Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
1.21 MB · 1,213,440 B
First seen
2026-07-14 03:16 · 3 months ago
Last seen
2026-07-14 03:16 · 3 months ago
Last analysis
2026-07-14 03:16 · 3 months ago
Hashes
MD5 d245eadb186f026bc1bc70fd0e2273ac Sha1 c3c5f2b383a4b4a6ee335a3b5bb9de182cb3cc82 Sha256 0e4e0247476003c3efef81eba6fdc6c98876d15ae4fd81994a2a58c598c2011d Sha384 ae2f01ef493305a8124ae7bf140726567865a06df3ad6d8356f7a9598feb6ebbe9020704651c024623f9cd2f7067ff43 Sha512 65f2873883be76704ce5c929eabec9b643906e8e2a45e521e3c89e8c5b1035eb4f362756d84386095665f1d4633add9b72237ee64e32581c7f01118b5084d700 SSDeep 12288:qi2amT2CPpHAP/iGc1ZOM+FhWF2hekxpp4y98G1R12Vg5CkCThajRxBV:G/2UxAPqGcv/+Duyx4K0kYa9xB TLSH 4F45E12549466536DB3D0A74C2D6749C13F0FDF39292E71A2EE870FCDB727A4A9D2082
Detection
PeID
HQR data fileMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual Studio .NET
Symbol obfuscation
Very high
2 malicious · 66 files
EXEd245eadb186f026bc1bc70fd0e2273ac.NET Reflective Loader
Structure
BINResources
BINRT_ICON
BINID:0032
IMGID:0
IMGID:0-preview.png
BINID:0033
BINID:0
BINID:0034
BINID:0
BINID:0035
BINID:0
BINID:0036
BINID:0
BINID:0037
BINID:0
BINRT_GROUP_CURSOR4
BINID:0001
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
TIFFGenitalk.klaoxao.tiff
BINZa3mo1T.Resources.resources
BIN9e5427e318a7c3.Resources.resources
BIN7128b1b70
DATA[NBF]root.Data
BIN7128b1b71
DATA[NBF]root.Data
BIN7128b1b710
DATA[NBF]root.Data
BIN7128b1b711
DATA[NBF]root.Data
BIN7128b1b712
DATA[NBF]root.Data
BIN7128b1b713
DATA[NBF]root.Data
BIN7128b1b714
DATA[NBF]root.Data
BIN7128b1b715
DATA[NBF]root.Data
BIN7128b1b716
DATA[NBF]root.Data
BIN7128b1b717
DATA[NBF]root.Data
BIN7128b1b718
DATA[NBF]root.Data
BIN7128b1b719
DATA[NBF]root.Data
BIN7128b1b72
DATA[NBF]root.Data
BIN7128b1b720
DATA[NBF]root.Data
BIN7128b1b721
DATA[NBF]root.Data
BIN7128b1b722
DATA[NBF]root.Data
BIN7128b1b73
DATA[NBF]root.Data
BIN7128b1b74
DATA[NBF]root.Data
BIN7128b1b75
DATA[NBF]root.Data
BIN7128b1b76
DATA[NBF]root.Data
BIN7128b1b77
DATA[NBF]root.Data
BIN7128b1b78
DATA[NBF]root.Data
BIN7128b1b79
DATA[NBF]root.Data
BIN.Net Reflective Loader
EXEGenitalk.klaoxao.tiff [AES Decrypted]
Structure
BINOverlay_ddd3db78.bin
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
BINObjectRequester.ScopeObject
BINScheduledObject.ObjectParser
BINDecryptorCompressor.ControllableObject
BINAuditorMap.LocalObject
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
5 / 5
Path pe:exe>pe:dll>pe:rsrc>bin
Shape pe:exe>pe:dll>pe:rsrc>bin
malicious 4 nodes
Path pe:exe>pe:dll>bin
Shape pe:exe>pe:dll>bin
malicious 3 nodes
Name Value
Module Name
Za3mo1T
Full Name
Za3mo1T
EntryPoint
System.Void yKk04ciBX5ox.fPy08xCsjK::6ctHioK5_9z()
Scope Name
Za3mo1T
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Za3mo1T
Assembly Version
7.4.26.131
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void yKk04ciBX5ox.fPy08xCsjK::6ctHioK5_9z()
Main IL Instruction Count
81
Main IL 
ldc.i4.5 <null>
stloc.s V_4
ldloc.s V_4
switch dnlib.DotNet.Emit.Instruction[]
nop <null>
ldc.i4.s 25
ldc.i4.6 <null>
ldc.i4 2026
call System.DateTime Microsoft.VisualBasic.DateAndTime::DateSerial(System.Int32,System.Int32,System.Int32)
stloc.0 <null>
ldloca.s V_1
initobj Microsoft.VisualBasic.FirstDayOfWeek
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.6 <null>
stloc.s V_4
br.s IL_0003: ldloc.s V_4
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
call System.Boolean yKk04ciBX5ox.fPy08xCsjK::jSw2X9d()
ldc.i4.0 <null>
ceq <null>
stloc.2 <null>
ldloc.2 <null>
brfalse.s IL_0064: ldc.i4.2
ldc.i4.7 <null>
stloc.s V_4
br.s IL_0003: ldloc.s V_4
ldc.i4.2 <null>
br.s IL_0060: stloc.s V_4
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
nop <null>
ldc.i4.2 <null>
stloc.s V_4
br.s IL_0003: ldloc.s V_4
nop <null>
call System.Void yKk04ciBX5ox.fPy08xCsjK::Kep4xF3d2m_G()
nop <null>
nop <null>
ldc.i4.5 <null>
ldc.i4 1651415064
ldtoken 8tsDKm6r4.5rqCiTi
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
ldnull <null>
call System.String Ny6sbPa.rs3En8Rscg1B/Pay2w9Ydb.eJy6G1b_/wGo7Z.Kt5oki::nWi0Sm3azLq94(System.Int32,System.Int32,System.Type,Ny6sbPa.rs3En8Rscg1B/Pay2w9Ydb.eJy6G1b_/wGo7Z.Kt5oki)
nop <null>
ldc.i4.s 91
ldc.i4 844449
ldc.i4.6 <null>
ldnull <null>
call System.String oa1RY.1NoxGz2zyaF9wX::3fmLb1N(System.Char,System.Int32,System.Int32,oa1RY.1NoxGz2zyaF9wX)
call System.Void yKk04ciBX5ox.fPy08xCsjK::Sp5n9XyiR(System.String,System.String)
ldc.i4.3 <null>
stloc.s V_4
br IL_0003: ldloc.s V_4
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
newobj System.Void yKk04ciBX5ox.fPy08xCsjK::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
ldtoken System.Void yKk04ciBX5ox.fPy08xCsjK::6ctHioK5_9z()
pop <null>
ldsfld System.Byte[] Ai0yn1nP.yb7AcSo68qx::by4M9i
ldc.i4.s 16
ldsfld System.Byte[] Ai0yn1nP.yb7AcSo68qx::by4M9i
ldc.i4.s 16
ldelem.u1 <null>
ldsfld System.Byte[] Ai0yn1nP.yb7AcSo68qx::by4M9i
ldc.i4.s 22
ldelem.u1 <null>
xor <null>
ldc.i4.s 26
and <null>
stelem.i1 <null>
ret <null>
Module Name
Za3mo1T
Full Name
Za3mo1T
EntryPoint
System.Void yKk04ciBX5ox.fPy08xCsjK::6ctHioK5_9z()
Scope Name
Za3mo1T
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Za3mo1T
Assembly Version
7.4.26.131
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void yKk04ciBX5ox.fPy08xCsjK::6ctHioK5_9z()
Main IL Instruction Count
81
Main IL 
ldc.i4.5 <null>
stloc.s V_4
ldloc.s V_4
switch dnlib.DotNet.Emit.Instruction[]
nop <null>
ldc.i4.s 25
ldc.i4.6 <null>
ldc.i4 2026
call System.DateTime Microsoft.VisualBasic.DateAndTime::DateSerial(System.Int32,System.Int32,System.Int32)
stloc.0 <null>
ldloca.s V_1
initobj Microsoft.VisualBasic.FirstDayOfWeek
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.6 <null>
stloc.s V_4
br.s IL_0003: ldloc.s V_4
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
call System.Boolean yKk04ciBX5ox.fPy08xCsjK::jSw2X9d()
ldc.i4.0 <null>
ceq <null>
stloc.2 <null>
ldloc.2 <null>
brfalse.s IL_0064: ldc.i4.2
ldc.i4.7 <null>
stloc.s V_4
br.s IL_0003: ldloc.s V_4
ldc.i4.2 <null>
br.s IL_0060: stloc.s V_4
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
nop <null>
ldc.i4.2 <null>
stloc.s V_4
br.s IL_0003: ldloc.s V_4
nop <null>
call System.Void yKk04ciBX5ox.fPy08xCsjK::Kep4xF3d2m_G()
nop <null>
nop <null>
ldc.i4.5 <null>
ldc.i4 1651415064
ldtoken 8tsDKm6r4.5rqCiTi
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
ldnull <null>
call System.String Ny6sbPa.rs3En8Rscg1B/Pay2w9Ydb.eJy6G1b_/wGo7Z.Kt5oki::nWi0Sm3azLq94(System.Int32,System.Int32,System.Type,Ny6sbPa.rs3En8Rscg1B/Pay2w9Ydb.eJy6G1b_/wGo7Z.Kt5oki)
nop <null>
ldc.i4.s 91
ldc.i4 844449
ldc.i4.6 <null>
ldnull <null>
call System.String oa1RY.1NoxGz2zyaF9wX::3fmLb1N(System.Char,System.Int32,System.Int32,oa1RY.1NoxGz2zyaF9wX)
call System.Void yKk04ciBX5ox.fPy08xCsjK::Sp5n9XyiR(System.String,System.String)
ldc.i4.3 <null>
stloc.s V_4
br IL_0003: ldloc.s V_4
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
newobj System.Void yKk04ciBX5ox.fPy08xCsjK::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
ldtoken System.Void yKk04ciBX5ox.fPy08xCsjK::6ctHioK5_9z()
pop <null>
ldsfld System.Byte[] Ai0yn1nP.yb7AcSo68qx::by4M9i
ldc.i4.s 16
ldsfld System.Byte[] Ai0yn1nP.yb7AcSo68qx::by4M9i
ldc.i4.s 16
ldelem.u1 <null>
ldsfld System.Byte[] Ai0yn1nP.yb7AcSo68qx::by4M9i
ldc.i4.s 22
ldelem.u1 <null>
xor <null>
ldc.i4.s 26
and <null>
stelem.i1 <null>
ret <null>
2 malicious · 66 files
EXEd245eadb186f026bc1bc70fd0e2273ac.NET Reflective Loader
Structure
BIN.Net Reflective Loader
EXEGenitalk.klaoxao.tiff [AES Decrypted]
Structure
BINOverlay_ddd3db78.bin
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙