Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
1.38 MB · 1,380,864 B
First seen
2026-03-02 19:16 · 8 months ago
Last seen
2026-03-02 19:16 · 8 months ago
Last analysis
2026-03-03 09:56 · 8 months ago
Hashes
MD5 ed22eea89ee3207e18847b0110e9c124 Sha1 351774e894c603bd12e23791d626cb11b522d215 Sha256 a874812d5f6518587a09b679236e71a2555702fb99458400613626651dc83f3b Sha384 025a1fc55546e5a2ee93bc6efe0b03681b5d78eaf75cd45ccd9b0f2dbef5292cb769737e4933f8a923e40096bf316913 Sha512 e6a78dd22de70248075b00517dc0d37baf64caa303097bd5b64898c2e015a956ef4d2dbb6f98b4bb55011e587565f192fa706c3628e7fdd9fc9bdc76073f94df SSDeep 24576:+rrja8tRItqUgF+lqQ3ly0hr7opz7TEXUPvQX0xJETK4T:+rrja8AtBgElqQ3kS7UnCUHQXOED TLSH 5E55332DAF97F4B5D2FFCABE2911D593927D1324EF941B2248A563EC3C43A358215C28
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Low
7 malicious · 94 files
EXEed22eea89ee3207e18847b0110e9c124XWorm
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN.Net Resources
BINdwwebfq.Resources
EXEUID BYPASS V1.0.exe
EXEUID BYPASS V1.0.exe [GZip Decompressed]AgentTesla
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN.Net Resources
BINNXR_UID_BYPASS_FOR_SELL_PROJECT.Form1.resources
ICON$this.Icon
BIN[NBF]root.IconData
BINguna2PictureBox3.Image
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINguna2PictureBox4.Image
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
LOGOshayanHeader1.Logo
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINnxr.NotificationForm.resources
0NXR_UID_BYPASS_FOR_SELL_PROJECT.c8750f0d.0
BINcostura.costura.dll.compressed
DLLcostura.costura.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.costura.pdb.compressed
PDBcostura.costura.pdb
BINcostura.guna.ui2.dll.compressed
DLLcostura.guna.ui2.dllAgentTesla
Structure
P7B[Authenticode]_28203e69.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
BING22190F0D5B1120504B3E00280003060D0F0F4F38724F222206070B01020F0F27012B0C.resources
BINicon.Image
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINGuna.UI2.Properties.Resources.resources
BINCheckedCheckbox_20px
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINCheckedRadioButton_20px
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINFullImage_64px
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINImageCalendar
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINUncheckedCheckbox_20px
BINUncheckedRadioButton_20px
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINce_48px
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINcurv3
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINcurv3_w
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINerror
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINinfo
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINlogo
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINlogo_w
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINmiring
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINquestion
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINwarning
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BING22190F0D5B1120504B250025230207091246250F300029390C06331B0E163B151735041C232100000E0B.resources
BINbtDown.Image
BINbtUp.Image
BINimageList1.ImageStream
DATA[NBF]root.Data
BINcostura.shayanui.dll.compressed
DLLcostura.shayanui.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.metadata
EXEsvchost.exe
EXEsvchost.exe [GZip Decompressed]XWorm
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
Config. Field Value
family xhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
uid.exe
Full Name
uid.exe
EntryPoint
System.Void Program::Main()
Scope Name
uid.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
uid
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
23
Main Method
System.Void Program::Main()
Main IL Instruction Count
57
Main IL 
ldc.i4 2000
call System.Void System.Threading.Thread::Sleep(System.Int32)
call System.Boolean Program::CreateMutex()
brtrue.s IL_001B: call System.Boolean Program::DetectVirtualMachine()
call System.Int32 System.Environment::get_ExitCode()
call System.Void System.Environment::Exit(System.Int32)
call System.Boolean Program::DetectVirtualMachine()
call System.Boolean Program::Emulator()
or <null>
call System.Boolean Program::DetectDebugger()
or <null>
call System.Boolean Program::DetectSandboxie()
or <null>
call System.Boolean Program::anyrun()
or <null>
brfalse.s IL_0040: leave.s IL_0050
ldnull <null>
call System.Void System.Environment::FailFast(System.String)
leave.s IL_0050: call System.Boolean Program::AdminCheck()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.0 <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0050: call System.Boolean Program::AdminCheck()
call System.Boolean Program::AdminCheck()
brtrue.s IL_00B1: ldnull
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
stloc.1 <null>
ldloc.1 <null>
call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
callvirt System.Diagnostics.ProcessModule System.Diagnostics.Process::get_MainModule()
callvirt System.String System.Diagnostics.ProcessModule::get_FileName()
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
ldloc.1 <null>
ldstr runas
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String)
ldloc.1 <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
ldloc.1 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
call System.Int32 System.Environment::get_ExitCode()
call System.Void System.Environment::Exit(System.Int32)
leave.s IL_00AF: br.s IL_00B8
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.2 <null>
call System.Int32 System.Environment::get_ExitCode()
call System.Void System.Environment::Exit(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00AF: br.s IL_00B8
br.s IL_00B8: ret
ldnull <null>
call System.Object Program::WorkF(System.Object)
pop <null>
ret <null>
Module Name
uid.exe
Full Name
uid.exe
EntryPoint
System.Void Program::Main()
Scope Name
uid.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
uid
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
23
Main Method
System.Void Program::Main()
Main IL Instruction Count
57
Main IL 
ldc.i4 2000
call System.Void System.Threading.Thread::Sleep(System.Int32)
call System.Boolean Program::CreateMutex()
brtrue.s IL_001B: call System.Boolean Program::DetectVirtualMachine()
call System.Int32 System.Environment::get_ExitCode()
call System.Void System.Environment::Exit(System.Int32)
call System.Boolean Program::DetectVirtualMachine()
call System.Boolean Program::Emulator()
or <null>
call System.Boolean Program::DetectDebugger()
or <null>
call System.Boolean Program::DetectSandboxie()
or <null>
call System.Boolean Program::anyrun()
or <null>
brfalse.s IL_0040: leave.s IL_0050
ldnull <null>
call System.Void System.Environment::FailFast(System.String)
leave.s IL_0050: call System.Boolean Program::AdminCheck()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.0 <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0050: call System.Boolean Program::AdminCheck()
call System.Boolean Program::AdminCheck()
brtrue.s IL_00B1: ldnull
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
stloc.1 <null>
ldloc.1 <null>
call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
callvirt System.Diagnostics.ProcessModule System.Diagnostics.Process::get_MainModule()
callvirt System.String System.Diagnostics.ProcessModule::get_FileName()
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
ldloc.1 <null>
ldstr runas
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String)
ldloc.1 <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
ldloc.1 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
call System.Int32 System.Environment::get_ExitCode()
call System.Void System.Environment::Exit(System.Int32)
leave.s IL_00AF: br.s IL_00B8
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.2 <null>
call System.Int32 System.Environment::get_ExitCode()
call System.Void System.Environment::Exit(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00AF: br.s IL_00B8
br.s IL_00B8: ret
ldnull <null>
call System.Object Program::WorkF(System.Object)
pop <null>
ret <null>
7 malicious · 94 files
EXEed22eea89ee3207e18847b0110e9c124XWorm
Structure
BIN.Net Resources
BINdwwebfq.Resources
EXEUID BYPASS V1.0.exe
EXEUID BYPASS V1.0.exe [GZip Decompressed]AgentTesla
Structure
BIN.Net Resources
BINnxr.NotificationForm.resources
0NXR_UID_BYPASS_FOR_SELL_PROJECT.c8750f0d.0
BINcostura.costura.dll.compressed
BINcostura.costura.pdb.compressed
PDBcostura.costura.pdb
BINcostura.guna.ui2.dll.compressed
DLLcostura.guna.ui2.dllAgentTesla
Structure
P7B[Authenticode]_28203e69.p7b
BINcostura.shayanui.dll.compressed
BINcostura.metadata
EXEsvchost.exe
EXEsvchost.exe [GZip Decompressed]XWorm
Structure
Config. Field Value
family xhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙