Malicious
Malicious

f0be4843f2df9f384563da0a1705c169

Share on LinkedIn
Print
PE Executable
MD5: f0be4843f2df9f384563da0a1705c169
Size: 48.64 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 f0be4843f2df9f384563da0a1705c169
Sha1 f9f4a11d94dba7a47ec0f72a0eefdfe10c89775d
Sha256 c1129d126820d0b83ec14389944fd8a7ade95e6a980245d37b904623183ddbf1
Sha384 78ecccd837ac79e79bbdf2d6b11b86210578049387951eb6024a848f1930953e05b636cf417bd194999277d5f67a8d7a
Sha512 0edbec7c90dcc988467a3c1cfefc92afd800e44fbf29df3f7c54a7846730bb9e68f84b563e9c02567e41e5f456345fc985216add41f8b2c1b43ad06360c2043b
SSDeep 768:VOEuILWCKi+DiQyYE/pif8Yb3ge5lFtGAi4JHvEgK/J/ZVc6KN:VOtmhezbQUlXGAznkJ/ZVclN
TLSH 19235D4037A8C136E2FD4BB4A8F3A6058279D6572D03DA9C6CC854EA1B13BC597136FE
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
f0be4843f2df9f384563da0a1705c169
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Config. Field Value
Key (AES_256) SmZLZ1huhuhuhuhuhuhuhuhuhuhu
Pastebin -huhuhuhu
Certificate MIICMDhuhuhuhuhuhuhuhuhuhuhu
ServerSignature VziqsZhuhuhuhuhuhuhuhuhuhuhu
Install fhuhuhuhu
BDOS fhuhuhuhu
Anti-VM fhuhuhuhu
Install-Folder %Aphuhuhuhu
Hosts 88.2huhuhuhuhuhuhu
Ports 1huhuhuhu
Mutex DcRathuhuhuhuhuhuhu
Version 1huhuhuhu
Delay 1huhuhuhu
Group Mhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
COM Surrogate.exe
Full Name
COM Surrogate.exe
EntryPoint
System.Void Client.Program::Main()
Scope Name
COM Surrogate.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
COM Surrogate
Assembly Version
1.0.7.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
150
Main Method
System.Void Client.Program::Main()
Main IL Instruction Count
59
Main IL 
ldc.i4.0 <null>
stloc.0 <null>
br IL_0015: ldloc.0
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
ldc.i4.1 <null>
add <null>
stloc.0 <null>
ldloc.0 <null>
ldsfld System.String Client.Settings::De_lay
call System.Int32 System.Convert::ToInt32(System.String)
blt.s IL_0007: ldc.i4 1000
call System.Boolean Client.Settings::InitializeSettings()
brtrue IL_0032: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
ldsfld System.String Client.Settings::An_ti
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_0047: call System.Boolean Client.Helper.MutexControl::CreateMutex()
call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis()
call System.Boolean Client.Helper.MutexControl::CreateMutex()
brtrue IL_0057: ldsfld System.String Client.Settings::Anti_Process
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String Client.Settings::Anti_Process
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_006B: ldsfld System.String Client.Settings::BS_OD
call System.Void Client.Helper.AntiProcess::StartBlock()
ldsfld System.String Client.Settings::BS_OD
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_0089: ldsfld System.String Client.Settings::In_stall
call System.Boolean Client.Helper.Methods::IsAdmin()
brfalse IL_0089: ldsfld System.String Client.Settings::In_stall
call System.Void Client.Helper.ProcessCritical::Set()
ldsfld System.String Client.Settings::In_stall
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_009D: call System.Void Client.Helper.Methods::PreventSleep()
call System.Void Client.Install.NormalStartup::Install()
call System.Void Client.Helper.Methods::PreventSleep()
call System.Boolean Client.Helper.Methods::IsAdmin()
brfalse IL_00B1: call System.Void Client.Connection.Amsi::Bypass()
call System.Void Client.Helper.Methods::ClearSetting()
call System.Void Client.Connection.Amsi::Bypass()
leave IL_00C1: nop
pop <null>
leave IL_00C1: nop
nop <null>
call System.Boolean Client.Connection.ClientSocket::get_IsConnected()
brtrue IL_00D6: leave IL_00E1
call System.Void Client.Connection.ClientSocket::Reconnect()
call System.Void Client.Connection.ClientSocket::InitializeClient()
leave IL_00E1: ldc.i4 5000
pop <null>
leave IL_00E1: ldc.i4 5000
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_00C1: nop
Module Name
COM Surrogate.exe
Full Name
COM Surrogate.exe
EntryPoint
System.Void Client.Program::Main()
Scope Name
COM Surrogate.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
COM Surrogate
Assembly Version
1.0.7.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
150
Main Method
System.Void Client.Program::Main()
Main IL Instruction Count
59
Main IL 
ldc.i4.0 <null>
stloc.0 <null>
br IL_0015: ldloc.0
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
ldc.i4.1 <null>
add <null>
stloc.0 <null>
ldloc.0 <null>
ldsfld System.String Client.Settings::De_lay
call System.Int32 System.Convert::ToInt32(System.String)
blt.s IL_0007: ldc.i4 1000
call System.Boolean Client.Settings::InitializeSettings()
brtrue IL_0032: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
ldsfld System.String Client.Settings::An_ti
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_0047: call System.Boolean Client.Helper.MutexControl::CreateMutex()
call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis()
call System.Boolean Client.Helper.MutexControl::CreateMutex()
brtrue IL_0057: ldsfld System.String Client.Settings::Anti_Process
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String Client.Settings::Anti_Process
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_006B: ldsfld System.String Client.Settings::BS_OD
call System.Void Client.Helper.AntiProcess::StartBlock()
ldsfld System.String Client.Settings::BS_OD
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_0089: ldsfld System.String Client.Settings::In_stall
call System.Boolean Client.Helper.Methods::IsAdmin()
brfalse IL_0089: ldsfld System.String Client.Settings::In_stall
call System.Void Client.Helper.ProcessCritical::Set()
ldsfld System.String Client.Settings::In_stall
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_009D: call System.Void Client.Helper.Methods::PreventSleep()
call System.Void Client.Install.NormalStartup::Install()
call System.Void Client.Helper.Methods::PreventSleep()
call System.Boolean Client.Helper.Methods::IsAdmin()
brfalse IL_00B1: call System.Void Client.Connection.Amsi::Bypass()
call System.Void Client.Helper.Methods::ClearSetting()
call System.Void Client.Connection.Amsi::Bypass()
leave IL_00C1: nop
pop <null>
leave IL_00C1: nop
nop <null>
call System.Boolean Client.Connection.ClientSocket::get_IsConnected()
brtrue IL_00D6: leave IL_00E1
call System.Void Client.Connection.ClientSocket::Reconnect()
call System.Void Client.Connection.ClientSocket::InitializeClient()
leave IL_00E1: ldc.i4 5000
pop <null>
leave IL_00E1: ldc.i4 5000
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_00C1: nop
Key (AES_256) MUTEXmalicious
SmZLZ1huhuhuhuhuhuhuhuhuhuhu
CnC CNCmalicious
88.2huhuhuhuhuhuhu
Ports PORTmalicious
1huhuhuhu
Mutex MUTEXmalicious
DcRathuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙