Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
PeID
.NET executableMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual Studio .NET
abbc9fb34643c124573d9f1c865f3f5d
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Config. Field Value
family xhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Lukas_XWormClient 7.2 .exe
Full Name
Lukas_XWormClient 7.2 .exe
EntryPoint
System.Void Stub.Main::Main()
Scope Name
Lukas_XWormClient 7.2 .exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Lukas_XWormClient 7.2
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
0
Main Method
System.Void Stub.Main::Main()
Main IL Instruction Count
126
Main IL 
ldsfld System.Int32 Settings::Sleep
ldc.i4 1000
mul.ovf <null>
ldc.i4 675
ldc.i4 721
call System.Void My.MyApplication::Ⴗ(System.Int32,System.Int32,System.Char)
ldc.i4.2 <null>
stloc.s V_4
ldloc.s V_4
switch dnlib.DotNet.Emit.Instruction[]
ldsfld System.String Settings::Hosts
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 356
ldc.i4 292
call System.String My.MyComputer::Ⴐ<System.Object>(System.Object,System.Int32,System.Char)
stsfld System.String Settings::Hosts
ldsfld System.String Settings::Port
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 694
ldc.i4 758
call System.String My.MyComputer::Ⴐ<System.Object>(System.Object,System.Int32,System.Char)
stsfld System.String Settings::Port
ldc.i4.5 <null>
stloc.s V_4
br.s IL_001D: ldloc.s V_4
ldsfld System.String Settings::KEY
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 868
ldc.i4 804
call System.String My.MyComputer::Ⴐ<System.Object>(System.Object,System.Int32,System.Char)
stsfld System.String Settings::KEY
ldsfld System.String Settings::SPL
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 855
ldc.i4 791
call System.String My.MyComputer::Ⴐ<System.Object>(System.Object,System.Int32,System.Char)
stsfld System.String Settings::SPL
ldc.i4.0 <null>
stloc.s V_4
br IL_001D: ldloc.s V_4
ldsfld System.String Settings::Groub
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 170
ldc.i4 234
call System.String My.MyComputer::Ⴐ<System.Object>(System.Object,System.Int32,System.Char)
stsfld System.String Settings::Groub
ldsfld System.String Settings::USBNM
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 854
ldc.i4 790
call System.String My.MyComputer::Ⴐ<System.Object>(System.Object,System.Int32,System.Char)
stsfld System.String Settings::USBNM
leave.s IL_012F: ldc.i4.7
dup <null>
ldc.i4 149
ldc.i4 199
call System.Void My.MyApplication/Ⴍ::Ⴀ<System.Exception>(System.Exception,System.Int32,System.Char)
stloc.2 <null>
ldc.i4.0 <null>
ldc.i4.s 19
ldc.i4.s 96
call System.Void My.MyApplication::Ⴗ(System.Int32,System.Int32,System.Char)
ldc.i4 634
ldc.i4 565
call System.Void My.MyApplication/Ⴍ::Ⴓ(System.Int32,System.Int16)
leave.s IL_012F: ldc.i4.7
ldc.i4.7 <null>
stloc.s V_6
ldloc.s V_6
switch dnlib.DotNet.Emit.Instruction[]
call System.Boolean Ⴐ.Ⴓ::Ⴈ()
brtrue.s IL_0169: ldc.i4.8
ldc.i4.5 <null>
stloc.s V_6
br.s IL_0132: ldloc.s V_6
ldc.i4.8 <null>
br.s IL_0165: stloc.s V_6
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Ⴐ.Ⴓ::Ⴀ()
ldnull <null>
ldftn System.Void Stub.Main::_Lambda$__1()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
callvirt System.Void System.Threading.Thread::Start()
ldnull <null>
ldftn System.Void Stub.Main::_Lambda$__2()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.0 <null>
ldc.i4.0 <null>
stloc.s V_6
br.s IL_0132: ldloc.s V_6
ldnull <null>
ldftn System.Void Stub.Main::_Lambda$__3()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.1 <null>
ldloc.0 <null>
castclass System.Threading.Thread
callvirt System.Void System.Threading.Thread::Start()
ldloc.1 <null>
castclass System.Threading.Thread
callvirt System.Void System.Threading.Thread::Start()
ldc.i4.1 <null>
stloc.s V_6
br IL_0132: ldloc.s V_6
ldloc.1 <null>
isinst System.Threading.Thread
callvirt System.Void System.Threading.Thread::Join()
ret <null>
ldtoken System.Void Stub.Main::Main()
pop <null>
ldsfld System.Byte[] Stub.AlgorithmAES::Ⴄ
ldc.i4 584
ldsfld System.Byte[] Stub.AlgorithmAES::Ⴄ
ldc.i4 584
ldelem.u1 <null>
ldsfld System.Byte[] Stub.AlgorithmAES::Ⴄ
ldc.i4.2 <null>
ldelem.u1 <null>
and <null>
ldc.i4.s 112
and <null>
stelem.i1 <null>
ret <null>
Module Name
Lukas_XWormClient 7.2 .exe
Full Name
Lukas_XWormClient 7.2 .exe
EntryPoint
System.Void Stub.Main::Main()
Scope Name
Lukas_XWormClient 7.2 .exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Lukas_XWormClient 7.2
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
0
Main Method
System.Void Stub.Main::Main()
Main IL Instruction Count
126
Main IL 
ldsfld System.Int32 Settings::Sleep
ldc.i4 1000
mul.ovf <null>
ldc.i4 675
ldc.i4 721
call System.Void My.MyApplication::Ⴗ(System.Int32,System.Int32,System.Char)
ldc.i4.2 <null>
stloc.s V_4
ldloc.s V_4
switch dnlib.DotNet.Emit.Instruction[]
ldsfld System.String Settings::Hosts
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 356
ldc.i4 292
call System.String My.MyComputer::Ⴐ<System.Object>(System.Object,System.Int32,System.Char)
stsfld System.String Settings::Hosts
ldsfld System.String Settings::Port
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 694
ldc.i4 758
call System.String My.MyComputer::Ⴐ<System.Object>(System.Object,System.Int32,System.Char)
stsfld System.String Settings::Port
ldc.i4.5 <null>
stloc.s V_4
br.s IL_001D: ldloc.s V_4
ldsfld System.String Settings::KEY
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 868
ldc.i4 804
call System.String My.MyComputer::Ⴐ<System.Object>(System.Object,System.Int32,System.Char)
stsfld System.String Settings::KEY
ldsfld System.String Settings::SPL
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 855
ldc.i4 791
call System.String My.MyComputer::Ⴐ<System.Object>(System.Object,System.Int32,System.Char)
stsfld System.String Settings::SPL
ldc.i4.0 <null>
stloc.s V_4
br IL_001D: ldloc.s V_4
ldsfld System.String Settings::Groub
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 170
ldc.i4 234
call System.String My.MyComputer::Ⴐ<System.Object>(System.Object,System.Int32,System.Char)
stsfld System.String Settings::Groub
ldsfld System.String Settings::USBNM
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 854
ldc.i4 790
call System.String My.MyComputer::Ⴐ<System.Object>(System.Object,System.Int32,System.Char)
stsfld System.String Settings::USBNM
leave.s IL_012F: ldc.i4.7
dup <null>
ldc.i4 149
ldc.i4 199
call System.Void My.MyApplication/Ⴍ::Ⴀ<System.Exception>(System.Exception,System.Int32,System.Char)
stloc.2 <null>
ldc.i4.0 <null>
ldc.i4.s 19
ldc.i4.s 96
call System.Void My.MyApplication::Ⴗ(System.Int32,System.Int32,System.Char)
ldc.i4 634
ldc.i4 565
call System.Void My.MyApplication/Ⴍ::Ⴓ(System.Int32,System.Int16)
leave.s IL_012F: ldc.i4.7
ldc.i4.7 <null>
stloc.s V_6
ldloc.s V_6
switch dnlib.DotNet.Emit.Instruction[]
call System.Boolean Ⴐ.Ⴓ::Ⴈ()
brtrue.s IL_0169: ldc.i4.8
ldc.i4.5 <null>
stloc.s V_6
br.s IL_0132: ldloc.s V_6
ldc.i4.8 <null>
br.s IL_0165: stloc.s V_6
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Ⴐ.Ⴓ::Ⴀ()
ldnull <null>
ldftn System.Void Stub.Main::_Lambda$__1()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
callvirt System.Void System.Threading.Thread::Start()
ldnull <null>
ldftn System.Void Stub.Main::_Lambda$__2()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.0 <null>
ldc.i4.0 <null>
stloc.s V_6
br.s IL_0132: ldloc.s V_6
ldnull <null>
ldftn System.Void Stub.Main::_Lambda$__3()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.1 <null>
ldloc.0 <null>
castclass System.Threading.Thread
callvirt System.Void System.Threading.Thread::Start()
ldloc.1 <null>
castclass System.Threading.Thread
callvirt System.Void System.Threading.Thread::Start()
ldc.i4.1 <null>
stloc.s V_6
br IL_0132: ldloc.s V_6
ldloc.1 <null>
isinst System.Threading.Thread
callvirt System.Void System.Threading.Thread::Join()
ret <null>
ldtoken System.Void Stub.Main::Main()
pop <null>
ldsfld System.Byte[] Stub.AlgorithmAES::Ⴄ
ldc.i4 584
ldsfld System.Byte[] Stub.AlgorithmAES::Ⴄ
ldc.i4 584
ldelem.u1 <null>
ldsfld System.Byte[] Stub.AlgorithmAES::Ⴄ
ldc.i4.2 <null>
ldelem.u1 <null>
and <null>
ldc.i4.s 112
and <null>
stelem.i1 <null>
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙