Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
1 malicious · 3 files
EXEd7c7cb74a58d55cd82e204b931592e2eXWorm
Structure
Config. Field Value
KEY 1aNUAShuhuhuhuhuhuhu
USBNM riwhsAhuhuhuhuhuhuhu
family xhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
GhostClient.exe
Full Name
GhostClient.exe
EntryPoint
System.Void Stub.tOΔUAΩYOPDQψ1FC3CIG::V8qp6HΔrSX3Xt4OΠPZR9AR()
Scope Name
GhostClient.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
GhostClient
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
562
Main Method
System.Void Stub.tOΔUAΩYOPDQψ1FC3CIG::V8qp6HΔrSX3Xt4OΠPZR9AR()
Main IL Instruction Count
58
Main IL 
ldsfld System.Int32 AVqr7ξAt0Eλ9Πζ7::WΘYξΠΦBIΣsMSNMG
ldc.i4 1000
mul.ovf <null>
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldsfld System.String AVqr7ξAt0Eλ9Πζ7::qYxC5sHQμλL5Π5Δ7HKHΣtζxξ2I
call System.Object Stub.DΠYYJζμAspp9ξxFppζt8HLBψλ1::GpxEpG5ψx4Πμ28C589(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String AVqr7ξAt0Eλ9Πζ7::qYxC5sHQμλL5Π5Δ7HKHΣtζxξ2I
ldsfld System.String AVqr7ξAt0Eλ9Πζ7::FΠI7988HΠ6ETEJWζL
call System.Object Stub.DΠYYJζμAspp9ξxFppζt8HLBψλ1::GpxEpG5ψx4Πμ28C589(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String AVqr7ξAt0Eλ9Πζ7::FΠI7988HΠ6ETEJWζL
ldsfld System.String AVqr7ξAt0Eλ9Πζ7::USQPpEM3REpLT6S4X7S
call System.Object Stub.DΠYYJζμAspp9ξxFppζt8HLBψλ1::GpxEpG5ψx4Πμ28C589(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String AVqr7ξAt0Eλ9Πζ7::USQPpEM3REpLT6S4X7S
ldsfld System.String AVqr7ξAt0Eλ9Πζ7::44ZOQIGλUVxΠV2IQRψNEΦ
call System.Object Stub.DΠYYJζμAspp9ξxFppζt8HLBψλ1::GpxEpG5ψx4Πμ28C589(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String AVqr7ξAt0Eλ9Πζ7::44ZOQIGλUVxΠV2IQRψNEΦ
ldsfld System.String AVqr7ξAt0Eλ9Πζ7::trKrΣ1WFSζYsC1λ0JPAs4rLψQ4
call System.Object Stub.DΠYYJζμAspp9ξxFppζt8HLBψλ1::GpxEpG5ψx4Πμ28C589(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String AVqr7ξAt0Eλ9Πζ7::trKrΣ1WFSζYsC1λ0JPAs4rLψQ4
ldsfld System.String AVqr7ξAt0Eλ9Πζ7::XXsSQS2S2KP0ΠYXs7EKSψHΦV
call System.Object Stub.DΠYYJζμAspp9ξxFppζt8HLBψλ1::GpxEpG5ψx4Πμ28C589(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String AVqr7ξAt0Eλ9Πζ7::XXsSQS2S2KP0ΠYXs7EKSψHΦV
leave.s IL_009E: call System.Boolean Stub.IΩBζCAψULψξZArV64UBs::5Q0KD9A9λNΘΩJPΦBEtOTSP()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.2 <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_009E: call System.Boolean Stub.IΩBζCAψULψξZArV64UBs::5Q0KD9A9λNΘΩJPΦBEtOTSP()
call System.Boolean Stub.IΩBζCAψULψξZArV64UBs::5Q0KD9A9λNΘΩJPΦBEtOTSP()
brtrue.s IL_00AB: call System.Void Stub.IΩBζCAψULψξZArV64UBs::VGIBJI9μHLQXWZZYλ25DBλPBξpλμ()
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Stub.IΩBζCAψULψξZArV64UBs::VGIBJI9μHLQXWZZYλ25DBλPBξpλμ()
ldnull <null>
ldftn System.Void Stub.tOΔUAΩYOPDQψ1FC3CIG::AZψXΔFrZxRIEΣΩ6M()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.0 <null>
ldnull <null>
ldftn System.Void Stub.tOΔUAΩYOPDQψ1FC3CIG::WC1E1GSΦX1W1CΩKKNDBH()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.1 <null>
ldloc.0 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.1 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.1 <null>
callvirt System.Void System.Threading.Thread::Join()
ret <null>
Module Name
GhostClient.exe
Full Name
GhostClient.exe
EntryPoint
System.Void Stub.tOΔUAΩYOPDQψ1FC3CIG::V8qp6HΔrSX3Xt4OΠPZR9AR()
Scope Name
GhostClient.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
GhostClient
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
562
Main Method
System.Void Stub.tOΔUAΩYOPDQψ1FC3CIG::V8qp6HΔrSX3Xt4OΠPZR9AR()
Main IL Instruction Count
58
Main IL 
ldsfld System.Int32 AVqr7ξAt0Eλ9Πζ7::WΘYξΠΦBIΣsMSNMG
ldc.i4 1000
mul.ovf <null>
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldsfld System.String AVqr7ξAt0Eλ9Πζ7::qYxC5sHQμλL5Π5Δ7HKHΣtζxξ2I
call System.Object Stub.DΠYYJζμAspp9ξxFppζt8HLBψλ1::GpxEpG5ψx4Πμ28C589(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String AVqr7ξAt0Eλ9Πζ7::qYxC5sHQμλL5Π5Δ7HKHΣtζxξ2I
ldsfld System.String AVqr7ξAt0Eλ9Πζ7::FΠI7988HΠ6ETEJWζL
call System.Object Stub.DΠYYJζμAspp9ξxFppζt8HLBψλ1::GpxEpG5ψx4Πμ28C589(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String AVqr7ξAt0Eλ9Πζ7::FΠI7988HΠ6ETEJWζL
ldsfld System.String AVqr7ξAt0Eλ9Πζ7::USQPpEM3REpLT6S4X7S
call System.Object Stub.DΠYYJζμAspp9ξxFppζt8HLBψλ1::GpxEpG5ψx4Πμ28C589(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String AVqr7ξAt0Eλ9Πζ7::USQPpEM3REpLT6S4X7S
ldsfld System.String AVqr7ξAt0Eλ9Πζ7::44ZOQIGλUVxΠV2IQRψNEΦ
call System.Object Stub.DΠYYJζμAspp9ξxFppζt8HLBψλ1::GpxEpG5ψx4Πμ28C589(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String AVqr7ξAt0Eλ9Πζ7::44ZOQIGλUVxΠV2IQRψNEΦ
ldsfld System.String AVqr7ξAt0Eλ9Πζ7::trKrΣ1WFSζYsC1λ0JPAs4rLψQ4
call System.Object Stub.DΠYYJζμAspp9ξxFppζt8HLBψλ1::GpxEpG5ψx4Πμ28C589(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String AVqr7ξAt0Eλ9Πζ7::trKrΣ1WFSζYsC1λ0JPAs4rLψQ4
ldsfld System.String AVqr7ξAt0Eλ9Πζ7::XXsSQS2S2KP0ΠYXs7EKSψHΦV
call System.Object Stub.DΠYYJζμAspp9ξxFppζt8HLBψλ1::GpxEpG5ψx4Πμ28C589(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String AVqr7ξAt0Eλ9Πζ7::XXsSQS2S2KP0ΠYXs7EKSψHΦV
leave.s IL_009E: call System.Boolean Stub.IΩBζCAψULψξZArV64UBs::5Q0KD9A9λNΘΩJPΦBEtOTSP()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.2 <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_009E: call System.Boolean Stub.IΩBζCAψULψξZArV64UBs::5Q0KD9A9λNΘΩJPΦBEtOTSP()
call System.Boolean Stub.IΩBζCAψULψξZArV64UBs::5Q0KD9A9λNΘΩJPΦBEtOTSP()
brtrue.s IL_00AB: call System.Void Stub.IΩBζCAψULψξZArV64UBs::VGIBJI9μHLQXWZZYλ25DBλPBξpλμ()
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Stub.IΩBζCAψULψξZArV64UBs::VGIBJI9μHLQXWZZYλ25DBλPBξpλμ()
ldnull <null>
ldftn System.Void Stub.tOΔUAΩYOPDQψ1FC3CIG::AZψXΔFrZxRIEΣΩ6M()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.0 <null>
ldnull <null>
ldftn System.Void Stub.tOΔUAΩYOPDQψ1FC3CIG::WC1E1GSΦX1W1CΩKKNDBH()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.1 <null>
ldloc.0 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.1 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.1 <null>
callvirt System.Void System.Threading.Thread::Join()
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙