Suspicious
Suspect

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very low
MD5 d60a896d12160161fa29fabc2c4abc7d
Sha1 9f46f8d8dddeb761dcf96058b3a31688b5fdf552
Sha256 10aa2fc4e6f97c189c0cb40f17e51df63c309be715eacbfc7e695394c69549f8
Sha384 784c0e4b9595abb0d6e9461dccf42e34d17ddeaa191c71746879de7af044adcd656f881d81baa5cfd306473f5cae4b0b
Sha512 75de180675157b3227c16f6f6be89776f8d4788d1cbe08988b786eccdbc94a4a2a25f44bf2331b111f0ca3a351e982f3f16bf9c49f85b622e391064f51ddb6c8
SSDeep 49152:7lm9N8DfgVUBsHjkmiGWU5+5WeLGpMZ7iKPyg0asWfTSwgW:LfgVUyHjkDGjYQeqpgm4NfTSu
TLSH 8706CF017BE5DE1BE1AF57B2B4B247100771EC95A792EB0A1D9036EC1CB3740AD1A39B
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
d60a896d12160161fa29fabc2c4abc7d
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Client.Properties.Resources.resources
Commands
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Commands.Forms.Chat.resources
$this.Icon
[NBF]root.IconData
imageList1.ImageStream
[NBF]root.Data
Commands.Forms.Games.MineSweeper.resources
Commands.Forms.InputBlock.resources
$this.Icon
[NBF]root.IconData
Commands.Forms.LockScreen.resources
$this.Icon
[NBF]root.IconData
Commands.Properties.Resources.resources
MALG102-deluxe-billy-prop-closeup_jpg-removebg-preview
[NBF]root.Data
[NBF]root.Data-preview.png
cat
[NBF]root.Data
[NBF]root.Data-preview.png
result
[NBF]root.Data
[NBF]root.Data-preview.png
screamer
[NBF]root.Data
[NBF]root.Data-preview.png
screamerAudio
tumblr_136e6a239bac2739768f0067f7c3df4b_5344d85d_1280
[NBF]root.Data
[NBF]root.Data-preview.png
AForge.Video.DirectShow.Properties.Resources.resources
camera
[NBF]root.Data
[NBF]root.Data-preview.png
AForge.Video.DirectShow.VideoCaptureDeviceForm.resources
FxResources.Microsoft.Win32.Registry.SR.resources
NAudio.WinForms.Gui.PanSlider.resources
$this.DefaultModifiers
$this.GridSize
$this.Language
NAudio.WinForms.Gui.VolumeSlider.resources
FxResources.System.Buffers.SR.resources
FxResources.System.Memory.SR.resources
FxResources.System.Numerics.Vectors.SR.resources
FxResources.System.Security.AccessControl.SR.resources
System.Security.Principal.Windows.xml
System.Text.Encodings.Web.xml
FxResources.System.Text.Json.SR.resources
System.Text.Json.xml
costura.costura.dll.compressed
costura.costura.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.costura.pdb.compressed
costura.costura.pdb
costura.messagepacklib.dll.compressed
costura.messagepacklib.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.system.buffers.dll.compressed
costura.system.buffers.dll
[Authenticode]_8c38879e.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.metadata
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
clientForCrypters.exe
Full Name
clientForCrypters.exe
EntryPoint
System.Void Program::Main()
Scope Name
clientForCrypters.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
clientForCrypters
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
726
Main Method
System.Void Program::Main()
Main IL Instruction Count
45
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
ldsfld System.Int32 Config::Delay
ldc.i4 1000
mul <null>
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldsfld System.Boolean Config::HideFile
brfalse.s IL_0027: call System.Boolean MutexControl::CreateMutex()
call System.Void HideClient::Execute()
call System.Boolean MutexControl::CreateMutex()
brtrue.s IL_0034: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
newobj System.Void SillyClient::.ctor()
stsfld SillyClient Program::client
leave.s IL_0044: ldsfld System.Action Program/<>c::<>9__1_0
pop <null>
leave.s IL_0098: ret
ldsfld System.Action Program/<>c::<>9__1_0
dup <null>
brtrue.s IL_0063: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
ldsfld Program/<>c Program/<>c::<>9
ldftn System.Void Program/<>c::<Main>b__1_0()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action Program/<>c::<>9__1_0
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
ldsfld System.Func`1<System.Threading.Tasks.Task> Program/<>c::<>9__1_1
dup <null>
brtrue.s IL_0088: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Func`1<System.Threading.Tasks.Task>)
pop <null>
ldsfld Program/<>c Program/<>c::<>9
ldftn System.Threading.Tasks.Task Program/<>c::<Main>b__1_1()
newobj System.Void System.Func`1<System.Threading.Tasks.Task>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`1<System.Threading.Tasks.Task> Program/<>c::<>9__1_1
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Func`1<System.Threading.Tasks.Task>)
pop <null>
newobj System.Void System.Windows.Forms.ApplicationContext::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.ApplicationContext)
ret <null>
Module Name
clientForCrypters.exe
Full Name
clientForCrypters.exe
EntryPoint
System.Void Program::Main()
Scope Name
clientForCrypters.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
clientForCrypters
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
726
Main Method
System.Void Program::Main()
Main IL Instruction Count
45
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
ldsfld System.Int32 Config::Delay
ldc.i4 1000
mul <null>
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldsfld System.Boolean Config::HideFile
brfalse.s IL_0027: call System.Boolean MutexControl::CreateMutex()
call System.Void HideClient::Execute()
call System.Boolean MutexControl::CreateMutex()
brtrue.s IL_0034: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
newobj System.Void SillyClient::.ctor()
stsfld SillyClient Program::client
leave.s IL_0044: ldsfld System.Action Program/<>c::<>9__1_0
pop <null>
leave.s IL_0098: ret
ldsfld System.Action Program/<>c::<>9__1_0
dup <null>
brtrue.s IL_0063: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
ldsfld Program/<>c Program/<>c::<>9
ldftn System.Void Program/<>c::<Main>b__1_0()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action Program/<>c::<>9__1_0
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
ldsfld System.Func`1<System.Threading.Tasks.Task> Program/<>c::<>9__1_1
dup <null>
brtrue.s IL_0088: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Func`1<System.Threading.Tasks.Task>)
pop <null>
ldsfld Program/<>c Program/<>c::<>9
ldftn System.Threading.Tasks.Task Program/<>c::<Main>b__1_1()
newobj System.Void System.Func`1<System.Threading.Tasks.Task>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`1<System.Threading.Tasks.Task> Program/<>c::<>9__1_1
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Func`1<System.Threading.Tasks.Task>)
pop <null>
newobj System.Void System.Windows.Forms.ApplicationContext::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.ApplicationContext)
ret <null>
d60a896d12160161fa29fabc2c4abc7d
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Client.Properties.Resources.resources
Commands
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Commands.Forms.Chat.resources
$this.Icon
[NBF]root.IconData
imageList1.ImageStream
[NBF]root.Data
Commands.Forms.Games.MineSweeper.resources
Commands.Forms.InputBlock.resources
$this.Icon
[NBF]root.IconData
Commands.Forms.LockScreen.resources
$this.Icon
[NBF]root.IconData
Commands.Properties.Resources.resources
MALG102-deluxe-billy-prop-closeup_jpg-removebg-preview
[NBF]root.Data
[NBF]root.Data-preview.png
cat
[NBF]root.Data
[NBF]root.Data-preview.png
result
[NBF]root.Data
[NBF]root.Data-preview.png
screamer
[NBF]root.Data
[NBF]root.Data-preview.png
screamerAudio
tumblr_136e6a239bac2739768f0067f7c3df4b_5344d85d_1280
[NBF]root.Data
[NBF]root.Data-preview.png
AForge.Video.DirectShow.Properties.Resources.resources
camera
[NBF]root.Data
[NBF]root.Data-preview.png
AForge.Video.DirectShow.VideoCaptureDeviceForm.resources
FxResources.Microsoft.Win32.Registry.SR.resources
NAudio.WinForms.Gui.PanSlider.resources
$this.DefaultModifiers
$this.GridSize
$this.Language
NAudio.WinForms.Gui.VolumeSlider.resources
FxResources.System.Buffers.SR.resources
FxResources.System.Memory.SR.resources
FxResources.System.Numerics.Vectors.SR.resources
FxResources.System.Security.AccessControl.SR.resources
System.Security.Principal.Windows.xml
System.Text.Encodings.Web.xml
FxResources.System.Text.Json.SR.resources
System.Text.Json.xml
costura.costura.dll.compressed
costura.costura.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.costura.pdb.compressed
costura.costura.pdb
costura.messagepacklib.dll.compressed
costura.messagepacklib.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.system.buffers.dll.compressed
costura.system.buffers.dll
[Authenticode]_8c38879e.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.metadata
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙