Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
1 malicious · 3 files
EXEd5e353f68036520c1f8345a14b2aa228AsyncRAT
Structure
Config. Field Value
Key (AES_256) -huhuhuhu
Pastebin -huhuhuhu
Certificate MIIE8jhuhuhuhuhuhuhuhuhuhuhu
Install fhuhuhuhu
Install-Folder %Aphuhuhuhu
Hosts socolihuhuhuhuhuhuhuhuhuhuhu
Ports 443,66huhuhuhuhuhuhuhuhuhuhu
Mutex t3G5huhuhuhu
Version 0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
nIiucJKnHPXu
Full Name
nIiucJKnHPXu
EntryPoint
System.Void MjvDPlISqpSWnE.FejvJtCxHe::Main()
Scope Name
nIiucJKnHPXu
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
stubclient
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
120
Main Method
System.Void MjvDPlISqpSWnE.FejvJtCxHe::Main()
Main IL Instruction Count
51
Main IL 
ldc.i4.0 <null>
stloc.0 <null>
br IL_0015: ldloc.0
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
ldc.i4.1 <null>
add <null>
stloc.0 <null>
ldloc.0 <null>
ldsfld System.String MjvDPlISqpSWnE.kVaOxVYIJs::vZssotYEPlLr
call System.Int32 System.Convert::ToInt32(System.String)
blt.s IL_0007: ldc.i4 1000
call System.Boolean MjvDPlISqpSWnE.kVaOxVYIJs::zsaObGVEdOym()
brtrue IL_0032: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Boolean ZiFxybvkRtxoxRT.zWikuryaosS::ZUBLVZcYzacaL()
brtrue IL_0043: ldsfld System.String MjvDPlISqpSWnE.kVaOxVYIJs::nRRfgRHzGvb
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String MjvDPlISqpSWnE.kVaOxVYIJs::nRRfgRHzGvb
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_0057: ldsfld System.String MjvDPlISqpSWnE.kVaOxVYIJs::exTDgynGkaCiZP
call System.Void ZiFxybvkRtxoxRT.CRsooLOKkD::TuMgkjBnqH()
ldsfld System.String MjvDPlISqpSWnE.kVaOxVYIJs::exTDgynGkaCiZP
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_006B: ldsfld System.String MjvDPlISqpSWnE.kVaOxVYIJs::cNoaPuSbohy
call System.Void RweGXSdOQrrQF.YgtBLiDRcEHKpdb::uUMCkyJpIjXEFS()
ldsfld System.String MjvDPlISqpSWnE.kVaOxVYIJs::cNoaPuSbohy
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_0089: call System.Void ZiFxybvkRtxoxRT.VGBrUKVZxqltOj::ZtXuMhAAlK()
call System.Boolean ZiFxybvkRtxoxRT.VGBrUKVZxqltOj::aFVYzvWXYRcF()
brfalse IL_0089: call System.Void ZiFxybvkRtxoxRT.VGBrUKVZxqltOj::ZtXuMhAAlK()
call System.Void ZiFxybvkRtxoxRT.wgEWKbWXgwoo::EMjgeHcRXSHQE()
call System.Void ZiFxybvkRtxoxRT.VGBrUKVZxqltOj::ZtXuMhAAlK()
leave IL_0099: nop
pop <null>
leave IL_0099: nop
nop <null>
call System.Boolean ZKTigYiERlpcZ.TEjGuGHAVnxuGn::get_IsConnected()
brtrue IL_00AE: leave IL_00B9
call System.Void ZKTigYiERlpcZ.TEjGuGHAVnxuGn::qOvmwHfIBkVKs()
call System.Void ZKTigYiERlpcZ.TEjGuGHAVnxuGn::GZREXsZNNgESX()
leave IL_00B9: ldc.i4 5000
pop <null>
leave IL_00B9: ldc.i4 5000
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_0099: nop
Module Name
nIiucJKnHPXu
Full Name
nIiucJKnHPXu
EntryPoint
System.Void MjvDPlISqpSWnE.FejvJtCxHe::Main()
Scope Name
nIiucJKnHPXu
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
stubclient
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
120
Main Method
System.Void MjvDPlISqpSWnE.FejvJtCxHe::Main()
Main IL Instruction Count
51
Main IL 
ldc.i4.0 <null>
stloc.0 <null>
br IL_0015: ldloc.0
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
ldc.i4.1 <null>
add <null>
stloc.0 <null>
ldloc.0 <null>
ldsfld System.String MjvDPlISqpSWnE.kVaOxVYIJs::vZssotYEPlLr
call System.Int32 System.Convert::ToInt32(System.String)
blt.s IL_0007: ldc.i4 1000
call System.Boolean MjvDPlISqpSWnE.kVaOxVYIJs::zsaObGVEdOym()
brtrue IL_0032: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Boolean ZiFxybvkRtxoxRT.zWikuryaosS::ZUBLVZcYzacaL()
brtrue IL_0043: ldsfld System.String MjvDPlISqpSWnE.kVaOxVYIJs::nRRfgRHzGvb
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String MjvDPlISqpSWnE.kVaOxVYIJs::nRRfgRHzGvb
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_0057: ldsfld System.String MjvDPlISqpSWnE.kVaOxVYIJs::exTDgynGkaCiZP
call System.Void ZiFxybvkRtxoxRT.CRsooLOKkD::TuMgkjBnqH()
ldsfld System.String MjvDPlISqpSWnE.kVaOxVYIJs::exTDgynGkaCiZP
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_006B: ldsfld System.String MjvDPlISqpSWnE.kVaOxVYIJs::cNoaPuSbohy
call System.Void RweGXSdOQrrQF.YgtBLiDRcEHKpdb::uUMCkyJpIjXEFS()
ldsfld System.String MjvDPlISqpSWnE.kVaOxVYIJs::cNoaPuSbohy
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_0089: call System.Void ZiFxybvkRtxoxRT.VGBrUKVZxqltOj::ZtXuMhAAlK()
call System.Boolean ZiFxybvkRtxoxRT.VGBrUKVZxqltOj::aFVYzvWXYRcF()
brfalse IL_0089: call System.Void ZiFxybvkRtxoxRT.VGBrUKVZxqltOj::ZtXuMhAAlK()
call System.Void ZiFxybvkRtxoxRT.wgEWKbWXgwoo::EMjgeHcRXSHQE()
call System.Void ZiFxybvkRtxoxRT.VGBrUKVZxqltOj::ZtXuMhAAlK()
leave IL_0099: nop
pop <null>
leave IL_0099: nop
nop <null>
call System.Boolean ZKTigYiERlpcZ.TEjGuGHAVnxuGn::get_IsConnected()
brtrue IL_00AE: leave IL_00B9
call System.Void ZKTigYiERlpcZ.TEjGuGHAVnxuGn::qOvmwHfIBkVKs()
call System.Void ZKTigYiERlpcZ.TEjGuGHAVnxuGn::GZREXsZNNgESX()
leave IL_00B9: ldc.i4 5000
pop <null>
leave IL_00B9: ldc.i4 5000
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_0099: nop
Key (AES_256) MUTEXmalicious
-huhuhuhu
CnC CNCmalicious
socolhuhuhuhuhuhuhu
CnC CNCmalicious
azhuhuhuhu
CnC CNCmalicious
socolhuhuhuhuhuhuhu
CnC CNCmalicious
comhuhuhuhu
CnC CNCmalicious
capithuhuhuhuhuhuhu
CnC CNCmalicious
shorhuhuhuhu
CnC CNCmalicious
lokhuhuhuhu
CnC CNCmalicious
socohuhuhuhuhuhuhu
CnC CNCmalicious
cheathhuhuhuhuhuhuhu
CnC CNCmalicious
burmhuhuhuhu
CnC CNCmalicious
anciehuhuhuhuhuhuhu
CnC CNCmalicious
lohuhuhuhu
CnC CNCmalicious
drhuhuhuhu
CnC CNCmalicious
www.bahuhuhuhuhuhuhu
CnC CNCmalicious
www.nhuhuhuhuhuhuhu
CnC CNCmalicious
kahuhuhuhu
CnC CNCmalicious
quanthuhuhuhuhuhuhu
CnC CNCmalicious
davihuhuhuhu
CnC CNCmalicious
rarhuhuhuhu
CnC CNCmalicious
cryphuhuhuhuhuhuhu
CnC CNCmalicious
beveghuhuhuhuhuhuhu
CnC CNCmalicious
arkhuhuhuhu
CnC CNCmalicious
opehuhuhuhu
CnC CNCmalicious
thesphuhuhuhuhuhuhu
CnC CNCmalicious
nehuhuhuhu
CnC CNCmalicious
descarhuhuhuhuhuhuhu
CnC CNCmalicious
cardhuhuhuhu
CnC CNCmalicious
uptrhuhuhuhuhuhuhu
CnC CNCmalicious
chhuhuhuhu
CnC CNCmalicious
socolhuhuhuhuhuhuhu
CnC CNCmalicious
youhuhuhuhu
CnC CNCmalicious
www.whhuhuhuhuhuhuhu
CnC CNCmalicious
clubthuhuhuhuhuhuhu
CnC CNCmalicious
socohuhuhuhuhuhuhu
CnC CNCmalicious
www.dhuhuhuhuhuhuhu
CnC CNCmalicious
socohuhuhuhuhuhuhu
CnC CNCmalicious
gohuhuhuhu
CnC CNCmalicious
coinshuhuhuhuhuhuhu
CnC CNCmalicious
52huhuhuhu
CnC CNCmalicious
yuhuhuhuhu
CnC CNCmalicious
fahuhuhuhu
CnC CNCmalicious
ifrahuhuhuhuhuhuhu
CnC CNCmalicious
lehuhuhuhu
CnC CNCmalicious
kohuhuhuhu
CnC CNCmalicious
connhuhuhuhuhuhuhu
CnC CNCmalicious
www.huhuhuhuhuhuhu
CnC CNCmalicious
cophuhuhuhu
CnC CNCmalicious
skahuhuhuhu
CnC CNCmalicious
cbighuhuhuhu
CnC CNCmalicious
socolihuhuhuhuhuhuhu
CnC CNCmalicious
www.erhuhuhuhuhuhuhu
Ports PORTmalicious
4huhuhuhu
Ports PORTmalicious
6huhuhuhu
Ports PORTmalicious
7huhuhuhu
Ports PORTmalicious
8huhuhuhu
Ports PORTmalicious
8huhuhuhu
Ports PORTmalicious
8huhuhuhu
Ports PORTmalicious
4huhuhuhu
Ports PORTmalicious
5huhuhuhu
Ports PORTmalicious
5huhuhuhu
Ports PORTmalicious
5huhuhuhu
Ports PORTmalicious
5huhuhuhu
Ports PORTmalicious
6huhuhuhu
Ports PORTmalicious
6huhuhuhu
Ports PORTmalicious
6huhuhuhu
Ports PORTmalicious
6huhuhuhu
Ports PORTmalicious
6huhuhuhu
Ports PORTmalicious
6huhuhuhu
Ports PORTmalicious
6huhuhuhu
Ports PORTmalicious
6huhuhuhu
Ports PORTmalicious
6huhuhuhu
Mutex MUTEXmalicious
t3G5huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙