSoTUiDr6zlB::5rm11Yfn3ahA9OJYlQ07PzpLYg4Ijv65CfHVZMavtgg2AA1v38t8FlLrKV0O()
Main IL Instruction Count
109
Main IL 
ldsfld System.Int32 X6f15R07PVygiA7HAqZ1myzFVIGnT2j9FjBMAK8JXfhh3ndr5WVtqJAazcNy::RLq63ZbrAuX4ALIWmn6OYvvjc3gQVkgLAJMQy6yd6LIJEQf3UtX6lMwNjFtp
ldc.i4 1000
mul.ovf <null>
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldsfld System.String X6f15R07PVygiA7HAqZ1myzFVIGnT2j9FjBMAK8JXfhh3ndr5WVtqJAazcNy::uPkkf8Ejnc12vzYMBoEq3yI36bwtDgO4ylkIpHYQlz52gFaRSGAMdqxLTKcs
call System.Object Stub.7tohbIFIzTbPEtVASmFi5VFBkmR1CEy4foOqFmFn0XrhnsueKdAj000V1ERER8fF5Jk0uOWEN0vs9::JlOVr6glKgLWZYU02ItbNdkCDMiofWeICI2QuvtlBA1aO5mGNpUQrZWzTTdiR4D3CADj9wng5tgzd(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String X6f15R07PVygiA7HAqZ1myzFVIGnT2j9FjBMAK8JXfhh3ndr5WVtqJAazcNy::uPkkf8Ejnc12vzYMBoEq3yI36bwtDgO4ylkIpHYQlz52gFaRSGAMdqxLTKcs
ldsfld System.String X6f15R07PVygiA7HAqZ1myzFVIGnT2j9FjBMAK8JXfhh3ndr5WVtqJAazcNy::10PkgbLUAa60sJ0HqavOeh127otL0dXzSKljVQdop5ImIdPsRHeovOX7ZMdw
call System.Object Stub.7tohbIFIzTbPEtVASmFi5VFBkmR1CEy4foOqFmFn0XrhnsueKdAj000V1ERER8fF5Jk0uOWEN0vs9::JlOVr6glKgLWZYU02ItbNdkCDMiofWeICI2QuvtlBA1aO5mGNpUQrZWzTTdiR4D3CADj9wng5tgzd(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String X6f15R07PVygiA7HAqZ1myzFVIGnT2j9FjBMAK8JXfhh3ndr5WVtqJAazcNy::10PkgbLUAa60sJ0HqavOeh127otL0dXzSKljVQdop5ImIdPsRHeovOX7ZMdw
ldsfld System.String X6f15R07PVygiA7HAqZ1myzFVIGnT2j9FjBMAK8JXfhh3ndr5WVtqJAazcNy::kdQYEaNYc59yADH4Rt7UDT9dQSeZmyMuGZuW9OShNDky9XBNMiQpUt3ZKI6m
call System.Object Stub.7tohbIFIzTbPEtVASmFi5VFBkmR1CEy4foOqFmFn0XrhnsueKdAj000V1ERER8fF5Jk0uOWEN0vs9::JlOVr6glKgLWZYU02ItbNdkCDMiofWeICI2QuvtlBA1aO5mGNpUQrZWzTTdiR4D3CADj9wng5tgzd(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String X6f15R07PVygiA7HAqZ1myzFVIGnT2j9FjBMAK8JXfhh3ndr5WVtqJAazcNy::kdQYEaNYc59yADH4Rt7UDT9dQSeZmyMuGZuW9OShNDky9XBNMiQpUt3ZKI6m
ldsfld System.String X6f15R07PVygiA7HAqZ1myzFVIGnT2j9FjBMAK8JXfhh3ndr5WVtqJAazcNy::ThpmUAMSCjPLZkTCslmxWCXEzWfkNMxx5BO6jPjvgjeAjBBHRFFsRcLBC41E
call System.Object Stub.7tohbIFIzTbPEtVASmFi5VFBkmR1CEy4foOqFmFn0XrhnsueKdAj000V1ERER8fF5Jk0uOWEN0vs9::JlOVr6glKgLWZYU02ItbNdkCDMiofWeICI2QuvtlBA1aO5mGNpUQrZWzTTdiR4D3CADj9wng5tgzd(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String X6f15R07PVygiA7HAqZ1myzFVIGnT2j9FjBMAK8JXfhh3ndr5WVtqJAazcNy::ThpmUAMSCjPLZkTCslmxWCXEzWfkNMxx5BO6jPjvgjeAjBBHRFFsRcLBC41E
ldsfld System.String X6f15R07PVygiA7HAqZ1myzFVIGnT2j9FjBMAK8JXfhh3ndr5WVtqJAazcNy::zPRk8PPJh5myGlfGx6qR7CBECKnKxka4TbmlUrRkxc8nKoqqglloetn9aLDx
call System.Object Stub.7tohbIFIzTbPEtVASmFi5VFBkmR1CEy4foOqFmFn0XrhnsueKdAj000V1ERER8fF5Jk0uOWEN0vs9::JlOVr6glKgLWZYU02ItbNdkCDMiofWeICI2QuvtlBA1aO5mGNpUQrZWzTTdiR4D3CADj9wng5tgzd(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String X6f15R07PVygiA7HAqZ1myzFVIGnT2j9FjBMAK8JXfhh3ndr5WVtqJAazcNy::zPRk8PPJh5myGlfGx6qR7CBECKnKxka4TbmlUrRkxc8nKoqqglloetn9aLDx
ldsfld System.String X6f15R07PVygiA7HAqZ1myzFVIGnT2j9FjBMAK8JXfhh3ndr5WVtqJAazcNy::wwHsk4Gk9CO0lSSIEXcom6MALHjWHSDixIqBvpezQbgvaVYYgtexc9zrCDZ5
call System.Object Stub.7tohbIFIzTbPEtVASmFi5VFBkmR1CEy4foOqFmFn0XrhnsueKdAj000V1ERER8fF5Jk0uOWEN0vs9::JlOVr6glKgLWZYU02ItbNdkCDMiofWeICI2QuvtlBA1aO5mGNpUQrZWzTTdiR4D3CADj9wng5tgzd(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String X6f15R07PVygiA7HAqZ1myzFVIGnT2j9FjBMAK8JXfhh3ndr5WVtqJAazcNy::wwHsk4Gk9CO0lSSIEXcom6MALHjWHSDixIqBvpezQbgvaVYYgtexc9zrCDZ5
ldsfld System.String X6f15R07PVygiA7HAqZ1myzFVIGnT2j9FjBMAK8JXfhh3ndr5WVtqJAazcNy::FbxL8gQ9xzvzMWEf542bQlUQ4qEikOPfxN2pWC432mUyzFIVOvQmS46YTDsc
call System.Object Stub.7tohbIFIzTbPEtVASmFi5VFBkmR1CEy4foOqFmFn0XrhnsueKdAj000V1ERER8fF5Jk0uOWEN0vs9::JlOVr6glKgLWZYU02ItbNdkCDMiofWeICI2QuvtlBA1aO5mGNpUQrZWzTTdiR4D3CADj9wng5tgzd(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String X6f15R07PVygiA7HAqZ1myzFVIGnT2j9FjBMAK8JXfhh3ndr5WVtqJAazcNy::FbxL8gQ9xzvzMWEf542bQlUQ4qEikOPfxN2pWC432mUyzFIVOvQmS46YTDsc
leave.s IL_00B2: call System.Boolean Stub.CISSvtsBGC0g65eQC8hFEz80288Jhn4b76jzgNJDzTtgJR2W0VpfZjIwKCu1ttkGSXvaJjOVaPb3E::JTPVyUWsfBLUX9NDr5zZg6jkiPfgBeOsRDuRatkj2zcfTkg6f7fet4abpXjYE3()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.3 <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00B2: call System.Boolean Stub.CISSvtsBGC0g65eQC8hFEz80288Jhn4b76jzgNJDzTtgJR2W0VpfZjIwKCu1ttkGSXvaJjOVaPb3E::JTPVyUWsfBLUX9NDr5zZg6jkiPfgBeOsRDuRatkj2zcfTkg6f7fet4abpXjYE3()
call System.Boolean Stub.CISSvtsBGC0g65eQC8hFEz80288Jhn4b76jzgNJDzTtgJR2W0VpfZjIwKCu1ttkGSXvaJjOVaPb3E::JTPVyUWsfBLUX9NDr5zZg6jkiPfgBeOsRDuRatkj2zcfTkg6f7fet4abpXjYE3()
brtrue.s IL_00BF: call System.Void Stub.awjYcka0093Al7utN14hkCfZ6axWHQ4m1fJ2sl32WOFiH0SeUSoTUiDr6zlB::Bgg8722wBG7tafXjWtDSJrUt7Rtdptq1r9IzyPrg4p2MtotSWuMO0SpWQtzd()
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Stub.awjYcka0093Al7utN14hkCfZ6axWHQ4m1fJ2sl32WOFiH0SeUSoTUiDr6zlB::Bgg8722wBG7tafXjWtDSJrUt7Rtdptq1r9IzyPrg4p2MtotSWuMO0SpWQtzd()
leave.s IL_00D5: call System.Void Stub.awjYcka0093Al7utN14hkCfZ6axWHQ4m1fJ2sl32WOFiH0SeUSoTUiDr6zlB::TqUfx3xURNWHsS2zETEFMitixVeZ8043Bl4ZjUjaF4q95juMb4sExTpJGBpi()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_4
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00D5: call System.Void Stub.awjYcka0093Al7utN14hkCfZ6axWHQ4m1fJ2sl32WOFiH0SeUSoTUiDr6zlB::TqUfx3xURNWHsS2zETEFMitixVeZ8043Bl4ZjUjaF4q95juMb4sExTpJGBpi()
call System.Void Stub.awjYcka0093Al7utN14hkCfZ6axWHQ4m1fJ2sl32WOFiH0SeUSoTUiDr6zlB::TqUfx3xURNWHsS2zETEFMitixVeZ8043Bl4ZjUjaF4q95juMb4sExTpJGBpi()
ldsfld System.String X6f15R07PVygiA7HAqZ1myzFVIGnT2j9FjBMAK8JXfhh3ndr5WVtqJAazcNy::zPRk8PPJh5myGlfGx6qR7CBECKnKxka4TbmlUrRkxc8nKoqqglloetn9aLDx
call System.String Stub.awjYcka0093Al7utN14hkCfZ6axWHQ4m1fJ2sl32WOFiH0SeUSoTUiDr6zlB::5Da3PL5UkqbH2hIDZ0e7e3Gz28XYffy8qZWJzrPvPcHkYKUvJD9xx5PflZ9c(System.String)
stloc.0 <null>
ldloc.0 <null>
ldc.i4.1 <null>
newarr System.Char
stloc.s V_5
ldloc.s V_5
ldc.i4.0 <null>
ldc.i4.s 58
stelem.i2 <null>
ldloc.s V_5
callvirt System.String[] System.String::Split(System.Char[])
ldc.i4.0 <null>
ldelem.ref <null>
stsfld System.String X6f15R07PVygiA7HAqZ1myzFVIGnT2j9FjBMAK8JXfhh3ndr5WVtqJAazcNy::XXjPZ08aDm7a2NpZDfb6LcTexpBFLlw5SV8yfbABkCjGuEdW37d3JaEJihcT
ldloc.0 <null>
ldc.i4.1 <null>
newarr System.Char
stloc.s V_5
ldloc.s V_5
ldc.i4.0 <null>
ldc.i4.s 58
stelem.i2 <null>
ldloc.s V_5
callvirt System.String[] System.String::Split(System.Char[])
ldc.i4.1 <null>
ldelem.ref <null>
stsfld System.String X6f15R07PVygiA7HAqZ1myzFVIGnT2j9FjBMAK8JXfhh3ndr5WVtqJAazcNy::D340bvhmKPlK4ufrCUdOKGowAk326XGrOkAWFo2y0zH0zC1qaUkKxnFAkLqD
call System.Void Stub.CISSvtsBGC0g65eQC8hFEz80288Jhn4b76jzgNJDzTtgJR2W0VpfZjIwKCu1ttkGSXvaJjOVaPb3E::FLHk2H1WzdJYV3uYwxbGsDZAUnnxiJtyshuTE6ZyeuXlncYdwVfWKK5p20oe9h()
ldnull <null>
ldftn System.Void Stub.awjYcka0093Al7utN14hkCfZ6axWHQ4m1fJ2sl32WOFiH0SeUSoTUiDr6zlB::ePyfdgovM9UG8Yi8Ji34lXB2wx8MWqjzYkRMZZt2NUDoFQXlqmRAIAZv4TFK()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
callvirt System.Void System.Threading.Thread::Start()
call System.String Stub.ldSBkjss8rt3PKEBnsUEfHWNESI6NfppFJbkpsfmrN5pQeTGeRDL1O8BDzeH::pItkGlb6myT60CPEB9bW8PdQFnmlHYdini2aMMZFvkFI8QiUplzQ16mEtozp()
call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.String)
brfalse.s IL_014B: call System.Void Stub.awjYcka0093Al7utN14hkCfZ6axWHQ4m1fJ2sl32WOFiH0SeUSoTUiDr6zlB::gixfYvBKySfKU4ZFye4aPV67R4JU1RTHVpZFapV5hs84VWglFZ12ELCoQmOp()
call System.Void Stub.NRjTNy2Ucz7TdsuaWFnDmS9J9FwOQKqn20mccBffoGYo2p1AvJIczrjzdXtszBLZ2gsQU8I0OEK0I::NWyJrgjQwcDw8RgplIqkCUdru14jUCbv7RkmAqWD7DWqifnO36KvBPp3Saz2JyCF8zufgOuM0qCQo()
call System.Void Stub.awjYcka0093Al7utN14hkCfZ6axWHQ4m1fJ2sl32WOFiH0SeUSoTUiDr6zlB::gixfYvBKySfKU4ZFye4aPV67R4JU1RTHVpZFapV5hs84VWglFZ12ELCoQmOp()
ldnull <null>
ldftn System.Void Stub.awjYcka0093Al7utN14hkCfZ6axWHQ4m1fJ2sl32WOFiH0SeUSoTUiDr6zlB::eAR6M2rsLAjfwWtYWfFm0LC8Soc6UXquToC9JIfC8oIYvw4qc33x3hMi5Ftg()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.1 <null>
ldnull <null>
ldftn System.Void Stub.awjYcka0093Al7utN14hkCfZ6axWHQ4m1fJ2sl32WOFiH0SeUSoTUiDr6zlB::DCkwqt5LXfevKej73ZxgTRe4L8cR2qstBvcS3sBwMGLPuZD297889IHqVGA8()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.2 <null>
ldloc.1 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.2 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.2 <null>
callvirt System.Void System.Threading.Thread::Join()
ret <null>
Mutex MUTEXmalicious
c5D4Yhuhuhuhuhuhuhu
Pastebin URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
CnC CNCmalicious
MRhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙