c7621bd824231ada140d61c4abfb61bc

PE Executable

MD5: c7621bd824231ada140d61c4abfb61bc

Size: 850.94 KB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Very high

MD5	c7621bd824231ada140d61c4abfb61bc
Sha1	c5e6a0a4e0906c9f138d1d9d69cae3ee00883a1d
Sha256	e084e80abf2e13a02f8e611406a499fd25fcbd84951ca9bff62f72c6897cb4d6
Sha384	ee7981f466f504a90e0d426238e06a922cb96d1ec188b3beaf2b8ca74cba40624f14d1c6ce3ceda0271b5842ca24aec8
Sha512	5b2ddec347ab4d80c95ed9c93bf164d00d6b30b3ab367b39cb63122abdc0b969bdd5100b6438283bc6a2c46447c7539dbe43ca0ce16976d276c486f33fb3af83
SSDeep	12288:NTUJVLlMl/WJbWlsZ3A8O/SloAS5M2YQ0mlriPkEywNS1CjJj+OLJYUm:NQJbMl/WJ4sZvfRSimiP8wNe8j+OL+
TLSH	150502DD3690A5FFC427D47189659D34E2626C7B0707D203A46B3C9FB63E5CB8E248A2

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	server1.exe
Full Name	server1.exe
EntryPoint	System.Void server.Module2::main()
Scope Name	server1.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	server1
Assembly Version	2.0.0.9
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.8
Total Strings	43
Main Method	System.Void server.Module2::main()
Main IL Instruction Count	48
Main IL	nop <null> call System.String server.My.Resources.Resources::get_encrypted() ldstr BCmW_M?u‡‚CZlQN‰?B;~bPkWJ:;oV†}`>~A call System.String server.Module2::AES_Decrypt(System.String,System.String) stsfld System.String server.Module2::Hex ldc.i4 -402690649 ldc.i4 -1366960054 xor <null> dup <null> stloc.2 <null> ldc.i4.4 <null> rem.un <null> switch dnlib.DotNet.Emit.Instruction[] br.s IL_008F: ldloc.1 ldsfld System.String server.Module2::Hex call System.Byte[] server.Module2::tilgUhXoMS(System.String) stsfld System.Byte[] server.Module2::Bytes ldloc.2 <null> ldc.i4 1452293722 mul <null> ldc.i4 1766063698 xor <null> br.s IL_001A: ldc.i4 -1366960054 newobj System.Void server.THBIHHYuFwK::.ctor() stloc.0 <null> ldloc.0 <null> ldsfld System.Byte[] server.Module2::Bytes call System.Diagnostics.Process server.Module2::‌‍‬‍‪‭⁮‭‮⁫⁫⁫‬⁬‭‭‮‌‏‍⁭⁯‏‏⁫‏‭‫‫‭⁪⁯‎⁭⁫⁪‭‭‫‮() call System.Diagnostics.ProcessModule server.Module2::‫‫⁮‭⁭‮‫‮‬‎‌‎⁪‪⁫‏⁮⁯‮‭‬‭⁯⁮⁫‭‌⁫⁫‫⁯⁮⁭‏⁭⁪‏‮(System.Diagnostics.Process) call System.String server.Module2::⁯‍‪⁪⁫‏⁫‭⁮⁮‬‪‮‫‭‬⁮‏⁫⁮‪‍⁫‌⁫⁭⁫‭⁪‎‭‭‌⁭‎⁪‮(System.Diagnostics.ProcessModule) callvirt System.Boolean server.THBIHHYuFwK::ltGUtPVJuRI(System.Byte[],System.String) pop <null> newobj System.Void server.SyJtXnyQBYj::.ctor() stloc.1 <null> ldloc.2 <null> ldc.i4 -1177721893 mul <null> ldc.i4 190515187 xor <null> br.s IL_001A: ldc.i4 -1366960054 ldloc.1 <null> ldsfld System.Byte[] server.Module2::Bytes call System.Diagnostics.Process server.Module2::‌‍‬‍‪‭⁮‭‮⁫⁫⁫‬⁬‭‭‮‌‏‍⁭⁯‏‏⁫‏‭‫‫‭⁪⁯‎⁭⁫⁪‭‭‫‮() call System.Diagnostics.ProcessModule server.Module2::‫‫⁮‭⁭‮‫‮‬‎‌‎⁪‪⁫‏⁮⁯‮‭‬‭⁯⁮⁫‭‌⁫⁫‫⁯⁮⁭‏⁭⁪‏‮(System.Diagnostics.Process) call System.String server.Module2::⁯‍‪⁪⁫‏⁫‭⁮⁮‬‪‮‫‭‬⁮‏⁫⁮‪‍⁫‌⁫⁭⁫‭⁪‎‭‭‌⁭‎⁪‮(System.Diagnostics.ProcessModule) callvirt System.Boolean server.SyJtXnyQBYj::ljOGJvvgquh(System.Byte[],System.String) pop <null> ret <null>
Module Name	server1.exe
Full Name	server1.exe
EntryPoint	System.Void server.Module2::main()
Scope Name	server1.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	server1
Assembly Version	2.0.0.9
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.8
Total Strings	43
Main Method	System.Void server.Module2::main()
Main IL Instruction Count	48
Main IL	nop <null> call System.String server.My.Resources.Resources::get_encrypted() ldstr BCmW_M?u‡‚CZlQN‰?B;~bPkWJ:;oV†}`>~A call System.String server.Module2::AES_Decrypt(System.String,System.String) stsfld System.String server.Module2::Hex ldc.i4 -402690649 ldc.i4 -1366960054 xor <null> dup <null> stloc.2 <null> ldc.i4.4 <null> rem.un <null> switch dnlib.DotNet.Emit.Instruction[] br.s IL_008F: ldloc.1 ldsfld System.String server.Module2::Hex call System.Byte[] server.Module2::tilgUhXoMS(System.String) stsfld System.Byte[] server.Module2::Bytes ldloc.2 <null> ldc.i4 1452293722 mul <null> ldc.i4 1766063698 xor <null> br.s IL_001A: ldc.i4 -1366960054 newobj System.Void server.THBIHHYuFwK::.ctor() stloc.0 <null> ldloc.0 <null> ldsfld System.Byte[] server.Module2::Bytes call System.Diagnostics.Process server.Module2::‌‍‬‍‪‭⁮‭‮⁫⁫⁫‬⁬‭‭‮‌‏‍⁭⁯‏‏⁫‏‭‫‫‭⁪⁯‎⁭⁫⁪‭‭‫‮() call System.Diagnostics.ProcessModule server.Module2::‫‫⁮‭⁭‮‫‮‬‎‌‎⁪‪⁫‏⁮⁯‮‭‬‭⁯⁮⁫‭‌⁫⁫‫⁯⁮⁭‏⁭⁪‏‮(System.Diagnostics.Process) call System.String server.Module2::⁯‍‪⁪⁫‏⁫‭⁮⁮‬‪‮‫‭‬⁮‏⁫⁮‪‍⁫‌⁫⁭⁫‭⁪‎‭‭‌⁭‎⁪‮(System.Diagnostics.ProcessModule) callvirt System.Boolean server.THBIHHYuFwK::ltGUtPVJuRI(System.Byte[],System.String) pop <null> newobj System.Void server.SyJtXnyQBYj::.ctor() stloc.1 <null> ldloc.2 <null> ldc.i4 -1177721893 mul <null> ldc.i4 190515187 xor <null> br.s IL_001A: ldc.i4 -1366960054 ldloc.1 <null> ldsfld System.Byte[] server.Module2::Bytes call System.Diagnostics.Process server.Module2::‌‍‬‍‪‭⁮‭‮⁫⁫⁫‬⁬‭‭‮‌‏‍⁭⁯‏‏⁫‏‭‫‫‭⁪⁯‎⁭⁫⁪‭‭‫‮() call System.Diagnostics.ProcessModule server.Module2::‫‫⁮‭⁭‮‫‮‬‎‌‎⁪‪⁫‏⁮⁯‮‭‬‭⁯⁮⁫‭‌⁫⁫‫⁯⁮⁭‏⁭⁪‏‮(System.Diagnostics.Process) call System.String server.Module2::⁯‍‪⁪⁫‏⁫‭⁮⁮‬‪‮‫‭‬⁮‏⁫⁮‪‍⁫‌⁫⁭⁫‭⁪‎‭‭‌⁭‎⁪‮(System.Diagnostics.ProcessModule) callvirt System.Boolean server.SyJtXnyQBYj::ljOGJvvgquh(System.Byte[],System.String) pop <null> ret <null>

No malware configuration was found at this point.

You must be signed in to view YARA rules.