Deep Malware Analysis of f1e932a91ae6248fe628b5fc303b84e6 | md5: f1e932a91ae6248fe628b5fc303b84e6 | Executable | PE (Portable Executable) | Managed .NET | PE Memory-Mapped (Dump) | .Net | SOS: 0.94 | RAT | XWorm

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Very high

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Config. Field	Value
Mutex	SEb72huhuhuhuhuhuhu
Hosts	127huhuhuhu
Port	7huhuhuhu
KEY	<12huhuhuhu
USBNM	<Xwhuhuhuhu
family	xhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Info	PE Detect: PeReader FAIL, AsmResolver Mapped OK
Info	Remap: Mapped -> FileLayout (RAM only) as [Rebuild from dump]_a3c12665.exe
Module Name	amongus.exe
Full Name	amongus.exe
EntryPoint	`System.Void Stub.C5SJZtT4FfkGQQXYeeYsuI7cgqPgjr2wgeYhRdQntH9weD525yxYBVfPXG7GWQpGXkSt0PvMenMBOKYy2H::wmQQFi4WwboSEHYYLePIlblzeqBn8rShsb68eavVI5OKq4gk9kcTU6un8qXtAqEzYWkfw6E4IOVW7hx8uc()`
Scope Name	amongus.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	amongus
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	210
Main Method	`System.Void Stub.C5SJZtT4FfkGQQXYeeYsuI7cgqPgjr2wgeYhRdQntH9weD525yxYBVfPXG7GWQpGXkSt0PvMenMBOKYy2H::wmQQFi4WwboSEHYYLePIlblzeqBn8rShsb68eavVI5OKq4gk9kcTU6un8qXtAqEzYWkfw6E4IOVW7hx8uc()`
Main IL Instruction Count	54
Main IL	ldsfld System.Int32 OmYwI1EDqCZNPpF5yRzqYSS0ylR8K2f6dMMROgc6eT389zTC13ccInK2VcuEZv92hTARDV4Fu89SHFrRwLkwDfze5ASE3Tj7n::LUkYcfiLBKaXsF9prizvqfb3fuFHI9YLiy0NcYIGmSMOz0YUcxyoPjpWSo3WZczTr1uOMuRE9ldmTzHfQM ldc.i4 1000 mul.ovf <null> call System.Void System.Threading.Thread::Sleep(System.Int32) ldsfld System.String OmYwI1EDqCZNPpF5yRzqYSS0ylR8K2f6dMMROgc6eT389zTC13ccInK2VcuEZv92hTARDV4Fu89SHFrRwLkwDfze5ASE3Tj7n::WsxLoadbg6FItF3nozleUhpNGZfkMuqs3YjiVkmHJzYNdMDvDuV67fZnUywboH8D0IMex0XXjPabDldEhdBPayalaKTyWcaHq call System.Object Stub.T0SK3KiiLmB2D31TuTzI1gb9::YPT7HPW9XQgk4bX5HwJgDCla(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String OmYwI1EDqCZNPpF5yRzqYSS0ylR8K2f6dMMROgc6eT389zTC13ccInK2VcuEZv92hTARDV4Fu89SHFrRwLkwDfze5ASE3Tj7n::WsxLoadbg6FItF3nozleUhpNGZfkMuqs3YjiVkmHJzYNdMDvDuV67fZnUywboH8D0IMex0XXjPabDldEhdBPayalaKTyWcaHq ldsfld System.String OmYwI1EDqCZNPpF5yRzqYSS0ylR8K2f6dMMROgc6eT389zTC13ccInK2VcuEZv92hTARDV4Fu89SHFrRwLkwDfze5ASE3Tj7n::jTCPOnuKWwG1Av5KwXTIVWE8GuYs8HcCzzuO7FJ0MGzPbe3Ae92btrFHrkjyX637f3BCNEdyQ8P9Ksw0XNLokKAv5Yw5fFqUP call System.Object Stub.T0SK3KiiLmB2D31TuTzI1gb9::YPT7HPW9XQgk4bX5HwJgDCla(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String OmYwI1EDqCZNPpF5yRzqYSS0ylR8K2f6dMMROgc6eT389zTC13ccInK2VcuEZv92hTARDV4Fu89SHFrRwLkwDfze5ASE3Tj7n::jTCPOnuKWwG1Av5KwXTIVWE8GuYs8HcCzzuO7FJ0MGzPbe3Ae92btrFHrkjyX637f3BCNEdyQ8P9Ksw0XNLokKAv5Yw5fFqUP ldsfld System.String OmYwI1EDqCZNPpF5yRzqYSS0ylR8K2f6dMMROgc6eT389zTC13ccInK2VcuEZv92hTARDV4Fu89SHFrRwLkwDfze5ASE3Tj7n::QO4g2QR8f6qjdpn5MGpSBf3jyWAG47t4qyPA6pE8B38XDqieEeyH2ctsN8imL0I632V3eLLYJfssFYadCQSxciR2eiUuFQr78 call System.Object Stub.T0SK3KiiLmB2D31TuTzI1gb9::YPT7HPW9XQgk4bX5HwJgDCla(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String OmYwI1EDqCZNPpF5yRzqYSS0ylR8K2f6dMMROgc6eT389zTC13ccInK2VcuEZv92hTARDV4Fu89SHFrRwLkwDfze5ASE3Tj7n::QO4g2QR8f6qjdpn5MGpSBf3jyWAG47t4qyPA6pE8B38XDqieEeyH2ctsN8imL0I632V3eLLYJfssFYadCQSxciR2eiUuFQr78 ldsfld System.String OmYwI1EDqCZNPpF5yRzqYSS0ylR8K2f6dMMROgc6eT389zTC13ccInK2VcuEZv92hTARDV4Fu89SHFrRwLkwDfze5ASE3Tj7n::MGZrBV5s9vPaxDxyliqLdr8spzjvxITIHnhu9uV0MLqDJOJSIrlqYtoAQ4RJYQSdGU7q0GI8wBNCqH7Znu call System.Object Stub.T0SK3KiiLmB2D31TuTzI1gb9::YPT7HPW9XQgk4bX5HwJgDCla(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String OmYwI1EDqCZNPpF5yRzqYSS0ylR8K2f6dMMROgc6eT389zTC13ccInK2VcuEZv92hTARDV4Fu89SHFrRwLkwDfze5ASE3Tj7n::MGZrBV5s9vPaxDxyliqLdr8spzjvxITIHnhu9uV0MLqDJOJSIrlqYtoAQ4RJYQSdGU7q0GI8wBNCqH7Znu ldsfld System.String OmYwI1EDqCZNPpF5yRzqYSS0ylR8K2f6dMMROgc6eT389zTC13ccInK2VcuEZv92hTARDV4Fu89SHFrRwLkwDfze5ASE3Tj7n::9GtOTsXNzpdkN7hJOQoSciB4SgdahTRy4nqGQiKEBPT3Kye4dCfkSM3AFGQqmXUOcoYVP2IIIKB6H15fN5 call System.Object Stub.T0SK3KiiLmB2D31TuTzI1gb9::YPT7HPW9XQgk4bX5HwJgDCla(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String OmYwI1EDqCZNPpF5yRzqYSS0ylR8K2f6dMMROgc6eT389zTC13ccInK2VcuEZv92hTARDV4Fu89SHFrRwLkwDfze5ASE3Tj7n::9GtOTsXNzpdkN7hJOQoSciB4SgdahTRy4nqGQiKEBPT3Kye4dCfkSM3AFGQqmXUOcoYVP2IIIKB6H15fN5 leave.s IL_008A: call System.Boolean Stub.HV9f0NQ0CbUN9bT10YyDgYk6::KEpc9RLgWCiQOPdixDUFg4Os() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.2 <null> ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_008A: call System.Boolean Stub.HV9f0NQ0CbUN9bT10YyDgYk6::KEpc9RLgWCiQOPdixDUFg4Os() call System.Boolean Stub.HV9f0NQ0CbUN9bT10YyDgYk6::KEpc9RLgWCiQOPdixDUFg4Os() brtrue.s IL_0097: call System.Void Stub.HV9f0NQ0CbUN9bT10YyDgYk6::OUUkAQehxR4fQEuTKxrVGrTv() ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Stub.HV9f0NQ0CbUN9bT10YyDgYk6::OUUkAQehxR4fQEuTKxrVGrTv() ldnull <null> ldftn System.Void Stub.C5SJZtT4FfkGQQXYeeYsuI7cgqPgjr2wgeYhRdQntH9weD525yxYBVfPXG7GWQpGXkSt0PvMenMBOKYy2H::M7Ip37mJunbgq2myrqxzA6wHKa1je95TXhyvAWXcobjMo4cLTYTyYxXQeQEzkkYEhsPpPQyTGc7xJMjWwm() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.0 <null> ldnull <null> ldftn System.Void Stub.C5SJZtT4FfkGQQXYeeYsuI7cgqPgjr2wgeYhRdQntH9weD525yxYBVfPXG7GWQpGXkSt0PvMenMBOKYy2H::TgBFFlqwGWsajEOnOCL7GILjwaSiqmUdydxrWsVnPamjkSzw6ViHztSckMy65ptg5fPB2OV60713i4D6Mt() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.1 <null> ldloc.0 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.1 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.1 <null> callvirt System.Void System.Threading.Thread::Join() ret <null>
Module Name	amongus.exe
Full Name	amongus.exe
EntryPoint	`System.Void Stub.C5SJZtT4FfkGQQXYeeYsuI7cgqPgjr2wgeYhRdQntH9weD525yxYBVfPXG7GWQpGXkSt0PvMenMBOKYy2H::wmQQFi4WwboSEHYYLePIlblzeqBn8rShsb68eavVI5OKq4gk9kcTU6un8qXtAqEzYWkfw6E4IOVW7hx8uc()`
Scope Name	amongus.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	amongus
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	210
Main Method	`System.Void Stub.C5SJZtT4FfkGQQXYeeYsuI7cgqPgjr2wgeYhRdQntH9weD525yxYBVfPXG7GWQpGXkSt0PvMenMBOKYy2H::wmQQFi4WwboSEHYYLePIlblzeqBn8rShsb68eavVI5OKq4gk9kcTU6un8qXtAqEzYWkfw6E4IOVW7hx8uc()`
Main IL Instruction Count	54
Main IL	ldsfld System.Int32 OmYwI1EDqCZNPpF5yRzqYSS0ylR8K2f6dMMROgc6eT389zTC13ccInK2VcuEZv92hTARDV4Fu89SHFrRwLkwDfze5ASE3Tj7n::LUkYcfiLBKaXsF9prizvqfb3fuFHI9YLiy0NcYIGmSMOz0YUcxyoPjpWSo3WZczTr1uOMuRE9ldmTzHfQM ldc.i4 1000 mul.ovf <null> call System.Void System.Threading.Thread::Sleep(System.Int32) ldsfld System.String OmYwI1EDqCZNPpF5yRzqYSS0ylR8K2f6dMMROgc6eT389zTC13ccInK2VcuEZv92hTARDV4Fu89SHFrRwLkwDfze5ASE3Tj7n::WsxLoadbg6FItF3nozleUhpNGZfkMuqs3YjiVkmHJzYNdMDvDuV67fZnUywboH8D0IMex0XXjPabDldEhdBPayalaKTyWcaHq call System.Object Stub.T0SK3KiiLmB2D31TuTzI1gb9::YPT7HPW9XQgk4bX5HwJgDCla(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String OmYwI1EDqCZNPpF5yRzqYSS0ylR8K2f6dMMROgc6eT389zTC13ccInK2VcuEZv92hTARDV4Fu89SHFrRwLkwDfze5ASE3Tj7n::WsxLoadbg6FItF3nozleUhpNGZfkMuqs3YjiVkmHJzYNdMDvDuV67fZnUywboH8D0IMex0XXjPabDldEhdBPayalaKTyWcaHq ldsfld System.String OmYwI1EDqCZNPpF5yRzqYSS0ylR8K2f6dMMROgc6eT389zTC13ccInK2VcuEZv92hTARDV4Fu89SHFrRwLkwDfze5ASE3Tj7n::jTCPOnuKWwG1Av5KwXTIVWE8GuYs8HcCzzuO7FJ0MGzPbe3Ae92btrFHrkjyX637f3BCNEdyQ8P9Ksw0XNLokKAv5Yw5fFqUP call System.Object Stub.T0SK3KiiLmB2D31TuTzI1gb9::YPT7HPW9XQgk4bX5HwJgDCla(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String OmYwI1EDqCZNPpF5yRzqYSS0ylR8K2f6dMMROgc6eT389zTC13ccInK2VcuEZv92hTARDV4Fu89SHFrRwLkwDfze5ASE3Tj7n::jTCPOnuKWwG1Av5KwXTIVWE8GuYs8HcCzzuO7FJ0MGzPbe3Ae92btrFHrkjyX637f3BCNEdyQ8P9Ksw0XNLokKAv5Yw5fFqUP ldsfld System.String OmYwI1EDqCZNPpF5yRzqYSS0ylR8K2f6dMMROgc6eT389zTC13ccInK2VcuEZv92hTARDV4Fu89SHFrRwLkwDfze5ASE3Tj7n::QO4g2QR8f6qjdpn5MGpSBf3jyWAG47t4qyPA6pE8B38XDqieEeyH2ctsN8imL0I632V3eLLYJfssFYadCQSxciR2eiUuFQr78 call System.Object Stub.T0SK3KiiLmB2D31TuTzI1gb9::YPT7HPW9XQgk4bX5HwJgDCla(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String OmYwI1EDqCZNPpF5yRzqYSS0ylR8K2f6dMMROgc6eT389zTC13ccInK2VcuEZv92hTARDV4Fu89SHFrRwLkwDfze5ASE3Tj7n::QO4g2QR8f6qjdpn5MGpSBf3jyWAG47t4qyPA6pE8B38XDqieEeyH2ctsN8imL0I632V3eLLYJfssFYadCQSxciR2eiUuFQr78 ldsfld System.String OmYwI1EDqCZNPpF5yRzqYSS0ylR8K2f6dMMROgc6eT389zTC13ccInK2VcuEZv92hTARDV4Fu89SHFrRwLkwDfze5ASE3Tj7n::MGZrBV5s9vPaxDxyliqLdr8spzjvxITIHnhu9uV0MLqDJOJSIrlqYtoAQ4RJYQSdGU7q0GI8wBNCqH7Znu call System.Object Stub.T0SK3KiiLmB2D31TuTzI1gb9::YPT7HPW9XQgk4bX5HwJgDCla(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String OmYwI1EDqCZNPpF5yRzqYSS0ylR8K2f6dMMROgc6eT389zTC13ccInK2VcuEZv92hTARDV4Fu89SHFrRwLkwDfze5ASE3Tj7n::MGZrBV5s9vPaxDxyliqLdr8spzjvxITIHnhu9uV0MLqDJOJSIrlqYtoAQ4RJYQSdGU7q0GI8wBNCqH7Znu ldsfld System.String OmYwI1EDqCZNPpF5yRzqYSS0ylR8K2f6dMMROgc6eT389zTC13ccInK2VcuEZv92hTARDV4Fu89SHFrRwLkwDfze5ASE3Tj7n::9GtOTsXNzpdkN7hJOQoSciB4SgdahTRy4nqGQiKEBPT3Kye4dCfkSM3AFGQqmXUOcoYVP2IIIKB6H15fN5 call System.Object Stub.T0SK3KiiLmB2D31TuTzI1gb9::YPT7HPW9XQgk4bX5HwJgDCla(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String OmYwI1EDqCZNPpF5yRzqYSS0ylR8K2f6dMMROgc6eT389zTC13ccInK2VcuEZv92hTARDV4Fu89SHFrRwLkwDfze5ASE3Tj7n::9GtOTsXNzpdkN7hJOQoSciB4SgdahTRy4nqGQiKEBPT3Kye4dCfkSM3AFGQqmXUOcoYVP2IIIKB6H15fN5 leave.s IL_008A: call System.Boolean Stub.HV9f0NQ0CbUN9bT10YyDgYk6::KEpc9RLgWCiQOPdixDUFg4Os() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.2 <null> ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_008A: call System.Boolean Stub.HV9f0NQ0CbUN9bT10YyDgYk6::KEpc9RLgWCiQOPdixDUFg4Os() call System.Boolean Stub.HV9f0NQ0CbUN9bT10YyDgYk6::KEpc9RLgWCiQOPdixDUFg4Os() brtrue.s IL_0097: call System.Void Stub.HV9f0NQ0CbUN9bT10YyDgYk6::OUUkAQehxR4fQEuTKxrVGrTv() ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Stub.HV9f0NQ0CbUN9bT10YyDgYk6::OUUkAQehxR4fQEuTKxrVGrTv() ldnull <null> ldftn System.Void Stub.C5SJZtT4FfkGQQXYeeYsuI7cgqPgjr2wgeYhRdQntH9weD525yxYBVfPXG7GWQpGXkSt0PvMenMBOKYy2H::M7Ip37mJunbgq2myrqxzA6wHKa1je95TXhyvAWXcobjMo4cLTYTyYxXQeQEzkkYEhsPpPQyTGc7xJMjWwm() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.0 <null> ldnull <null> ldftn System.Void Stub.C5SJZtT4FfkGQQXYeeYsuI7cgqPgjr2wgeYhRdQntH9weD525yxYBVfPXG7GWQpGXkSt0PvMenMBOKYy2H::TgBFFlqwGWsajEOnOCL7GILjwaSiqmUdydxrWsVnPamjkSzw6ViHztSckMy65ptg5fPB2OV60713i4D6Mt() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.1 <null> ldloc.0 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.1 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.1 <null> callvirt System.Void System.Threading.Thread::Join() ret <null>

PE Layout UNKNWOWNsuspect

Memoryhuhuhuhuhuhuhuhuhuhuhu

Mutex MUTEXmalicious

SEb72huhuhuhuhuhuhu

CnC CNCmalicious

127huhuhuhu

Port PORTmalicious

7huhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential