Malicious
Malicious

accc992b82f7332df297b48a2c778301

PE Executable
MD5: accc992b82f7332df297b48a2c778301
Size: 828.42 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 accc992b82f7332df297b48a2c778301
Sha1 fc2d83d15c58843337d2b123bb489be398227f8d
Sha256 5e10c356f7a41764011d102094f4823f2dce439c5cd50c68c23e3328de9255dc
Sha384 ca9389868c863351921884c900f717936586be30fdde748e06f284d39f919c49fb2864e8fb47ad86e80da146fd98e4b2
Sha512 b05dab56f9afeaf787946615bd73f2647dd261e7b06625e734fc0a6b82e7200f3b270094bf2cc88e8ebe4c2e1481f5abd5a1f5c73cca4117e8239565fed96d1c
SSDeep 12288:D/KnaEY193a3z6dmuXKurBkarbYmkaO8QwHe8UeDe:DF3a3z60uXzkaQmZOLkeNeDe
TLSH 2C05BF2B72958F21C18A6772C2CF491093EA964736ABE70B758413D71D033FEEA06397
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
accc992b82f7332df297b48a2c778301
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
LKQQnmfUF35Mj4oo0d.jEuNUfU03QXLM9Awvn
nenWh7L1pTpURRF9l5.oDd0HrKaP7sVQ0R6yK
b4EUVyO05Wj2rWEk0I.b74UQrENLTgO7GHnkW
TxWT4KWSqMlOut3ueq.yS3RWBAQCpiG0ON6kg
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Mbsumkxdegf.exe
Full Name
Mbsumkxdegf.exe
EntryPoint
System.Void rRaeSIn005Qy1xKuyf.hbMgoMS2J5x91fC3fE::bNeMXUpsw()
Scope Name
Mbsumkxdegf.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Mbsumkxdegf
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void rRaeSIn005Qy1xKuyf.hbMgoMS2J5x91fC3fE::bNeMXUpsw()
Main IL Instruction Count
101
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_0038: ret
ret <null>
nop <null>
ldsfld dJDjVWSfaLhIugbFIfR dJDjVWSfaLhIugbFIfR::lFOSUF8X58
call System.Byte[] dJDjVWSfaLhIugbFIfR::IBCS3XYsg6(dJDjVWSfaLhIugbFIfR)
stloc.s V_3
ldc.i4 1
ldsfld <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454} <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_29a285cf4bd5419c930eda18a6befa17
ldfld System.Int32 <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_4852f1a8030f431e896a0903a060c4ea
brtrue IL_0077: switch(IL_0127,IL_0097)
pop <null>
ldc.i4 7
br IL_0077: switch(IL_0127,IL_0097)
br IL_0073: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_0073: ldloc V_2
br IL_0127: leave IL_0038
ldc.i4 932721789
ldc.i4 1941472499
add <null>
ldc.i4 -1037788206
xor <null>
ldsfld <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454} <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_29a285cf4bd5419c930eda18a6befa17
ldfld System.Int32 <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_0290345adfe9424381d4e9d62e0ad7d6
xor <null>
ldsfld cAMStJSSZDSAl0mEEZs cAMStJSSZDSAl0mEEZs::hjMSn5oyBS
call System.String cAMStJSSZDSAl0mEEZs::IBCS3XYsg6(System.Int32,cAMStJSSZDSAl0mEEZs)
ldc.i4 -710695454
ldc.i4 -547241583
add <null>
ldc.i4 -726401619
xor <null>
ldsfld <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454} <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_29a285cf4bd5419c930eda18a6befa17
ldfld System.Int32 <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_63f0d206ec724ca7a9f54111fd5f94e9
xor <null>
ldsfld cAMStJSSZDSAl0mEEZs cAMStJSSZDSAl0mEEZs::hjMSn5oyBS
call System.String cAMStJSSZDSAl0mEEZs::IBCS3XYsg6(System.Int32,cAMStJSSZDSAl0mEEZs)
newobj System.Void mMEp3YWmWwGZlT6XbdJ.rYj8K7W3CLIZNbOmqJ0::.ctor(System.String,System.String)
ldloc.s V_3
ldsfld MXnPdoSMKvmhggRLfwF MXnPdoSMKvmhggRLfwF::YrTSkqfN07
call mMEp3YWmWwGZlT6XbdJ.rYj8K7W3CLIZNbOmqJ0 MXnPdoSMKvmhggRLfwF::IBCS3XYsg6(System.Object,System.Byte[],MXnPdoSMKvmhggRLfwF)
ldsfld BpvdpCSx0dv3WmQv42l BpvdpCSx0dv3WmQv42l::KCDSRDkIcr
call mMEp3YWmWwGZlT6XbdJ.rYj8K7W3CLIZNbOmqJ0 BpvdpCSx0dv3WmQv42l::IBCS3XYsg6(System.Object,BpvdpCSx0dv3WmQv42l)
ldsfld CLwCVISQHPlvYxu8xS9 CLwCVISQHPlvYxu8xS9::hb1SgqYmiX
call System.Void CLwCVISQHPlvYxu8xS9::IBCS3XYsg6(System.Object,CLwCVISQHPlvYxu8xS9)
ldc.i4 0
ldsfld <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454} <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_29a285cf4bd5419c930eda18a6befa17
ldfld System.Int32 <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_aad5f67728a644bb890ce0ae90c7359d
brtrue IL_0077: switch(IL_0127,IL_0097)
pop <null>
ldc.i4 6
br IL_0077: switch(IL_0127,IL_0097)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454} <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_29a285cf4bd5419c930eda18a6befa17
ldfld System.Int32 <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_0372b97a1ba549e194b102b1d5c5a2f4
brfalse IL_015E: switch(IL_017A)
pop <null>
ldc.i4 4
br IL_015E: switch(IL_017A)
br IL_015A: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_015A: ldloc V_0
br IL_017A: leave IL_0038
leave IL_0038: ret
ldc.i4 3
ldsfld <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454} <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_29a285cf4bd5419c930eda18a6befa17
ldfld System.Int32 <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_6899f58062c54e57bbddd3fc6469d65f
brtrue IL_0014: switch(IL_0039,IL_019E,IL_0038)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0039,IL_019E,IL_0038)
ldsfld tXeF3bSLTjsNbSnhGWh tXeF3bSLTjsNbSnhGWh::C3nSKRUBgw
call System.Void tXeF3bSLTjsNbSnhGWh::IBCS3XYsg6(tXeF3bSLTjsNbSnhGWh)
ldc.i4 1
ldsfld <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454} <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_29a285cf4bd5419c930eda18a6befa17
ldfld System.Int32 <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_a3cca680390241978dabc483ba128bf8
brtrue IL_0014: switch(IL_0039,IL_019E,IL_0038)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0039,IL_019E,IL_0038)
Module Name
Mbsumkxdegf.exe
Full Name
Mbsumkxdegf.exe
EntryPoint
System.Void rRaeSIn005Qy1xKuyf.hbMgoMS2J5x91fC3fE::bNeMXUpsw()
Scope Name
Mbsumkxdegf.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Mbsumkxdegf
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void rRaeSIn005Qy1xKuyf.hbMgoMS2J5x91fC3fE::bNeMXUpsw()
Main IL Instruction Count
101
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_0038: ret
ret <null>
nop <null>
ldsfld dJDjVWSfaLhIugbFIfR dJDjVWSfaLhIugbFIfR::lFOSUF8X58
call System.Byte[] dJDjVWSfaLhIugbFIfR::IBCS3XYsg6(dJDjVWSfaLhIugbFIfR)
stloc.s V_3
ldc.i4 1
ldsfld <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454} <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_29a285cf4bd5419c930eda18a6befa17
ldfld System.Int32 <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_4852f1a8030f431e896a0903a060c4ea
brtrue IL_0077: switch(IL_0127,IL_0097)
pop <null>
ldc.i4 7
br IL_0077: switch(IL_0127,IL_0097)
br IL_0073: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_0073: ldloc V_2
br IL_0127: leave IL_0038
ldc.i4 932721789
ldc.i4 1941472499
add <null>
ldc.i4 -1037788206
xor <null>
ldsfld <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454} <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_29a285cf4bd5419c930eda18a6befa17
ldfld System.Int32 <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_0290345adfe9424381d4e9d62e0ad7d6
xor <null>
ldsfld cAMStJSSZDSAl0mEEZs cAMStJSSZDSAl0mEEZs::hjMSn5oyBS
call System.String cAMStJSSZDSAl0mEEZs::IBCS3XYsg6(System.Int32,cAMStJSSZDSAl0mEEZs)
ldc.i4 -710695454
ldc.i4 -547241583
add <null>
ldc.i4 -726401619
xor <null>
ldsfld <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454} <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_29a285cf4bd5419c930eda18a6befa17
ldfld System.Int32 <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_63f0d206ec724ca7a9f54111fd5f94e9
xor <null>
ldsfld cAMStJSSZDSAl0mEEZs cAMStJSSZDSAl0mEEZs::hjMSn5oyBS
call System.String cAMStJSSZDSAl0mEEZs::IBCS3XYsg6(System.Int32,cAMStJSSZDSAl0mEEZs)
newobj System.Void mMEp3YWmWwGZlT6XbdJ.rYj8K7W3CLIZNbOmqJ0::.ctor(System.String,System.String)
ldloc.s V_3
ldsfld MXnPdoSMKvmhggRLfwF MXnPdoSMKvmhggRLfwF::YrTSkqfN07
call mMEp3YWmWwGZlT6XbdJ.rYj8K7W3CLIZNbOmqJ0 MXnPdoSMKvmhggRLfwF::IBCS3XYsg6(System.Object,System.Byte[],MXnPdoSMKvmhggRLfwF)
ldsfld BpvdpCSx0dv3WmQv42l BpvdpCSx0dv3WmQv42l::KCDSRDkIcr
call mMEp3YWmWwGZlT6XbdJ.rYj8K7W3CLIZNbOmqJ0 BpvdpCSx0dv3WmQv42l::IBCS3XYsg6(System.Object,BpvdpCSx0dv3WmQv42l)
ldsfld CLwCVISQHPlvYxu8xS9 CLwCVISQHPlvYxu8xS9::hb1SgqYmiX
call System.Void CLwCVISQHPlvYxu8xS9::IBCS3XYsg6(System.Object,CLwCVISQHPlvYxu8xS9)
ldc.i4 0
ldsfld <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454} <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_29a285cf4bd5419c930eda18a6befa17
ldfld System.Int32 <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_aad5f67728a644bb890ce0ae90c7359d
brtrue IL_0077: switch(IL_0127,IL_0097)
pop <null>
ldc.i4 6
br IL_0077: switch(IL_0127,IL_0097)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454} <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_29a285cf4bd5419c930eda18a6befa17
ldfld System.Int32 <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_0372b97a1ba549e194b102b1d5c5a2f4
brfalse IL_015E: switch(IL_017A)
pop <null>
ldc.i4 4
br IL_015E: switch(IL_017A)
br IL_015A: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_015A: ldloc V_0
br IL_017A: leave IL_0038
leave IL_0038: ret
ldc.i4 3
ldsfld <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454} <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_29a285cf4bd5419c930eda18a6befa17
ldfld System.Int32 <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_6899f58062c54e57bbddd3fc6469d65f
brtrue IL_0014: switch(IL_0039,IL_019E,IL_0038)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0039,IL_019E,IL_0038)
ldsfld tXeF3bSLTjsNbSnhGWh tXeF3bSLTjsNbSnhGWh::C3nSKRUBgw
call System.Void tXeF3bSLTjsNbSnhGWh::IBCS3XYsg6(tXeF3bSLTjsNbSnhGWh)
ldc.i4 1
ldsfld <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454} <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_29a285cf4bd5419c930eda18a6befa17
ldfld System.Int32 <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_a3cca680390241978dabc483ba128bf8
brtrue IL_0014: switch(IL_0039,IL_019E,IL_0038)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0039,IL_019E,IL_0038)
accc992b82f7332df297b48a2c778301
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
LKQQnmfUF35Mj4oo0d.jEuNUfU03QXLM9Awvn
nenWh7L1pTpURRF9l5.oDd0HrKaP7sVQ0R6yK
b4EUVyO05Wj2rWEk0I.b74UQrENLTgO7GHnkW
TxWT4KWSqMlOut3ueq.yS3RWBAQCpiG0ON6kg
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙