Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 d245eadb186f026bc1bc70fd0e2273ac
Sha1 c3c5f2b383a4b4a6ee335a3b5bb9de182cb3cc82
Sha256 0e4e0247476003c3efef81eba6fdc6c98876d15ae4fd81994a2a58c598c2011d
Sha384 ae2f01ef493305a8124ae7bf140726567865a06df3ad6d8356f7a9598feb6ebbe9020704651c024623f9cd2f7067ff43
Sha512 65f2873883be76704ce5c929eabec9b643906e8e2a45e521e3c89e8c5b1035eb4f362756d84386095665f1d4633add9b72237ee64e32581c7f01118b5084d700
SSDeep 12288:qi2amT2CPpHAP/iGc1ZOM+FhWF2hekxpp4y98G1R12Vg5CkCThajRxBV:G/2UxAPqGcv/+Duyx4K0kYa9xB
TLSH 4F45E12549466536DB3D0A74C2D6749C13F0FDF39292E71A2EE870FCDB727A4A9D2082
PeID
HQR data fileMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual Studio .NET
d245eadb186f026bc1bc70fd0e2273ac
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0032
ID:0
ID:0-preview.png
ID:0033
ID:0
ID:0034
ID:0
ID:0035
ID:0
ID:0036
ID:0
ID:0037
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
Genitalk.klaoxao.tiff
Za3mo1T.Resources.resources
9e5427e318a7c3.Resources.resources
7128b1b70
[NBF]root.Data
7128b1b71
[NBF]root.Data
7128b1b710
[NBF]root.Data
7128b1b711
[NBF]root.Data
7128b1b712
[NBF]root.Data
7128b1b713
[NBF]root.Data
7128b1b714
[NBF]root.Data
7128b1b715
[NBF]root.Data
7128b1b716
[NBF]root.Data
7128b1b717
[NBF]root.Data
7128b1b718
[NBF]root.Data
7128b1b719
[NBF]root.Data
7128b1b72
[NBF]root.Data
7128b1b720
[NBF]root.Data
7128b1b721
[NBF]root.Data
7128b1b722
[NBF]root.Data
7128b1b73
[NBF]root.Data
7128b1b74
[NBF]root.Data
7128b1b75
[NBF]root.Data
7128b1b76
[NBF]root.Data
7128b1b77
[NBF]root.Data
7128b1b78
[NBF]root.Data
7128b1b79
[NBF]root.Data
.Net Reflective Loader
Malicious
Genitalk.klaoxao.tiff [AES Decrypted]
Malicious
Overlay_ddd3db78.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
ObjectRequester.ScopeObject
ScheduledObject.ObjectParser
DecryptorCompressor.ControllableObject
AuditorMap.LocalObject
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
5 / 5
Path pe:exe>pe:dll>pe:rsrc>bin
Shape pe:exe>pe:dll>pe:rsrc>bin
malicious 4 nodes
Path pe:exe>pe:dll>bin
Shape pe:exe>pe:dll>bin
malicious 3 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Za3mo1T
Full Name
Za3mo1T
EntryPoint
System.Void yKk04ciBX5ox.fPy08xCsjK::6ctHioK5_9z()
Scope Name
Za3mo1T
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Za3mo1T
Assembly Version
7.4.26.131
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void yKk04ciBX5ox.fPy08xCsjK::6ctHioK5_9z()
Main IL Instruction Count
81
Main IL 
ldc.i4.5 <null>
stloc.s V_4
ldloc.s V_4
switch dnlib.DotNet.Emit.Instruction[]
nop <null>
ldc.i4.s 25
ldc.i4.6 <null>
ldc.i4 2026
call System.DateTime Microsoft.VisualBasic.DateAndTime::DateSerial(System.Int32,System.Int32,System.Int32)
stloc.0 <null>
ldloca.s V_1
initobj Microsoft.VisualBasic.FirstDayOfWeek
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.6 <null>
stloc.s V_4
br.s IL_0003: ldloc.s V_4
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
call System.Boolean yKk04ciBX5ox.fPy08xCsjK::jSw2X9d()
ldc.i4.0 <null>
ceq <null>
stloc.2 <null>
ldloc.2 <null>
brfalse.s IL_0064: ldc.i4.2
ldc.i4.7 <null>
stloc.s V_4
br.s IL_0003: ldloc.s V_4
ldc.i4.2 <null>
br.s IL_0060: stloc.s V_4
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
nop <null>
ldc.i4.2 <null>
stloc.s V_4
br.s IL_0003: ldloc.s V_4
nop <null>
call System.Void yKk04ciBX5ox.fPy08xCsjK::Kep4xF3d2m_G()
nop <null>
nop <null>
ldc.i4.5 <null>
ldc.i4 1651415064
ldtoken 8tsDKm6r4.5rqCiTi
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
ldnull <null>
call System.String Ny6sbPa.rs3En8Rscg1B/Pay2w9Ydb.eJy6G1b_/wGo7Z.Kt5oki::nWi0Sm3azLq94(System.Int32,System.Int32,System.Type,Ny6sbPa.rs3En8Rscg1B/Pay2w9Ydb.eJy6G1b_/wGo7Z.Kt5oki)
nop <null>
ldc.i4.s 91
ldc.i4 844449
ldc.i4.6 <null>
ldnull <null>
call System.String oa1RY.1NoxGz2zyaF9wX::3fmLb1N(System.Char,System.Int32,System.Int32,oa1RY.1NoxGz2zyaF9wX)
call System.Void yKk04ciBX5ox.fPy08xCsjK::Sp5n9XyiR(System.String,System.String)
ldc.i4.3 <null>
stloc.s V_4
br IL_0003: ldloc.s V_4
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
newobj System.Void yKk04ciBX5ox.fPy08xCsjK::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
ldtoken System.Void yKk04ciBX5ox.fPy08xCsjK::6ctHioK5_9z()
pop <null>
ldsfld System.Byte[] Ai0yn1nP.yb7AcSo68qx::by4M9i
ldc.i4.s 16
ldsfld System.Byte[] Ai0yn1nP.yb7AcSo68qx::by4M9i
ldc.i4.s 16
ldelem.u1 <null>
ldsfld System.Byte[] Ai0yn1nP.yb7AcSo68qx::by4M9i
ldc.i4.s 22
ldelem.u1 <null>
xor <null>
ldc.i4.s 26
and <null>
stelem.i1 <null>
ret <null>
Module Name
Za3mo1T
Full Name
Za3mo1T
EntryPoint
System.Void yKk04ciBX5ox.fPy08xCsjK::6ctHioK5_9z()
Scope Name
Za3mo1T
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Za3mo1T
Assembly Version
7.4.26.131
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void yKk04ciBX5ox.fPy08xCsjK::6ctHioK5_9z()
Main IL Instruction Count
81
Main IL 
ldc.i4.5 <null>
stloc.s V_4
ldloc.s V_4
switch dnlib.DotNet.Emit.Instruction[]
nop <null>
ldc.i4.s 25
ldc.i4.6 <null>
ldc.i4 2026
call System.DateTime Microsoft.VisualBasic.DateAndTime::DateSerial(System.Int32,System.Int32,System.Int32)
stloc.0 <null>
ldloca.s V_1
initobj Microsoft.VisualBasic.FirstDayOfWeek
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.6 <null>
stloc.s V_4
br.s IL_0003: ldloc.s V_4
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
call System.Boolean yKk04ciBX5ox.fPy08xCsjK::jSw2X9d()
ldc.i4.0 <null>
ceq <null>
stloc.2 <null>
ldloc.2 <null>
brfalse.s IL_0064: ldc.i4.2
ldc.i4.7 <null>
stloc.s V_4
br.s IL_0003: ldloc.s V_4
ldc.i4.2 <null>
br.s IL_0060: stloc.s V_4
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
nop <null>
ldc.i4.2 <null>
stloc.s V_4
br.s IL_0003: ldloc.s V_4
nop <null>
call System.Void yKk04ciBX5ox.fPy08xCsjK::Kep4xF3d2m_G()
nop <null>
nop <null>
ldc.i4.5 <null>
ldc.i4 1651415064
ldtoken 8tsDKm6r4.5rqCiTi
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
ldnull <null>
call System.String Ny6sbPa.rs3En8Rscg1B/Pay2w9Ydb.eJy6G1b_/wGo7Z.Kt5oki::nWi0Sm3azLq94(System.Int32,System.Int32,System.Type,Ny6sbPa.rs3En8Rscg1B/Pay2w9Ydb.eJy6G1b_/wGo7Z.Kt5oki)
nop <null>
ldc.i4.s 91
ldc.i4 844449
ldc.i4.6 <null>
ldnull <null>
call System.String oa1RY.1NoxGz2zyaF9wX::3fmLb1N(System.Char,System.Int32,System.Int32,oa1RY.1NoxGz2zyaF9wX)
call System.Void yKk04ciBX5ox.fPy08xCsjK::Sp5n9XyiR(System.String,System.String)
ldc.i4.3 <null>
stloc.s V_4
br IL_0003: ldloc.s V_4
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
newobj System.Void yKk04ciBX5ox.fPy08xCsjK::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
ldtoken System.Void yKk04ciBX5ox.fPy08xCsjK::6ctHioK5_9z()
pop <null>
ldsfld System.Byte[] Ai0yn1nP.yb7AcSo68qx::by4M9i
ldc.i4.s 16
ldsfld System.Byte[] Ai0yn1nP.yb7AcSo68qx::by4M9i
ldc.i4.s 16
ldelem.u1 <null>
ldsfld System.Byte[] Ai0yn1nP.yb7AcSo68qx::by4M9i
ldc.i4.s 22
ldelem.u1 <null>
xor <null>
ldc.i4.s 26
and <null>
stelem.i1 <null>
ret <null>
d245eadb186f026bc1bc70fd0e2273ac
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0032
ID:0
ID:0-preview.png
ID:0033
ID:0
ID:0034
ID:0
ID:0035
ID:0
ID:0036
ID:0
ID:0037
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
Genitalk.klaoxao.tiff
Za3mo1T.Resources.resources
9e5427e318a7c3.Resources.resources
7128b1b70
[NBF]root.Data
7128b1b71
[NBF]root.Data
7128b1b710
[NBF]root.Data
7128b1b711
[NBF]root.Data
7128b1b712
[NBF]root.Data
7128b1b713
[NBF]root.Data
7128b1b714
[NBF]root.Data
7128b1b715
[NBF]root.Data
7128b1b716
[NBF]root.Data
7128b1b717
[NBF]root.Data
7128b1b718
[NBF]root.Data
7128b1b719
[NBF]root.Data
7128b1b72
[NBF]root.Data
7128b1b720
[NBF]root.Data
7128b1b721
[NBF]root.Data
7128b1b722
[NBF]root.Data
7128b1b73
[NBF]root.Data
7128b1b74
[NBF]root.Data
7128b1b75
[NBF]root.Data
7128b1b76
[NBF]root.Data
7128b1b77
[NBF]root.Data
7128b1b78
[NBF]root.Data
7128b1b79
[NBF]root.Data
.Net Reflective Loader
Malicious
Genitalk.klaoxao.tiff [AES Decrypted]
Malicious
Overlay_ddd3db78.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
ObjectRequester.ScopeObject
ScheduledObject.ObjectParser
DecryptorCompressor.ControllableObject
AuditorMap.LocalObject
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙