Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 eaff05ace23686b52695ea35367725fd
Sha1 3f81b9e39a7a60bd964308548dda75c1d7bc4350
Sha256 81c589fae253795f2a6625709d192409df2349b929b3ea692b8ea3af08767ffd
Sha384 a13829023b8c4076bcd794686d340cc4001a7d1afba54fa84416721c64690e5713d93b483f50709b0ee8c9f520eee763
Sha512 538ac4ccf1098f307b8f139446e4285dea08b51bcc729979783735523a28a0622663d704c3d2872e18615e8daacba716487d00b418e4eca9dcb9e1e0d5412732
SSDeep 24576:uO02UxAPqGcv/+Duyx42IPOr+e4ggVq3XOI0Nd:uFqPRcvEnyggiXOIO
TLSH 0D45F1256A866A56CB3E0B74C026488823F0CD52AA77E71F3EEDB0F85B737C52D17452
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
eaff05ace23686b52695ea35367725fd
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0032
ID:0
ID:0033
ID:0
ID:0034
ID:0
ID:0035
ID:0
ID:0036
ID:0
ID:0037
ID:0
ID:0038
ID:0
ID:0039
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
Genitalk.klaoxao.tiff
kf8A0aC.Resources.resources
d37f9d26237d6d.Resources.resources
0385c0d20
[NBF]root.Data
0385c0d21
[NBF]root.Data
0385c0d210
[NBF]root.Data
0385c0d211
[NBF]root.Data
0385c0d212
[NBF]root.Data
0385c0d213
[NBF]root.Data
0385c0d214
[NBF]root.Data
0385c0d215
[NBF]root.Data
0385c0d216
[NBF]root.Data
0385c0d217
[NBF]root.Data
0385c0d218
[NBF]root.Data
0385c0d219
[NBF]root.Data
0385c0d22
[NBF]root.Data
0385c0d23
[NBF]root.Data
0385c0d24
[NBF]root.Data
0385c0d25
[NBF]root.Data
0385c0d26
[NBF]root.Data
0385c0d27
[NBF]root.Data
0385c0d28
[NBF]root.Data
0385c0d29
[NBF]root.Data
.Net Reflective Loader
Malicious
Genitalk.klaoxao.tiff [AES Decrypted]
Malicious
Overlay_ddd3db78.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
ObjectRequester.ScopeObject
ScheduledObject.ObjectParser
DecryptorCompressor.ControllableObject
AuditorMap.LocalObject
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
4 / 4
Path pe:exe>pe:dll>pe:rsrc>bin
Shape pe:exe>pe:dll>pe:rsrc>bin
malicious 4 nodes
Path pe:exe>pe:dll>bin
Shape pe:exe>pe:dll>bin
malicious 3 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
kf8A0aC
Full Name
kf8A0aC
EntryPoint
System.Void Ay4_6dxQL.6FdwAoq30::Faz4zg7E()
Scope Name
kf8A0aC
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
kf8A0aC
Assembly Version
24.6.5.146
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void Ay4_6dxQL.6FdwAoq30::Faz4zg7E()
Main IL Instruction Count
80
Main IL 
ldc.i4.0 <null>
stloc.s V_4
ldloc.s V_4
switch dnlib.DotNet.Emit.Instruction[]
nop <null>
ldc.i4.s 25
ldc.i4.6 <null>
ldc.i4 2026
call System.DateTime Microsoft.VisualBasic.DateAndTime::DateSerial(System.Int32,System.Int32,System.Int32)
stloc.0 <null>
ldloca.s V_1
initobj Microsoft.VisualBasic.FirstDayOfWeek
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.1 <null>
stloc.s V_4
br.s IL_0003: ldloc.s V_4
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
call System.Boolean Ay4_6dxQL.6FdwAoq30::0Yorp1_SR()
ldc.i4.0 <null>
ceq <null>
stloc.2 <null>
ldloc.2 <null>
brfalse.s IL_0064: ldc.i4.5
ldc.i4.3 <null>
stloc.s V_4
br.s IL_0003: ldloc.s V_4
ldc.i4.5 <null>
br.s IL_0060: stloc.s V_4
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
nop <null>
ldc.i4.5 <null>
stloc.s V_4
br.s IL_0003: ldloc.s V_4
nop <null>
call System.Void Ay4_6dxQL.6FdwAoq30::in5JA6ra()
nop <null>
nop <null>
ldc.i4.6 <null>
ldc.i4 180171028
ldnull <null>
ldc.i4.s 11
call System.String Qw1is5L.bo8ANcf/dZt23dkG.Xfp8mn/Xn7wr0WmQa1qd.kMk20imSqQ1::2deQp_(System.Int32,System.Int32,System.Reflection.Assembly,System.Int32)
nop <null>
ldc.i8 10
ldc.i4.0 <null>
ldc.i4.s 60
ldc.i4 364895637
call System.String Qw1is5L.bo8ANcf::6XyjAg_5b9Zk7f(System.Int64,System.Int32,System.Char,System.Int32)
call System.Void Ay4_6dxQL.6FdwAoq30::0Qcqbf6EA(System.String,System.String)
ldc.i4.4 <null>
stloc.s V_4
br IL_0003: ldloc.s V_4
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
newobj System.Void Ay4_6dxQL.6FdwAoq30::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ldsfld System.Char[] 1Gzng9tXwkL.0mcPT7so3jmW::jXt72fT
ldc.i4 312
ldsfld System.Char[] 1Gzng9tXwkL.0mcPT7so3jmW::jXt72fT
ldc.i4 312
ldelem.u2 <null>
ldsfld System.Char[] 1Gzng9tXwkL.0mcPT7so3jmW::jXt72fT
ldc.i4 257
ldelem.u2 <null>
sub <null>
ldc.i4.s 118
and <null>
stelem.i2 <null>
ret <null>
ldtoken System.Void Ay4_6dxQL.6FdwAoq30::Faz4zg7E()
pop <null>
ret <null>
Module Name
kf8A0aC
Full Name
kf8A0aC
EntryPoint
System.Void Ay4_6dxQL.6FdwAoq30::Faz4zg7E()
Scope Name
kf8A0aC
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
kf8A0aC
Assembly Version
24.6.5.146
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void Ay4_6dxQL.6FdwAoq30::Faz4zg7E()
Main IL Instruction Count
80
Main IL 
ldc.i4.0 <null>
stloc.s V_4
ldloc.s V_4
switch dnlib.DotNet.Emit.Instruction[]
nop <null>
ldc.i4.s 25
ldc.i4.6 <null>
ldc.i4 2026
call System.DateTime Microsoft.VisualBasic.DateAndTime::DateSerial(System.Int32,System.Int32,System.Int32)
stloc.0 <null>
ldloca.s V_1
initobj Microsoft.VisualBasic.FirstDayOfWeek
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.1 <null>
stloc.s V_4
br.s IL_0003: ldloc.s V_4
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
call System.Boolean Ay4_6dxQL.6FdwAoq30::0Yorp1_SR()
ldc.i4.0 <null>
ceq <null>
stloc.2 <null>
ldloc.2 <null>
brfalse.s IL_0064: ldc.i4.5
ldc.i4.3 <null>
stloc.s V_4
br.s IL_0003: ldloc.s V_4
ldc.i4.5 <null>
br.s IL_0060: stloc.s V_4
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
nop <null>
ldc.i4.5 <null>
stloc.s V_4
br.s IL_0003: ldloc.s V_4
nop <null>
call System.Void Ay4_6dxQL.6FdwAoq30::in5JA6ra()
nop <null>
nop <null>
ldc.i4.6 <null>
ldc.i4 180171028
ldnull <null>
ldc.i4.s 11
call System.String Qw1is5L.bo8ANcf/dZt23dkG.Xfp8mn/Xn7wr0WmQa1qd.kMk20imSqQ1::2deQp_(System.Int32,System.Int32,System.Reflection.Assembly,System.Int32)
nop <null>
ldc.i8 10
ldc.i4.0 <null>
ldc.i4.s 60
ldc.i4 364895637
call System.String Qw1is5L.bo8ANcf::6XyjAg_5b9Zk7f(System.Int64,System.Int32,System.Char,System.Int32)
call System.Void Ay4_6dxQL.6FdwAoq30::0Qcqbf6EA(System.String,System.String)
ldc.i4.4 <null>
stloc.s V_4
br IL_0003: ldloc.s V_4
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
newobj System.Void Ay4_6dxQL.6FdwAoq30::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ldsfld System.Char[] 1Gzng9tXwkL.0mcPT7so3jmW::jXt72fT
ldc.i4 312
ldsfld System.Char[] 1Gzng9tXwkL.0mcPT7so3jmW::jXt72fT
ldc.i4 312
ldelem.u2 <null>
ldsfld System.Char[] 1Gzng9tXwkL.0mcPT7so3jmW::jXt72fT
ldc.i4 257
ldelem.u2 <null>
sub <null>
ldc.i4.s 118
and <null>
stelem.i2 <null>
ret <null>
ldtoken System.Void Ay4_6dxQL.6FdwAoq30::Faz4zg7E()
pop <null>
ret <null>
eaff05ace23686b52695ea35367725fd
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0032
ID:0
ID:0033
ID:0
ID:0034
ID:0
ID:0035
ID:0
ID:0036
ID:0
ID:0037
ID:0
ID:0038
ID:0
ID:0039
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
Genitalk.klaoxao.tiff
kf8A0aC.Resources.resources
d37f9d26237d6d.Resources.resources
0385c0d20
[NBF]root.Data
0385c0d21
[NBF]root.Data
0385c0d210
[NBF]root.Data
0385c0d211
[NBF]root.Data
0385c0d212
[NBF]root.Data
0385c0d213
[NBF]root.Data
0385c0d214
[NBF]root.Data
0385c0d215
[NBF]root.Data
0385c0d216
[NBF]root.Data
0385c0d217
[NBF]root.Data
0385c0d218
[NBF]root.Data
0385c0d219
[NBF]root.Data
0385c0d22
[NBF]root.Data
0385c0d23
[NBF]root.Data
0385c0d24
[NBF]root.Data
0385c0d25
[NBF]root.Data
0385c0d26
[NBF]root.Data
0385c0d27
[NBF]root.Data
0385c0d28
[NBF]root.Data
0385c0d29
[NBF]root.Data
.Net Reflective Loader
Malicious
Genitalk.klaoxao.tiff [AES Decrypted]
Malicious
Overlay_ddd3db78.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
ObjectRequester.ScopeObject
ScheduledObject.ObjectParser
DecryptorCompressor.ControllableObject
AuditorMap.LocalObject
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙