Malicious
Malicious

PE Executable
MD5: fcf5c0b9e4a6cb5b034f32a75a4396aa
Size: 28.67 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 fcf5c0b9e4a6cb5b034f32a75a4396aa
Sha1 e15367001747acd7677288d3ce3d123b903d6827
Sha256 8f6502f9cc4e6916a6481bf77b2e52473143f39a6fb258186edbb146e577fa65
Sha384 b654f82f4a0b60c3783d93979e3be623d62bdc39bf404f60ee2ad0692d6bf2b53e470e1c97ed536c09204b6fd3b8e176
Sha512 cec19f4a829c90848e8da016121d908f07bb2fc654606c57317a1445d48c5a3fe55b8484a4c8b1352aafe1011ef96bd518e6a2dcdd4f8e7a652d141172b42789
SSDeep 384:bNHPiWD4iXdRz2DgtyeEHjP2S3auH9qbuUsU/QxnCJfJbndnjJ/S7uq0+:bFPJcA72styneSXIb4BibnjYuq0+
TLSH F3D24D0433E8C5B2D2FD46BED83286008775E5974953DB6A1FC990EE2A237CD8E14BD5
fcf5c0b9e4a6cb5b034f32a75a4396aa
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Config. Field Value
Key (AES_256) U2VjdXhuhuhuhuhuhuhuhuhuhuhu
Pastebin -huhuhuhu
Install fhuhuhuhu
Install File au8huhuhuhu
Install-Folder %huhuhuhu
Version 0.huhuhuhu
Hosts ok9huhuhuhu
Ports 4huhuhuhu
Mutex Aphuhuhuhu
Delay 0huhuhuhu
Group Dhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
PDB Path: C:\wow\update\obj\Debug\I9BETAPP.pdb
Module Name
I9BETAPP.exe
Full Name
I9BETAPP.exe
EntryPoint
System.Void Client.Program::Main()
Scope Name
I9BETAPP.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
I9BETAPP
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
123
Main Method
System.Void Client.Program::Main()
Main IL Instruction Count
101
Main IL 
nop <null>
ldc.i4.0 <null>
stloc.0 <null>
br.s IL_0016: ldloc.0
nop <null>
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
nop <null>
ldloc.0 <null>
ldc.i4.1 <null>
add <null>
stloc.0 <null>
ldloc.0 <null>
ldsfld System.String Client.Settings::Delay
call System.Int32 System.Convert::ToInt32(System.String)
clt <null>
stloc.1 <null>
ldloc.1 <null>
brtrue.s IL_0005: nop
call System.Boolean Client.Settings::InitializeSettings()
ldc.i4.0 <null>
ceq <null>
stloc.2 <null>
ldloc.2 <null>
brfalse.s IL_003A: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
nop <null>
nop <null>
call System.Boolean Client.Helper.MutexControl::CreateMutex()
ldc.i4.0 <null>
ceq <null>
stloc.3 <null>
ldloc.3 <null>
brfalse.s IL_004F: ldsfld System.String Client.Settings::Anti
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
ldsfld System.String Client.Settings::Anti
call System.Boolean System.Convert::ToBoolean(System.String)
stloc.s V_4
ldloc.s V_4
brfalse.s IL_0065: ldsfld System.String Client.Settings::Install
call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis()
nop <null>
ldsfld System.String Client.Settings::Install
call System.Boolean System.Convert::ToBoolean(System.String)
stloc.s V_5
ldloc.s V_5
brfalse.s IL_007B: ldsfld System.String Client.Settings::BDOS
call System.Void Client.Install.NormalStartup::Install()
nop <null>
ldsfld System.String Client.Settings::BDOS
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_008E: ldc.i4.0
call System.Boolean Client.Helper.Methods::IsAdmin()
br.s IL_008F: stloc.s V_6
ldc.i4.0 <null>
stloc.s V_6
ldloc.s V_6
brfalse.s IL_009B: call System.Void Client.Helper.Methods::PreventSleep()
call System.Void Client.Helper.ProcessCritical::Set()
nop <null>
call System.Void Client.Helper.Methods::PreventSleep()
nop <null>
nop <null>
leave.s IL_00A9: br.s IL_00DD
pop <null>
nop <null>
nop <null>
leave.s IL_00A9: br.s IL_00DD
br.s IL_00DD: ldc.i4.1
nop <null>
nop <null>
call System.Boolean Client.Connection.ClientSocket::get_IsConnected()
ldc.i4.0 <null>
ceq <null>
stloc.s V_7
ldloc.s V_7
brfalse.s IL_00C9: nop
nop <null>
call System.Void Client.Connection.ClientSocket::Reconnect()
nop <null>
call System.Void Client.Connection.ClientSocket::InitializeClient()
nop <null>
nop <null>
nop <null>
leave.s IL_00D1: ldc.i4 5000
pop <null>
nop <null>
nop <null>
leave.s IL_00D1: ldc.i4 5000
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
nop <null>
ldc.i4.1 <null>
stloc.s V_8
br.s IL_00AB: nop
Key (AES_256) MUTEXmalicious
U2VjdXhuhuhuhuhuhuhuhuhuhuhu
CnC CNCmalicious
ok9huhuhuhu
Ports PORTmalicious
4huhuhuhu
Mutex MUTEXmalicious
Aphuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
fcf5c0b9e4a6cb5b034f32a75a4396aa
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Config. Field Value
Key (AES_256) U2VjdXhuhuhuhuhuhuhuhuhuhuhu
Pastebin -huhuhuhu
Install fhuhuhuhu
Install File au8huhuhuhu
Install-Folder %huhuhuhu
Version 0.huhuhuhu
Hosts ok9huhuhuhu
Ports 4huhuhuhu
Mutex Aphuhuhuhu
Delay 0huhuhuhu
Group Dhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Key (AES_256) MUTEXmalicious
U2VjdXhuhuhuhuhuhuhuhuhuhuhu
fcf5c0b9e4a6cb5b034f32a75a4396aa
CnC CNCmalicious
ok9huhuhuhu
fcf5c0b9e4a6cb5b034f32a75a4396aa
Ports PORTmalicious
4huhuhuhu
fcf5c0b9e4a6cb5b034f32a75a4396aa
Mutex MUTEXmalicious
Aphuhuhuhu
fcf5c0b9e4a6cb5b034f32a75a4396aa
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙