Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
1 malicious · 3 files
EXEb98b6a539831103e055016fd560d019bAsyncRAT
Structure
Config. Field Value
Key (AES_256) RldrOEhuhuhuhuhuhuhuhuhuhuhu
Pastebin -huhuhuhu
Certificate MIIE8jhuhuhuhuhuhuhuhuhuhuhu
ServerSignature XBfegkhuhuhuhuhuhuhuhuhuhuhu
Install thuhuhuhu
BDOS thuhuhuhu
Anti-VM thuhuhuhu
Install File hypehuhuhuhuhuhuhu
Install-Folder %Aphuhuhuhu
Version 0.huhuhuhu
Hosts hyper.huhuhuhuhuhuhuhuhuhuhu
Ports 44,64,huhuhuhuhuhuhu
Mutex hyperhuhuhuhuhuhuhu
Delay 5huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
XkInrJzYHVE
Full Name
XkInrJzYHVE
EntryPoint
System.Void pQTDkWaPyObAK.PDcpCTxdwEn::Main()
Scope Name
XkInrJzYHVE
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Stub
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
130
Main Method
System.Void pQTDkWaPyObAK.PDcpCTxdwEn::Main()
Main IL Instruction Count
53
Main IL 
ldc.i4.0 <null>
stloc.0 <null>
br.s IL_0012: ldloc.0
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
ldc.i4.1 <null>
add <null>
stloc.0 <null>
ldloc.0 <null>
ldsfld System.String pQTDkWaPyObAK.KwWpBJnKfyK::JTfsUCmehOKtau
call System.Int32 System.Convert::ToInt32(System.String)
blt.s IL_0004: ldc.i4 1000
call System.Boolean pQTDkWaPyObAK.KwWpBJnKfyK::HyqKTmAXqSMUQ()
brtrue.s IL_002C: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Boolean AJPxotbfjpcwm.EdXLKqsldge::IcutYoQpOYHpwI()
brtrue.s IL_003A: ldsfld System.String pQTDkWaPyObAK.KwWpBJnKfyK::dCHAkRiumtbN
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String pQTDkWaPyObAK.KwWpBJnKfyK::dCHAkRiumtbN
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_004B: ldsfld System.String pQTDkWaPyObAK.KwWpBJnKfyK::RrDcpLndmzcHA
call System.Void AJPxotbfjpcwm.yVgPaMnIgq::vbgdeuaTvSsuyk()
ldsfld System.String pQTDkWaPyObAK.KwWpBJnKfyK::RrDcpLndmzcHA
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_005C: ldsfld System.String pQTDkWaPyObAK.KwWpBJnKfyK::qPhTHxDPMHSm
call System.Void BdYEJqlkFtPlU.ViDVtdCpUzha::KTPTkipCqNEs()
ldsfld System.String pQTDkWaPyObAK.KwWpBJnKfyK::qPhTHxDPMHSm
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_0074: call System.Void AJPxotbfjpcwm.MscCKNPmlLdD::yhtoYuCoVIiCUG()
call System.Boolean AJPxotbfjpcwm.MscCKNPmlLdD::iAjNDUhNszvju()
brfalse.s IL_0074: call System.Void AJPxotbfjpcwm.MscCKNPmlLdD::yhtoYuCoVIiCUG()
call System.Void AJPxotbfjpcwm.YvkDFogDTgETl::RLnpIjLdtUCEy()
call System.Void AJPxotbfjpcwm.MscCKNPmlLdD::yhtoYuCoVIiCUG()
newobj System.Void AJPxotbfjpcwm.bUkrGGvnUc::.ctor()
call System.String AJPxotbfjpcwm.bUkrGGvnUc::EMYgnzicZyJ()
pop <null>
leave.s IL_0089: call System.Boolean GmqvaMSaygM.ujrYcPZoodEWl::get_IsConnected()
pop <null>
leave.s IL_0089: call System.Boolean GmqvaMSaygM.ujrYcPZoodEWl::get_IsConnected()
call System.Boolean GmqvaMSaygM.ujrYcPZoodEWl::get_IsConnected()
brtrue.s IL_009A: newobj System.Void System.Random::.ctor()
call System.Void GmqvaMSaygM.ujrYcPZoodEWl::LbDMwzNnABmBi()
call System.Void GmqvaMSaygM.ujrYcPZoodEWl::ivPGEWksPF()
newobj System.Void System.Random::.ctor()
ldc.i4 1000
ldc.i4 5000
callvirt System.Int32 System.Random::Next(System.Int32,System.Int32)
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_0089: call System.Boolean GmqvaMSaygM.ujrYcPZoodEWl::get_IsConnected()
Module Name
XkInrJzYHVE
Full Name
XkInrJzYHVE
EntryPoint
System.Void pQTDkWaPyObAK.PDcpCTxdwEn::Main()
Scope Name
XkInrJzYHVE
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Stub
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
130
Main Method
System.Void pQTDkWaPyObAK.PDcpCTxdwEn::Main()
Main IL Instruction Count
53
Main IL 
ldc.i4.0 <null>
stloc.0 <null>
br.s IL_0012: ldloc.0
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
ldc.i4.1 <null>
add <null>
stloc.0 <null>
ldloc.0 <null>
ldsfld System.String pQTDkWaPyObAK.KwWpBJnKfyK::JTfsUCmehOKtau
call System.Int32 System.Convert::ToInt32(System.String)
blt.s IL_0004: ldc.i4 1000
call System.Boolean pQTDkWaPyObAK.KwWpBJnKfyK::HyqKTmAXqSMUQ()
brtrue.s IL_002C: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Boolean AJPxotbfjpcwm.EdXLKqsldge::IcutYoQpOYHpwI()
brtrue.s IL_003A: ldsfld System.String pQTDkWaPyObAK.KwWpBJnKfyK::dCHAkRiumtbN
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String pQTDkWaPyObAK.KwWpBJnKfyK::dCHAkRiumtbN
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_004B: ldsfld System.String pQTDkWaPyObAK.KwWpBJnKfyK::RrDcpLndmzcHA
call System.Void AJPxotbfjpcwm.yVgPaMnIgq::vbgdeuaTvSsuyk()
ldsfld System.String pQTDkWaPyObAK.KwWpBJnKfyK::RrDcpLndmzcHA
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_005C: ldsfld System.String pQTDkWaPyObAK.KwWpBJnKfyK::qPhTHxDPMHSm
call System.Void BdYEJqlkFtPlU.ViDVtdCpUzha::KTPTkipCqNEs()
ldsfld System.String pQTDkWaPyObAK.KwWpBJnKfyK::qPhTHxDPMHSm
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_0074: call System.Void AJPxotbfjpcwm.MscCKNPmlLdD::yhtoYuCoVIiCUG()
call System.Boolean AJPxotbfjpcwm.MscCKNPmlLdD::iAjNDUhNszvju()
brfalse.s IL_0074: call System.Void AJPxotbfjpcwm.MscCKNPmlLdD::yhtoYuCoVIiCUG()
call System.Void AJPxotbfjpcwm.YvkDFogDTgETl::RLnpIjLdtUCEy()
call System.Void AJPxotbfjpcwm.MscCKNPmlLdD::yhtoYuCoVIiCUG()
newobj System.Void AJPxotbfjpcwm.bUkrGGvnUc::.ctor()
call System.String AJPxotbfjpcwm.bUkrGGvnUc::EMYgnzicZyJ()
pop <null>
leave.s IL_0089: call System.Boolean GmqvaMSaygM.ujrYcPZoodEWl::get_IsConnected()
pop <null>
leave.s IL_0089: call System.Boolean GmqvaMSaygM.ujrYcPZoodEWl::get_IsConnected()
call System.Boolean GmqvaMSaygM.ujrYcPZoodEWl::get_IsConnected()
brtrue.s IL_009A: newobj System.Void System.Random::.ctor()
call System.Void GmqvaMSaygM.ujrYcPZoodEWl::LbDMwzNnABmBi()
call System.Void GmqvaMSaygM.ujrYcPZoodEWl::ivPGEWksPF()
newobj System.Void System.Random::.ctor()
ldc.i4 1000
ldc.i4 5000
callvirt System.Int32 System.Random::Next(System.Int32,System.Int32)
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_0089: call System.Boolean GmqvaMSaygM.ujrYcPZoodEWl::get_IsConnected()
Key (AES_256) MUTEXmalicious
RldrOEhuhuhuhuhuhuhuhuhuhuhu
CnC CNCmalicious
hypehuhuhuhu
CnC CNCmalicious
swingmhuhuhuhuhuhuhu
CnC CNCmalicious
astrolhuhuhuhuhuhuhu
Ports PORTmalicious
4huhuhuhu
Ports PORTmalicious
6huhuhuhu
Ports PORTmalicious
4huhuhuhu
Ports PORTmalicious
6huhuhuhu
Ports PORTmalicious
7huhuhuhu
Ports PORTmalicious
8huhuhuhu
Mutex MUTEXmalicious
hyperhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙