Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 df8e26f66145f175ecff2cef4ee76b01
Sha1 18d4c8b9aa9034fa358fb580713a5a7534176110
Sha256 7f1c566eee880bce9a3f80880badee548b53ab3aded225c654faeff9cf0349df
Sha384 a7d41c0ce06afce86298dbf8c252575755f29f20dc459d58fa91b1edeeb558a04e7e84dd04eafb37e26ee8989bdd3a50
Sha512 54590e41d6a807c127c27a8818a208fd61b9adcfc95f97b31fe98d1345212b492e220c1dc674025e1017f85d6981e7e8c97c79d1f18f7d12620293078df0b57d
SSDeep 12288:yF6htfT2CPpHAP/iGc1ZOM+FhWF2hekxpp4yy8G1R12Vg5CaCThajRlbrjV:f2UxAPqGcv/+Duyx4N0aYa95
TLSH 3D45F12549461635CA3D0A75C1D974A813F0FEF39266E71A2EE830FDCBB3794A9D7082
PeID
.NET executableHQR data fileMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
df8e26f66145f175ecff2cef4ee76b01
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0032
ID:0
ID:0-preview.png
ID:0033
ID:0
ID:0034
ID:0
ID:0035
ID:0
ID:0036
ID:0
ID:0037
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
Genitalk.klaoxao.tiff
8qqKQi.Resources.resources
c6564518ea51a1.Resources.resources
c0ba2a0f0
[NBF]root.Data
c0ba2a0f1
[NBF]root.Data
c0ba2a0f10
[NBF]root.Data
c0ba2a0f11
[NBF]root.Data
c0ba2a0f12
[NBF]root.Data
c0ba2a0f13
[NBF]root.Data
c0ba2a0f14
[NBF]root.Data
c0ba2a0f15
[NBF]root.Data
c0ba2a0f16
[NBF]root.Data
c0ba2a0f17
[NBF]root.Data
c0ba2a0f18
[NBF]root.Data
c0ba2a0f19
[NBF]root.Data
c0ba2a0f2
[NBF]root.Data
c0ba2a0f20
[NBF]root.Data
c0ba2a0f21
[NBF]root.Data
c0ba2a0f22
[NBF]root.Data
c0ba2a0f3
[NBF]root.Data
c0ba2a0f4
[NBF]root.Data
c0ba2a0f5
[NBF]root.Data
c0ba2a0f6
[NBF]root.Data
c0ba2a0f7
[NBF]root.Data
c0ba2a0f8
[NBF]root.Data
c0ba2a0f9
[NBF]root.Data
.Net Reflective Loader
Malicious
Genitalk.klaoxao.tiff [AES Decrypted]
Malicious
Overlay_ddd3db78.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
ObjectRequester.ScopeObject
ScheduledObject.ObjectParser
DecryptorCompressor.ControllableObject
AuditorMap.LocalObject
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
5 / 5
Path pe:exe>pe:dll>pe:rsrc>bin
Shape pe:exe>pe:dll>pe:rsrc>bin
malicious 4 nodes
Path pe:exe>pe:dll>bin
Shape pe:exe>pe:dll>bin
malicious 3 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
8qqKQi
Full Name
8qqKQi
EntryPoint
System.Void wc3BYfz17.Mn1an8T::Jra02TegXr8q()
Scope Name
8qqKQi
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
8qqKQi
Assembly Version
22.4.3.131
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void wc3BYfz17.Mn1an8T::Jra02TegXr8q()
Main IL Instruction Count
73
Main IL 
ldsfld System.Int32[] y_6E0Prnq2jKLq.iXf86okJicH0bQ::aJf4N1rgdq3Hy7
stloc.s V_5
ldc.i4.3 <null>
stloc.s V_4
ldloc.s V_4
switch dnlib.DotNet.Emit.Instruction[]
nop <null>
ldc.i4.s 25
ldc.i4.6 <null>
ldc.i4 2026
call System.DateTime Microsoft.VisualBasic.DateAndTime::DateSerial(System.Int32,System.Int32,System.Int32)
stloc.0 <null>
ldloca.s V_1
initobj Microsoft.VisualBasic.FirstDayOfWeek
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldloc.s V_5
ldc.i4.s 62
ldelem.i4 <null>
ldc.i4 52067
sub <null>
stloc.s V_4
br.s IL_000A: ldloc.s V_4
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
call System.Boolean wc3BYfz17.Mn1an8T::Nj5q0Bpc_6mM()
ldc.i4.0 <null>
ceq <null>
stloc.2 <null>
ldloc.2 <null>
brfalse.s IL_0075: ldc.i4.6
ldc.i4.0 <null>
stloc.s V_4
br.s IL_000A: ldloc.s V_4
ldc.i4.6 <null>
br.s IL_0071: stloc.s V_4
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
nop <null>
ldc.i4.6 <null>
stloc.s V_4
br.s IL_000A: ldloc.s V_4
nop <null>
call System.Void wc3BYfz17.Mn1an8T::kQe8Zq3()
nop <null>
nop <null>
ldc.i4 1501028818
ldc.i4.8 <null>
ldtoken Xay15iS.Kn2oz1S/oi7P8Wdcw.2opPx
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
call System.String Eis08Dqcj5T.Ls7py1xZ2Kwct9::4Xtzk9wA3eSy(System.Int32,System.Int32,System.Type)
nop <null>
ldc.i4.0 <null>
ldnull <null>
ldc.i4 1960383218
call System.String Emt91rPceg8.Kk7fbEm::2PmsQeb7fr1XNb(System.Int32,Emt91rPceg8.Kk7fbEm,System.Int32)
call System.Void wc3BYfz17.Mn1an8T::6kkCK2pq5(System.String,System.String)
ldc.i4.4 <null>
stloc.s V_4
br IL_000A: ldloc.s V_4
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
newobj System.Void wc3BYfz17.Mn1an8T::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
ldtoken System.Void wc3BYfz17.Mn1an8T::Jra02TegXr8q()
pop <null>
ret <null>
Module Name
8qqKQi
Full Name
8qqKQi
EntryPoint
System.Void wc3BYfz17.Mn1an8T::Jra02TegXr8q()
Scope Name
8qqKQi
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
8qqKQi
Assembly Version
22.4.3.131
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void wc3BYfz17.Mn1an8T::Jra02TegXr8q()
Main IL Instruction Count
73
Main IL 
ldsfld System.Int32[] y_6E0Prnq2jKLq.iXf86okJicH0bQ::aJf4N1rgdq3Hy7
stloc.s V_5
ldc.i4.3 <null>
stloc.s V_4
ldloc.s V_4
switch dnlib.DotNet.Emit.Instruction[]
nop <null>
ldc.i4.s 25
ldc.i4.6 <null>
ldc.i4 2026
call System.DateTime Microsoft.VisualBasic.DateAndTime::DateSerial(System.Int32,System.Int32,System.Int32)
stloc.0 <null>
ldloca.s V_1
initobj Microsoft.VisualBasic.FirstDayOfWeek
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldloc.s V_5
ldc.i4.s 62
ldelem.i4 <null>
ldc.i4 52067
sub <null>
stloc.s V_4
br.s IL_000A: ldloc.s V_4
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
call System.Boolean wc3BYfz17.Mn1an8T::Nj5q0Bpc_6mM()
ldc.i4.0 <null>
ceq <null>
stloc.2 <null>
ldloc.2 <null>
brfalse.s IL_0075: ldc.i4.6
ldc.i4.0 <null>
stloc.s V_4
br.s IL_000A: ldloc.s V_4
ldc.i4.6 <null>
br.s IL_0071: stloc.s V_4
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
nop <null>
ldc.i4.6 <null>
stloc.s V_4
br.s IL_000A: ldloc.s V_4
nop <null>
call System.Void wc3BYfz17.Mn1an8T::kQe8Zq3()
nop <null>
nop <null>
ldc.i4 1501028818
ldc.i4.8 <null>
ldtoken Xay15iS.Kn2oz1S/oi7P8Wdcw.2opPx
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
call System.String Eis08Dqcj5T.Ls7py1xZ2Kwct9::4Xtzk9wA3eSy(System.Int32,System.Int32,System.Type)
nop <null>
ldc.i4.0 <null>
ldnull <null>
ldc.i4 1960383218
call System.String Emt91rPceg8.Kk7fbEm::2PmsQeb7fr1XNb(System.Int32,Emt91rPceg8.Kk7fbEm,System.Int32)
call System.Void wc3BYfz17.Mn1an8T::6kkCK2pq5(System.String,System.String)
ldc.i4.4 <null>
stloc.s V_4
br IL_000A: ldloc.s V_4
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
newobj System.Void wc3BYfz17.Mn1an8T::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
ldtoken System.Void wc3BYfz17.Mn1an8T::Jra02TegXr8q()
pop <null>
ret <null>
df8e26f66145f175ecff2cef4ee76b01
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0032
ID:0
ID:0-preview.png
ID:0033
ID:0
ID:0034
ID:0
ID:0035
ID:0
ID:0036
ID:0
ID:0037
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
Genitalk.klaoxao.tiff
8qqKQi.Resources.resources
c6564518ea51a1.Resources.resources
c0ba2a0f0
[NBF]root.Data
c0ba2a0f1
[NBF]root.Data
c0ba2a0f10
[NBF]root.Data
c0ba2a0f11
[NBF]root.Data
c0ba2a0f12
[NBF]root.Data
c0ba2a0f13
[NBF]root.Data
c0ba2a0f14
[NBF]root.Data
c0ba2a0f15
[NBF]root.Data
c0ba2a0f16
[NBF]root.Data
c0ba2a0f17
[NBF]root.Data
c0ba2a0f18
[NBF]root.Data
c0ba2a0f19
[NBF]root.Data
c0ba2a0f2
[NBF]root.Data
c0ba2a0f20
[NBF]root.Data
c0ba2a0f21
[NBF]root.Data
c0ba2a0f22
[NBF]root.Data
c0ba2a0f3
[NBF]root.Data
c0ba2a0f4
[NBF]root.Data
c0ba2a0f5
[NBF]root.Data
c0ba2a0f6
[NBF]root.Data
c0ba2a0f7
[NBF]root.Data
c0ba2a0f8
[NBF]root.Data
c0ba2a0f9
[NBF]root.Data
.Net Reflective Loader
Malicious
Genitalk.klaoxao.tiff [AES Decrypted]
Malicious
Overlay_ddd3db78.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
ObjectRequester.ScopeObject
ScheduledObject.ObjectParser
DecryptorCompressor.ControllableObject
AuditorMap.LocalObject
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙