Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5: ed22eea89ee3207e18847b0110e9c124
Size: 1.38 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
1.38 MB · 1,380,864 B
First seen
2026-03-02 19:16 · 8 months ago
Last seen
2026-03-02 19:16 · 8 months ago
Last analysis
2026-03-03 09:56 · 8 months ago
Hashes
MD5 ed22eea89ee3207e18847b0110e9c124 Sha1 351774e894c603bd12e23791d626cb11b522d215 Sha256 a874812d5f6518587a09b679236e71a2555702fb99458400613626651dc83f3b Sha384 025a1fc55546e5a2ee93bc6efe0b03681b5d78eaf75cd45ccd9b0f2dbef5292cb769737e4933f8a923e40096bf316913 Sha512 e6a78dd22de70248075b00517dc0d37baf64caa303097bd5b64898c2e015a956ef4d2dbb6f98b4bb55011e587565f192fa706c3628e7fdd9fc9bdc76073f94df SSDeep 24576:+rrja8tRItqUgF+lqQ3ly0hr7opz7TEXUPvQX0xJETK4T:+rrja8AtBgElqQ3kS7UnCUHQXOED TLSH 5E55332DAF97F4B5D2FFCABE2911D593927D1324EF941B2248A563EC3C43A358215C28
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Low
7 malicious · 94 files
EXEed22eea89ee3207e18847b0110e9c124XWorm
Structure
BIN.Net Resources
BINdwwebfq.Resources
EXEUID BYPASS V1.0.exe
EXEUID BYPASS V1.0.exe [GZip Decompressed]AgentTesla
Structure
BIN.Net Resources
BINnxr.NotificationForm.resources
0NXR_UID_BYPASS_FOR_SELL_PROJECT.c8750f0d.0
BINcostura.costura.dll.compressed
BINcostura.costura.pdb.compressed
PDBcostura.costura.pdb
BINcostura.guna.ui2.dll.compressed
DLLcostura.guna.ui2.dllAgentTesla
Structure
P7B[Authenticode]_28203e69.p7b
BINcostura.shayanui.dll.compressed
BINcostura.metadata
EXEsvchost.exe
EXEsvchost.exe [GZip Decompressed]XWorm
Structure
Config. Field Value
family xhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
uid.exe
Full Name
uid.exe
EntryPoint
System.Void Program::Main()
Scope Name
uid.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
uid
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
23
Main Method
System.Void Program::Main()
Main IL Instruction Count
57
Main IL 
ldc.i4 2000
call System.Void System.Threading.Thread::Sleep(System.Int32)
call System.Boolean Program::CreateMutex()
brtrue.s IL_001B: call System.Boolean Program::DetectVirtualMachine()
call System.Int32 System.Environment::get_ExitCode()
call System.Void System.Environment::Exit(System.Int32)
call System.Boolean Program::DetectVirtualMachine()
call System.Boolean Program::Emulator()
or <null>
call System.Boolean Program::DetectDebugger()
or <null>
call System.Boolean Program::DetectSandboxie()
or <null>
call System.Boolean Program::anyrun()
or <null>
brfalse.s IL_0040: leave.s IL_0050
ldnull <null>
call System.Void System.Environment::FailFast(System.String)
leave.s IL_0050: call System.Boolean Program::AdminCheck()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.0 <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0050: call System.Boolean Program::AdminCheck()
call System.Boolean Program::AdminCheck()
brtrue.s IL_00B1: ldnull
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
stloc.1 <null>
ldloc.1 <null>
call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
callvirt System.Diagnostics.ProcessModule System.Diagnostics.Process::get_MainModule()
callvirt System.String System.Diagnostics.ProcessModule::get_FileName()
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
ldloc.1 <null>
ldstr runas
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String)
ldloc.1 <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
ldloc.1 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
call System.Int32 System.Environment::get_ExitCode()
call System.Void System.Environment::Exit(System.Int32)
leave.s IL_00AF: br.s IL_00B8
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.2 <null>
call System.Int32 System.Environment::get_ExitCode()
call System.Void System.Environment::Exit(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00AF: br.s IL_00B8
br.s IL_00B8: ret
ldnull <null>
call System.Object Program::WorkF(System.Object)
pop <null>
ret <null>
Module Name
uid.exe
Full Name
uid.exe
EntryPoint
System.Void Program::Main()
Scope Name
uid.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
uid
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
23
Main Method
System.Void Program::Main()
Main IL Instruction Count
57
Main IL 
ldc.i4 2000
call System.Void System.Threading.Thread::Sleep(System.Int32)
call System.Boolean Program::CreateMutex()
brtrue.s IL_001B: call System.Boolean Program::DetectVirtualMachine()
call System.Int32 System.Environment::get_ExitCode()
call System.Void System.Environment::Exit(System.Int32)
call System.Boolean Program::DetectVirtualMachine()
call System.Boolean Program::Emulator()
or <null>
call System.Boolean Program::DetectDebugger()
or <null>
call System.Boolean Program::DetectSandboxie()
or <null>
call System.Boolean Program::anyrun()
or <null>
brfalse.s IL_0040: leave.s IL_0050
ldnull <null>
call System.Void System.Environment::FailFast(System.String)
leave.s IL_0050: call System.Boolean Program::AdminCheck()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.0 <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0050: call System.Boolean Program::AdminCheck()
call System.Boolean Program::AdminCheck()
brtrue.s IL_00B1: ldnull
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
stloc.1 <null>
ldloc.1 <null>
call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
callvirt System.Diagnostics.ProcessModule System.Diagnostics.Process::get_MainModule()
callvirt System.String System.Diagnostics.ProcessModule::get_FileName()
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
ldloc.1 <null>
ldstr runas
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String)
ldloc.1 <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
ldloc.1 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
call System.Int32 System.Environment::get_ExitCode()
call System.Void System.Environment::Exit(System.Int32)
leave.s IL_00AF: br.s IL_00B8
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.2 <null>
call System.Int32 System.Environment::get_ExitCode()
call System.Void System.Environment::Exit(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00AF: br.s IL_00B8
br.s IL_00B8: ret
ldnull <null>
call System.Object Program::WorkF(System.Object)
pop <null>
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙