Malicious
Malicious

accc992b82f7332df297b48a2c778301

Share on LinkedIn
Print
PE Executable
MD5: accc992b82f7332df297b48a2c778301
Size: 828.42 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 accc992b82f7332df297b48a2c778301
Sha1 fc2d83d15c58843337d2b123bb489be398227f8d
Sha256 5e10c356f7a41764011d102094f4823f2dce439c5cd50c68c23e3328de9255dc
Sha384 ca9389868c863351921884c900f717936586be30fdde748e06f284d39f919c49fb2864e8fb47ad86e80da146fd98e4b2
Sha512 b05dab56f9afeaf787946615bd73f2647dd261e7b06625e734fc0a6b82e7200f3b270094bf2cc88e8ebe4c2e1481f5abd5a1f5c73cca4117e8239565fed96d1c
SSDeep 12288:D/KnaEY193a3z6dmuXKurBkarbYmkaO8QwHe8UeDe:DF3a3z60uXzkaQmZOLkeNeDe
TLSH 2C05BF2B72958F21C18A6772C2CF491093EA964736ABE70B758413D71D033FEEA06397
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
accc992b82f7332df297b48a2c778301
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
LKQQnmfUF35Mj4oo0d.jEuNUfU03QXLM9Awvn
nenWh7L1pTpURRF9l5.oDd0HrKaP7sVQ0R6yK
b4EUVyO05Wj2rWEk0I.b74UQrENLTgO7GHnkW
TxWT4KWSqMlOut3ueq.yS3RWBAQCpiG0ON6kg
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Mbsumkxdegf.exe
Full Name
Mbsumkxdegf.exe
EntryPoint
System.Void rRaeSIn005Qy1xKuyf.hbMgoMS2J5x91fC3fE::bNeMXUpsw()
Scope Name
Mbsumkxdegf.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Mbsumkxdegf
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void rRaeSIn005Qy1xKuyf.hbMgoMS2J5x91fC3fE::bNeMXUpsw()
Main IL Instruction Count
101
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_0038: ret
ret <null>
nop <null>
ldsfld dJDjVWSfaLhIugbFIfR dJDjVWSfaLhIugbFIfR::lFOSUF8X58
call System.Byte[] dJDjVWSfaLhIugbFIfR::IBCS3XYsg6(dJDjVWSfaLhIugbFIfR)
stloc.s V_3
ldc.i4 1
ldsfld <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454} <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_29a285cf4bd5419c930eda18a6befa17
ldfld System.Int32 <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_4852f1a8030f431e896a0903a060c4ea
brtrue IL_0077: switch(IL_0127,IL_0097)
pop <null>
ldc.i4 7
br IL_0077: switch(IL_0127,IL_0097)
br IL_0073: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_0073: ldloc V_2
br IL_0127: leave IL_0038
ldc.i4 932721789
ldc.i4 1941472499
add <null>
ldc.i4 -1037788206
xor <null>
ldsfld <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454} <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_29a285cf4bd5419c930eda18a6befa17
ldfld System.Int32 <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_0290345adfe9424381d4e9d62e0ad7d6
xor <null>
ldsfld cAMStJSSZDSAl0mEEZs cAMStJSSZDSAl0mEEZs::hjMSn5oyBS
call System.String cAMStJSSZDSAl0mEEZs::IBCS3XYsg6(System.Int32,cAMStJSSZDSAl0mEEZs)
ldc.i4 -710695454
ldc.i4 -547241583
add <null>
ldc.i4 -726401619
xor <null>
ldsfld <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454} <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_29a285cf4bd5419c930eda18a6befa17
ldfld System.Int32 <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_63f0d206ec724ca7a9f54111fd5f94e9
xor <null>
ldsfld cAMStJSSZDSAl0mEEZs cAMStJSSZDSAl0mEEZs::hjMSn5oyBS
call System.String cAMStJSSZDSAl0mEEZs::IBCS3XYsg6(System.Int32,cAMStJSSZDSAl0mEEZs)
newobj System.Void mMEp3YWmWwGZlT6XbdJ.rYj8K7W3CLIZNbOmqJ0::.ctor(System.String,System.String)
ldloc.s V_3
ldsfld MXnPdoSMKvmhggRLfwF MXnPdoSMKvmhggRLfwF::YrTSkqfN07
call mMEp3YWmWwGZlT6XbdJ.rYj8K7W3CLIZNbOmqJ0 MXnPdoSMKvmhggRLfwF::IBCS3XYsg6(System.Object,System.Byte[],MXnPdoSMKvmhggRLfwF)
ldsfld BpvdpCSx0dv3WmQv42l BpvdpCSx0dv3WmQv42l::KCDSRDkIcr
call mMEp3YWmWwGZlT6XbdJ.rYj8K7W3CLIZNbOmqJ0 BpvdpCSx0dv3WmQv42l::IBCS3XYsg6(System.Object,BpvdpCSx0dv3WmQv42l)
ldsfld CLwCVISQHPlvYxu8xS9 CLwCVISQHPlvYxu8xS9::hb1SgqYmiX
call System.Void CLwCVISQHPlvYxu8xS9::IBCS3XYsg6(System.Object,CLwCVISQHPlvYxu8xS9)
ldc.i4 0
ldsfld <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454} <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_29a285cf4bd5419c930eda18a6befa17
ldfld System.Int32 <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_aad5f67728a644bb890ce0ae90c7359d
brtrue IL_0077: switch(IL_0127,IL_0097)
pop <null>
ldc.i4 6
br IL_0077: switch(IL_0127,IL_0097)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454} <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_29a285cf4bd5419c930eda18a6befa17
ldfld System.Int32 <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_0372b97a1ba549e194b102b1d5c5a2f4
brfalse IL_015E: switch(IL_017A)
pop <null>
ldc.i4 4
br IL_015E: switch(IL_017A)
br IL_015A: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_015A: ldloc V_0
br IL_017A: leave IL_0038
leave IL_0038: ret
ldc.i4 3
ldsfld <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454} <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_29a285cf4bd5419c930eda18a6befa17
ldfld System.Int32 <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_6899f58062c54e57bbddd3fc6469d65f
brtrue IL_0014: switch(IL_0039,IL_019E,IL_0038)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0039,IL_019E,IL_0038)
ldsfld tXeF3bSLTjsNbSnhGWh tXeF3bSLTjsNbSnhGWh::C3nSKRUBgw
call System.Void tXeF3bSLTjsNbSnhGWh::IBCS3XYsg6(tXeF3bSLTjsNbSnhGWh)
ldc.i4 1
ldsfld <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454} <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_29a285cf4bd5419c930eda18a6befa17
ldfld System.Int32 <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_a3cca680390241978dabc483ba128bf8
brtrue IL_0014: switch(IL_0039,IL_019E,IL_0038)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0039,IL_019E,IL_0038)
Module Name
Mbsumkxdegf.exe
Full Name
Mbsumkxdegf.exe
EntryPoint
System.Void rRaeSIn005Qy1xKuyf.hbMgoMS2J5x91fC3fE::bNeMXUpsw()
Scope Name
Mbsumkxdegf.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Mbsumkxdegf
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void rRaeSIn005Qy1xKuyf.hbMgoMS2J5x91fC3fE::bNeMXUpsw()
Main IL Instruction Count
101
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_0038: ret
ret <null>
nop <null>
ldsfld dJDjVWSfaLhIugbFIfR dJDjVWSfaLhIugbFIfR::lFOSUF8X58
call System.Byte[] dJDjVWSfaLhIugbFIfR::IBCS3XYsg6(dJDjVWSfaLhIugbFIfR)
stloc.s V_3
ldc.i4 1
ldsfld <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454} <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_29a285cf4bd5419c930eda18a6befa17
ldfld System.Int32 <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_4852f1a8030f431e896a0903a060c4ea
brtrue IL_0077: switch(IL_0127,IL_0097)
pop <null>
ldc.i4 7
br IL_0077: switch(IL_0127,IL_0097)
br IL_0073: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_0073: ldloc V_2
br IL_0127: leave IL_0038
ldc.i4 932721789
ldc.i4 1941472499
add <null>
ldc.i4 -1037788206
xor <null>
ldsfld <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454} <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_29a285cf4bd5419c930eda18a6befa17
ldfld System.Int32 <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_0290345adfe9424381d4e9d62e0ad7d6
xor <null>
ldsfld cAMStJSSZDSAl0mEEZs cAMStJSSZDSAl0mEEZs::hjMSn5oyBS
call System.String cAMStJSSZDSAl0mEEZs::IBCS3XYsg6(System.Int32,cAMStJSSZDSAl0mEEZs)
ldc.i4 -710695454
ldc.i4 -547241583
add <null>
ldc.i4 -726401619
xor <null>
ldsfld <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454} <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_29a285cf4bd5419c930eda18a6befa17
ldfld System.Int32 <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_63f0d206ec724ca7a9f54111fd5f94e9
xor <null>
ldsfld cAMStJSSZDSAl0mEEZs cAMStJSSZDSAl0mEEZs::hjMSn5oyBS
call System.String cAMStJSSZDSAl0mEEZs::IBCS3XYsg6(System.Int32,cAMStJSSZDSAl0mEEZs)
newobj System.Void mMEp3YWmWwGZlT6XbdJ.rYj8K7W3CLIZNbOmqJ0::.ctor(System.String,System.String)
ldloc.s V_3
ldsfld MXnPdoSMKvmhggRLfwF MXnPdoSMKvmhggRLfwF::YrTSkqfN07
call mMEp3YWmWwGZlT6XbdJ.rYj8K7W3CLIZNbOmqJ0 MXnPdoSMKvmhggRLfwF::IBCS3XYsg6(System.Object,System.Byte[],MXnPdoSMKvmhggRLfwF)
ldsfld BpvdpCSx0dv3WmQv42l BpvdpCSx0dv3WmQv42l::KCDSRDkIcr
call mMEp3YWmWwGZlT6XbdJ.rYj8K7W3CLIZNbOmqJ0 BpvdpCSx0dv3WmQv42l::IBCS3XYsg6(System.Object,BpvdpCSx0dv3WmQv42l)
ldsfld CLwCVISQHPlvYxu8xS9 CLwCVISQHPlvYxu8xS9::hb1SgqYmiX
call System.Void CLwCVISQHPlvYxu8xS9::IBCS3XYsg6(System.Object,CLwCVISQHPlvYxu8xS9)
ldc.i4 0
ldsfld <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454} <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_29a285cf4bd5419c930eda18a6befa17
ldfld System.Int32 <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_aad5f67728a644bb890ce0ae90c7359d
brtrue IL_0077: switch(IL_0127,IL_0097)
pop <null>
ldc.i4 6
br IL_0077: switch(IL_0127,IL_0097)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454} <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_29a285cf4bd5419c930eda18a6befa17
ldfld System.Int32 <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_0372b97a1ba549e194b102b1d5c5a2f4
brfalse IL_015E: switch(IL_017A)
pop <null>
ldc.i4 4
br IL_015E: switch(IL_017A)
br IL_015A: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_015A: ldloc V_0
br IL_017A: leave IL_0038
leave IL_0038: ret
ldc.i4 3
ldsfld <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454} <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_29a285cf4bd5419c930eda18a6befa17
ldfld System.Int32 <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_6899f58062c54e57bbddd3fc6469d65f
brtrue IL_0014: switch(IL_0039,IL_019E,IL_0038)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0039,IL_019E,IL_0038)
ldsfld tXeF3bSLTjsNbSnhGWh tXeF3bSLTjsNbSnhGWh::C3nSKRUBgw
call System.Void tXeF3bSLTjsNbSnhGWh::IBCS3XYsg6(tXeF3bSLTjsNbSnhGWh)
ldc.i4 1
ldsfld <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454} <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_29a285cf4bd5419c930eda18a6befa17
ldfld System.Int32 <Module>{3a42020c-0636-4e11-992c-d9cccb7bd454}::m_a3cca680390241978dabc483ba128bf8
brtrue IL_0014: switch(IL_0039,IL_019E,IL_0038)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0039,IL_019E,IL_0038)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙