Malicious
Malicious

b304986e947fe26a40e454426d90ef50

PE Executable
MD5: b304986e947fe26a40e454426d90ef50
Size: 25.6 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 b304986e947fe26a40e454426d90ef50
Sha1 828815848f201886f9c5536ac02414ac68772f84
Sha256 838512a8a88f584a5d9a61cff17da0db7fa5886cccce2f84652ccb6e7808b090
Sha384 bbc7e40b4f0e6fb9ff816a1873ad752dcd82845dd1ad0bedb6bd19c93848899396643eac9e69b93d5a7970603acd1629
Sha512 9ca687a394fdebf327f0acc01f237db14873747aa4b5f960ee709a836e5a0e03d0a54eb9c460112a0b2b0b292b1119d4f798351b92750346239c7db3b89491e5
SSDeep 768:00JFBkiy09oeEIl1RGlmiTU94iGCK/XBLK:/Jd9oeEC1RGgb9BGB/xLK
TLSH 77B25A09776C8766EA69CABFC8E2E91043F1D2E31423DA5FB48D236A1E437C4CB42745
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
b304986e947fe26a40e454426d90ef50
Malicious
.Net Resources
RemoteLibUpdater.g.resources
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Module Name
RemoteLibUpdater.exe
Full Name
RemoteLibUpdater.exe
EntryPoint
System.Void SearchExplorer.Program::Main(System.String[])
Scope Name
RemoteLibUpdater.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
RemoteLibUpdater
Assembly Version
1.0.3.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
9
Main Method
System.Void SearchExplorer.Program::Main(System.String[])
Main IL Instruction Count
150
Main IL 
br IL_0006: nop
ret <null>
nop <null>
call System.String System.IO.Directory::GetCurrentDirectory()
stloc.s V_0
br IL_018C: call System.String[] System.Environment::GetCommandLineArgs()
br IL_0021: ldloc V_7
ldc.i4 0
stloc V_7
ldloc V_7
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_7
ldc.i4 989
beq IL_0021: ldloc V_7
br IL_008D: ldloc.s V_0
newobj System.Void System.Collections.Generic.List`1<System.String>::.ctor()
stloc.s V_1
br IL_0179: ldarg.0
ldc.i4.0 <null>
stloc.s V_4
br IL_0069: br IL_0198
nop <null>
br IL_00CD: nop
br IL_0204: leave IL_0005
br IL_0059: nop
br IL_0198: ldloc.s V_4
ldc.i4 4
ldsfld <Module>{4936b039-cabc-4278-9eed-59a1d17ceb06} <Module>{4936b039-cabc-4278-9eed-59a1d17ceb06}::m_41bf211440ad4219b591438f3548a883
ldfld System.Int32 <Module>{4936b039-cabc-4278-9eed-59a1d17ceb06}::m_555d9b0ebc044b3880d71134fdb9866f
brfalse IL_0025: switch(IL_008D,IL_01D3)
pop <null>
ldc.i4 1
br IL_0025: switch(IL_008D,IL_01D3)
ldloc.s V_0
ldloc.s V_1
call SearchExplorer.Conditions SearchExplorer.Program::CheckConditions(System.String,System.Collections.Generic.List`1<System.String>)
stloc.s V_2
br IL_009D: ldloc.s V_2
ldloc.s V_2
ldfld System.Boolean SearchExplorer.Conditions::argument
brfalse IL_0059: nop
br IL_01C2: ldloc.s V_2
ldsfld System.Action SearchExplorer.Program/<>c::<>9__0_0
dup <null>
brtrue IL_01F5: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
br IL_01DF: ldsfld SearchExplorer.Program/<>c SearchExplorer.Program/<>c::<>9
ldloc.s V_1
ldloc.s V_5
callvirt System.Void System.Collections.Generic.List`1<System.String>::Add(System.String)
br IL_0181: ldloc.s V_4
nop <null>
ldsfld System.Action SearchExplorer.Program/<>c::<>9__0_1
dup <null>
brtrue IL_0136: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
br IL_0120: ldsfld SearchExplorer.Program/<>c SearchExplorer.Program/<>c::<>9
nop <null>
ldc.i4.2 <null>
newarr System.Threading.Tasks.Task
dup <null>
ldc.i4.0 <null>
ldloc.s V_6
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
ldloc.s V_8
stelem.ref <null>
call System.Void System.Threading.Tasks.Task::WaitAll(System.Threading.Tasks.Task[])
br IL_00FA: leave IL_0164
leave IL_0164: leave IL_0204
pop <null>
br IL_0105: leave IL_0164
leave IL_0164: leave IL_0204
br IL_0164: leave IL_0204
ldsfld System.Action SearchExplorer.Program/<>c::<>9__0_2
dup <null>
brtrue IL_0158: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
br IL_0142: ldsfld SearchExplorer.Program/<>c SearchExplorer.Program/<>c::<>9
ldsfld SearchExplorer.Program/<>c SearchExplorer.Program/<>c::<>9
ldftn System.Void SearchExplorer.Program/<>c::<Main>b__0_1()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action SearchExplorer.Program/<>c::<>9__0_1
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
stloc.s V_6
br IL_010F: ldsfld System.Action SearchExplorer.Program/<>c::<>9__0_2
ldsfld SearchExplorer.Program/<>c SearchExplorer.Program/<>c::<>9
ldftn System.Void SearchExplorer.Program/<>c::<Main>b__0_2()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action SearchExplorer.Program/<>c::<>9__0_2
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
stloc.s V_8
br IL_00DF: nop
leave IL_0204: leave IL_0005
pop <null>
br IL_016F: leave IL_0204
leave IL_0204: leave IL_0005
br IL_0204: leave IL_0005
ldarg.0 <null>
stloc.s V_3
br IL_0051: ldc.i4.0
ldloc.s V_4
ldc.i4.1 <null>
add <null>
stloc.s V_4
br IL_0198: ldloc.s V_4
call System.String[] System.Environment::GetCommandLineArgs()
starg.s args
br IL_0045: newobj System.Void System.Collections.Generic.List`1<System.String>::.ctor()
ldloc.s V_4
ldloc.s V_3
ldlen <null>
conv.i4 <null>
blt IL_01D3: ldloc.s V_3
ldc.i4 0
ldsfld <Module>{4936b039-cabc-4278-9eed-59a1d17ceb06} <Module>{4936b039-cabc-4278-9eed-59a1d17ceb06}::m_41bf211440ad4219b591438f3548a883
ldfld System.Int32 <Module>{4936b039-cabc-4278-9eed-59a1d17ceb06}::m_5c037671801f4de28d1a33b5f690e054
brfalse IL_0025: switch(IL_008D,IL_01D3)
pop <null>
ldc.i4 5
br IL_0025: switch(IL_008D,IL_01D3)
ldloc.s V_2
ldfld System.Boolean SearchExplorer.Conditions::sysemdirectory
brfalse IL_0059: nop
br IL_00AE: ldsfld System.Action SearchExplorer.Program/<>c::<>9__0_0
ldloc.s V_3
ldloc.s V_4
ldelem.ref <null>
stloc.s V_5
br IL_00BF: ldloc.s V_1
ldsfld SearchExplorer.Program/<>c SearchExplorer.Program/<>c::<>9
ldftn System.Void SearchExplorer.Program/<>c::<Main>b__0_0()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action SearchExplorer.Program/<>c::<>9__0_0
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
callvirt System.Void System.Threading.Tasks.Task::Wait()
br IL_005F: br IL_0204
leave IL_0005: ret
callvirt System.String System.Object::ToString()
call System.Void System.Console::WriteLine(System.String)
br IL_0218: ldc.i4.0
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
br IL_0223: leave IL_0005
leave IL_0005: ret
br IL_0005: ret
Info
PE Detect: PeReader OK (file layout)
Module Name
RemoteLibUpdater.exe
Full Name
RemoteLibUpdater.exe
EntryPoint
System.Void SearchExplorer.Program::Main(System.String[])
Scope Name
RemoteLibUpdater.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
RemoteLibUpdater
Assembly Version
1.0.3.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
9
Main Method
System.Void SearchExplorer.Program::Main(System.String[])
Main IL Instruction Count
150
Main IL 
br IL_0006: nop
ret <null>
nop <null>
call System.String System.IO.Directory::GetCurrentDirectory()
stloc.s V_0
br IL_018C: call System.String[] System.Environment::GetCommandLineArgs()
br IL_0021: ldloc V_7
ldc.i4 0
stloc V_7
ldloc V_7
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_7
ldc.i4 989
beq IL_0021: ldloc V_7
br IL_008D: ldloc.s V_0
newobj System.Void System.Collections.Generic.List`1<System.String>::.ctor()
stloc.s V_1
br IL_0179: ldarg.0
ldc.i4.0 <null>
stloc.s V_4
br IL_0069: br IL_0198
nop <null>
br IL_00CD: nop
br IL_0204: leave IL_0005
br IL_0059: nop
br IL_0198: ldloc.s V_4
ldc.i4 4
ldsfld <Module>{4936b039-cabc-4278-9eed-59a1d17ceb06} <Module>{4936b039-cabc-4278-9eed-59a1d17ceb06}::m_41bf211440ad4219b591438f3548a883
ldfld System.Int32 <Module>{4936b039-cabc-4278-9eed-59a1d17ceb06}::m_555d9b0ebc044b3880d71134fdb9866f
brfalse IL_0025: switch(IL_008D,IL_01D3)
pop <null>
ldc.i4 1
br IL_0025: switch(IL_008D,IL_01D3)
ldloc.s V_0
ldloc.s V_1
call SearchExplorer.Conditions SearchExplorer.Program::CheckConditions(System.String,System.Collections.Generic.List`1<System.String>)
stloc.s V_2
br IL_009D: ldloc.s V_2
ldloc.s V_2
ldfld System.Boolean SearchExplorer.Conditions::argument
brfalse IL_0059: nop
br IL_01C2: ldloc.s V_2
ldsfld System.Action SearchExplorer.Program/<>c::<>9__0_0
dup <null>
brtrue IL_01F5: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
br IL_01DF: ldsfld SearchExplorer.Program/<>c SearchExplorer.Program/<>c::<>9
ldloc.s V_1
ldloc.s V_5
callvirt System.Void System.Collections.Generic.List`1<System.String>::Add(System.String)
br IL_0181: ldloc.s V_4
nop <null>
ldsfld System.Action SearchExplorer.Program/<>c::<>9__0_1
dup <null>
brtrue IL_0136: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
br IL_0120: ldsfld SearchExplorer.Program/<>c SearchExplorer.Program/<>c::<>9
nop <null>
ldc.i4.2 <null>
newarr System.Threading.Tasks.Task
dup <null>
ldc.i4.0 <null>
ldloc.s V_6
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
ldloc.s V_8
stelem.ref <null>
call System.Void System.Threading.Tasks.Task::WaitAll(System.Threading.Tasks.Task[])
br IL_00FA: leave IL_0164
leave IL_0164: leave IL_0204
pop <null>
br IL_0105: leave IL_0164
leave IL_0164: leave IL_0204
br IL_0164: leave IL_0204
ldsfld System.Action SearchExplorer.Program/<>c::<>9__0_2
dup <null>
brtrue IL_0158: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
br IL_0142: ldsfld SearchExplorer.Program/<>c SearchExplorer.Program/<>c::<>9
ldsfld SearchExplorer.Program/<>c SearchExplorer.Program/<>c::<>9
ldftn System.Void SearchExplorer.Program/<>c::<Main>b__0_1()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action SearchExplorer.Program/<>c::<>9__0_1
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
stloc.s V_6
br IL_010F: ldsfld System.Action SearchExplorer.Program/<>c::<>9__0_2
ldsfld SearchExplorer.Program/<>c SearchExplorer.Program/<>c::<>9
ldftn System.Void SearchExplorer.Program/<>c::<Main>b__0_2()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action SearchExplorer.Program/<>c::<>9__0_2
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
stloc.s V_8
br IL_00DF: nop
leave IL_0204: leave IL_0005
pop <null>
br IL_016F: leave IL_0204
leave IL_0204: leave IL_0005
br IL_0204: leave IL_0005
ldarg.0 <null>
stloc.s V_3
br IL_0051: ldc.i4.0
ldloc.s V_4
ldc.i4.1 <null>
add <null>
stloc.s V_4
br IL_0198: ldloc.s V_4
call System.String[] System.Environment::GetCommandLineArgs()
starg.s args
br IL_0045: newobj System.Void System.Collections.Generic.List`1<System.String>::.ctor()
ldloc.s V_4
ldloc.s V_3
ldlen <null>
conv.i4 <null>
blt IL_01D3: ldloc.s V_3
ldc.i4 0
ldsfld <Module>{4936b039-cabc-4278-9eed-59a1d17ceb06} <Module>{4936b039-cabc-4278-9eed-59a1d17ceb06}::m_41bf211440ad4219b591438f3548a883
ldfld System.Int32 <Module>{4936b039-cabc-4278-9eed-59a1d17ceb06}::m_5c037671801f4de28d1a33b5f690e054
brfalse IL_0025: switch(IL_008D,IL_01D3)
pop <null>
ldc.i4 5
br IL_0025: switch(IL_008D,IL_01D3)
ldloc.s V_2
ldfld System.Boolean SearchExplorer.Conditions::sysemdirectory
brfalse IL_0059: nop
br IL_00AE: ldsfld System.Action SearchExplorer.Program/<>c::<>9__0_0
ldloc.s V_3
ldloc.s V_4
ldelem.ref <null>
stloc.s V_5
br IL_00BF: ldloc.s V_1
ldsfld SearchExplorer.Program/<>c SearchExplorer.Program/<>c::<>9
ldftn System.Void SearchExplorer.Program/<>c::<Main>b__0_0()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action SearchExplorer.Program/<>c::<>9__0_0
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
callvirt System.Void System.Threading.Tasks.Task::Wait()
br IL_005F: br IL_0204
leave IL_0005: ret
callvirt System.String System.Object::ToString()
call System.Void System.Console::WriteLine(System.String)
br IL_0218: ldc.i4.0
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
br IL_0223: leave IL_0005
leave IL_0005: ret
br IL_0005: ret
b304986e947fe26a40e454426d90ef50
Malicious
.Net Resources
RemoteLibUpdater.g.resources
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙