Malicious
Malicious

b98b6a539831103e055016fd560d019b

PE Executable
MD5: b98b6a539831103e055016fd560d019b
Size: 50.69 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 b98b6a539831103e055016fd560d019b
Sha1 a55fa380d35113d8c9f9bd27c769a0dc4e740f98
Sha256 be325b9cc973ccd930094f73b3886ed98a178fa691ab1b8a77cd2143aea4e299
Sha384 c291e1188f51c5db625bc662eff5d7c3197bd6334ac30027798bfd5186a1cf38e48817ceeb5d0ec548588b4d4dfc18bd
Sha512 9c15361a8afc20c25f7f97b665dc7c4460ec4353341af83df62a5b6c3a412bbe3526c640f0677cab71e6da8101fcc10a5e200a385056a0060a19409aad10844e
SSDeep 1536:C3Ds0sJ5L12UZbjHW9kvxXHuJmJN6OJkmVcl:Cn25L8UZbj6k5XfJNVk8Y
TLSH D2333C0037E98126F1FE5FB89CF1214586BAF6633502D51E7C8842D64B23BC6DA52BF6
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
b98b6a539831103e055016fd560d019b
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Config. Field Value
Key (AES_256) RldrOEhuhuhuhuhuhuhuhuhuhuhu
Pastebin -huhuhuhu
Certificate MIIE8jhuhuhuhuhuhuhuhuhuhuhu
ServerSignature XBfegkhuhuhuhuhuhuhuhuhuhuhu
Install thuhuhuhu
BDOS thuhuhuhu
Anti-VM thuhuhuhu
Install File hypehuhuhuhuhuhuhu
Install-Folder %Aphuhuhuhu
Version 0.huhuhuhu
Hosts hyper.huhuhuhuhuhuhuhuhuhuhu
Ports 44,64,huhuhuhuhuhuhu
Mutex hyperhuhuhuhuhuhuhu
Delay 5huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
XkInrJzYHVE
Full Name
XkInrJzYHVE
EntryPoint
System.Void pQTDkWaPyObAK.PDcpCTxdwEn::Main()
Scope Name
XkInrJzYHVE
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Stub
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
130
Main Method
System.Void pQTDkWaPyObAK.PDcpCTxdwEn::Main()
Main IL Instruction Count
53
Main IL 
ldc.i4.0 <null>
stloc.0 <null>
br.s IL_0012: ldloc.0
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
ldc.i4.1 <null>
add <null>
stloc.0 <null>
ldloc.0 <null>
ldsfld System.String pQTDkWaPyObAK.KwWpBJnKfyK::JTfsUCmehOKtau
call System.Int32 System.Convert::ToInt32(System.String)
blt.s IL_0004: ldc.i4 1000
call System.Boolean pQTDkWaPyObAK.KwWpBJnKfyK::HyqKTmAXqSMUQ()
brtrue.s IL_002C: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Boolean AJPxotbfjpcwm.EdXLKqsldge::IcutYoQpOYHpwI()
brtrue.s IL_003A: ldsfld System.String pQTDkWaPyObAK.KwWpBJnKfyK::dCHAkRiumtbN
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String pQTDkWaPyObAK.KwWpBJnKfyK::dCHAkRiumtbN
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_004B: ldsfld System.String pQTDkWaPyObAK.KwWpBJnKfyK::RrDcpLndmzcHA
call System.Void AJPxotbfjpcwm.yVgPaMnIgq::vbgdeuaTvSsuyk()
ldsfld System.String pQTDkWaPyObAK.KwWpBJnKfyK::RrDcpLndmzcHA
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_005C: ldsfld System.String pQTDkWaPyObAK.KwWpBJnKfyK::qPhTHxDPMHSm
call System.Void BdYEJqlkFtPlU.ViDVtdCpUzha::KTPTkipCqNEs()
ldsfld System.String pQTDkWaPyObAK.KwWpBJnKfyK::qPhTHxDPMHSm
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_0074: call System.Void AJPxotbfjpcwm.MscCKNPmlLdD::yhtoYuCoVIiCUG()
call System.Boolean AJPxotbfjpcwm.MscCKNPmlLdD::iAjNDUhNszvju()
brfalse.s IL_0074: call System.Void AJPxotbfjpcwm.MscCKNPmlLdD::yhtoYuCoVIiCUG()
call System.Void AJPxotbfjpcwm.YvkDFogDTgETl::RLnpIjLdtUCEy()
call System.Void AJPxotbfjpcwm.MscCKNPmlLdD::yhtoYuCoVIiCUG()
newobj System.Void AJPxotbfjpcwm.bUkrGGvnUc::.ctor()
call System.String AJPxotbfjpcwm.bUkrGGvnUc::EMYgnzicZyJ()
pop <null>
leave.s IL_0089: call System.Boolean GmqvaMSaygM.ujrYcPZoodEWl::get_IsConnected()
pop <null>
leave.s IL_0089: call System.Boolean GmqvaMSaygM.ujrYcPZoodEWl::get_IsConnected()
call System.Boolean GmqvaMSaygM.ujrYcPZoodEWl::get_IsConnected()
brtrue.s IL_009A: newobj System.Void System.Random::.ctor()
call System.Void GmqvaMSaygM.ujrYcPZoodEWl::LbDMwzNnABmBi()
call System.Void GmqvaMSaygM.ujrYcPZoodEWl::ivPGEWksPF()
newobj System.Void System.Random::.ctor()
ldc.i4 1000
ldc.i4 5000
callvirt System.Int32 System.Random::Next(System.Int32,System.Int32)
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_0089: call System.Boolean GmqvaMSaygM.ujrYcPZoodEWl::get_IsConnected()
Module Name
XkInrJzYHVE
Full Name
XkInrJzYHVE
EntryPoint
System.Void pQTDkWaPyObAK.PDcpCTxdwEn::Main()
Scope Name
XkInrJzYHVE
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Stub
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
130
Main Method
System.Void pQTDkWaPyObAK.PDcpCTxdwEn::Main()
Main IL Instruction Count
53
Main IL 
ldc.i4.0 <null>
stloc.0 <null>
br.s IL_0012: ldloc.0
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
ldc.i4.1 <null>
add <null>
stloc.0 <null>
ldloc.0 <null>
ldsfld System.String pQTDkWaPyObAK.KwWpBJnKfyK::JTfsUCmehOKtau
call System.Int32 System.Convert::ToInt32(System.String)
blt.s IL_0004: ldc.i4 1000
call System.Boolean pQTDkWaPyObAK.KwWpBJnKfyK::HyqKTmAXqSMUQ()
brtrue.s IL_002C: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Boolean AJPxotbfjpcwm.EdXLKqsldge::IcutYoQpOYHpwI()
brtrue.s IL_003A: ldsfld System.String pQTDkWaPyObAK.KwWpBJnKfyK::dCHAkRiumtbN
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String pQTDkWaPyObAK.KwWpBJnKfyK::dCHAkRiumtbN
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_004B: ldsfld System.String pQTDkWaPyObAK.KwWpBJnKfyK::RrDcpLndmzcHA
call System.Void AJPxotbfjpcwm.yVgPaMnIgq::vbgdeuaTvSsuyk()
ldsfld System.String pQTDkWaPyObAK.KwWpBJnKfyK::RrDcpLndmzcHA
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_005C: ldsfld System.String pQTDkWaPyObAK.KwWpBJnKfyK::qPhTHxDPMHSm
call System.Void BdYEJqlkFtPlU.ViDVtdCpUzha::KTPTkipCqNEs()
ldsfld System.String pQTDkWaPyObAK.KwWpBJnKfyK::qPhTHxDPMHSm
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_0074: call System.Void AJPxotbfjpcwm.MscCKNPmlLdD::yhtoYuCoVIiCUG()
call System.Boolean AJPxotbfjpcwm.MscCKNPmlLdD::iAjNDUhNszvju()
brfalse.s IL_0074: call System.Void AJPxotbfjpcwm.MscCKNPmlLdD::yhtoYuCoVIiCUG()
call System.Void AJPxotbfjpcwm.YvkDFogDTgETl::RLnpIjLdtUCEy()
call System.Void AJPxotbfjpcwm.MscCKNPmlLdD::yhtoYuCoVIiCUG()
newobj System.Void AJPxotbfjpcwm.bUkrGGvnUc::.ctor()
call System.String AJPxotbfjpcwm.bUkrGGvnUc::EMYgnzicZyJ()
pop <null>
leave.s IL_0089: call System.Boolean GmqvaMSaygM.ujrYcPZoodEWl::get_IsConnected()
pop <null>
leave.s IL_0089: call System.Boolean GmqvaMSaygM.ujrYcPZoodEWl::get_IsConnected()
call System.Boolean GmqvaMSaygM.ujrYcPZoodEWl::get_IsConnected()
brtrue.s IL_009A: newobj System.Void System.Random::.ctor()
call System.Void GmqvaMSaygM.ujrYcPZoodEWl::LbDMwzNnABmBi()
call System.Void GmqvaMSaygM.ujrYcPZoodEWl::ivPGEWksPF()
newobj System.Void System.Random::.ctor()
ldc.i4 1000
ldc.i4 5000
callvirt System.Int32 System.Random::Next(System.Int32,System.Int32)
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_0089: call System.Boolean GmqvaMSaygM.ujrYcPZoodEWl::get_IsConnected()
Key (AES_256) MUTEXmalicious
RldrOEhuhuhuhuhuhuhuhuhuhuhu
CnC CNCmalicious
hypehuhuhuhu
CnC CNCmalicious
swingmhuhuhuhuhuhuhu
CnC CNCmalicious
astrolhuhuhuhuhuhuhu
Ports PORTmalicious
4huhuhuhu
Ports PORTmalicious
6huhuhuhu
Ports PORTmalicious
4huhuhuhu
Ports PORTmalicious
6huhuhuhu
Ports PORTmalicious
7huhuhuhu
Ports PORTmalicious
8huhuhuhu
Mutex MUTEXmalicious
hyperhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
b98b6a539831103e055016fd560d019b
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Config. Field Value
Key (AES_256) RldrOEhuhuhuhuhuhuhuhuhuhuhu
Pastebin -huhuhuhu
Certificate MIIE8jhuhuhuhuhuhuhuhuhuhuhu
ServerSignature XBfegkhuhuhuhuhuhuhuhuhuhuhu
Install thuhuhuhu
BDOS thuhuhuhu
Anti-VM thuhuhuhu
Install File hypehuhuhuhuhuhuhu
Install-Folder %Aphuhuhuhu
Version 0.huhuhuhu
Hosts hyper.huhuhuhuhuhuhuhuhuhuhu
Ports 44,64,huhuhuhuhuhuhu
Mutex hyperhuhuhuhuhuhuhu
Delay 5huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Key (AES_256) MUTEXmalicious
RldrOEhuhuhuhuhuhuhuhuhuhuhu
b98b6a539831103e055016fd560d019b
CnC CNCmalicious
hypehuhuhuhu
b98b6a539831103e055016fd560d019b
CnC CNCmalicious
swingmhuhuhuhuhuhuhu
b98b6a539831103e055016fd560d019b
CnC CNCmalicious
astrolhuhuhuhuhuhuhu
b98b6a539831103e055016fd560d019b
Ports PORTmalicious
4huhuhuhu
b98b6a539831103e055016fd560d019b
Ports PORTmalicious
6huhuhuhu
b98b6a539831103e055016fd560d019b
Ports PORTmalicious
4huhuhuhu
b98b6a539831103e055016fd560d019b
Ports PORTmalicious
6huhuhuhu
b98b6a539831103e055016fd560d019b
Ports PORTmalicious
7huhuhuhu
b98b6a539831103e055016fd560d019b
Ports PORTmalicious
8huhuhuhu
b98b6a539831103e055016fd560d019b
Mutex MUTEXmalicious
hyperhuhuhuhuhuhuhu
b98b6a539831103e055016fd560d019b
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙