Malicious
0af61a3613cb79aec77d9d2a6e2756e1
PE Executable
MD5: 0af61a3613cb79aec77d9d2a6e2756e1
Size: 56.32 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Size
56.32 KB · 56,320 B
First seen
2026-08-16 19:31 · 2 months ago
Last seen
2026-08-16 19:31 · 2 months ago
Last analysis
2026-08-16 19:31 · 2 months ago
Hashes
MD5
0af61a3613cb79aec77d9d2a6e2756e1
Sha1
8b33bf886db31c1065034cbbfbda71d17561290e
Sha256
520afe474c0d141f0efb5ab826e581fb4d0e87a30cf6e34fd509af71d3829f26
Sha384
c3f7e41685d9cd213bf7012b0ab74a08065acf6c090a18c9af5e3906066512adcff6cae86fc8311b8b791c4619635d62
Sha512
4295a1c009acc223c315d030c85d1a1d4392fab3c09571f8c15498d7b8aebb0c62a10c16c3d60a21d2b2d0284a566c319396b6335c43321e0ef2538483555410
SSDeep
1536:dwws4DnAN7jytFADRwsNMDMXExI3pm4m:iT4DnA2PADRwsNMDMXExI3pm
TLSH
0D432844BFEA4A01E2BD8F3469F555150634BA63E532EB1F48D668EB13327C58C40FE6
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Low
1 malicious · 2 files
EXE0af61a3613cb79aec77d9d2a6e2756e1njRat
Structure
BINResources
BINRT_MANIFEST
BINID:0001
BINID:0
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe>pe:rsrc>bin
Shape
pe:exe>pe:rsrc>bin
malicious
3 nodes
| Config. Field | Value |
|---|---|
| packet_size [b] | 5huhuhuhu |
| BD [BD] | Fhuhuhuhu |
| directory [DR] | Thuhuhuhu |
| executable_name [EXE] | dllhuhuhuhu |
| cnc_host [H] | 27.tchuhuhuhuhuhuhu |
| is_dir_defined [Idr] | Fhuhuhuhu |
| Anti_CH | Fhuhuhuhu |
| is_startup_folder [IsF] | Fhuhuhuhu |
| USB_SP | Fhuhuhuhu |
| is_user_reg [Isu] | Fhuhuhuhu |
| cnc_port [P] | 1huhuhuhu |
| reg_key [RG] | 998ee0huhuhuhuhuhuhuhuhuhuhu |
| reg_path [sf] | Softwahuhuhuhuhuhuhuhuhuhuhu |
| victim_name [VN] | Vihuhuhuhu |
| version [VR] | <- NjRhuhuhuhuhuhuhuhuhuhuhu |
| splitter [Y] | Y262huhuhuhu |
| MSGE | Dihuhuhuhu |
| MSGT | Thhuhuhuhu |
| MSGB | Sorry,huhuhuhuhuhuhuhuhuhuhu |
| MSGSYM | vbChuhuhuhu |
| OBITO | Dihuhuhuhu |
| TSKE | Dihuhuhuhu |
| TSK | Wirehuhuhuhuhuhuhu |
| KAKASHI | Dihuhuhuhu |
| AKATSUKI | Dihuhuhuhu |
| CLEANSWEEP | Dihuhuhuhu |
| PASTEE | Dihuhuhuhu |
| PASTEBIN | https:huhuhuhuhuhuhuhuhuhuhu |
| CLIP | nhuhuhuhu |
| UAC | Dihuhuhuhu |
| nowifi | ohuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| Module Name | Stub.exe |
| Full Name | Stub.exe |
| EntryPoint | System.Void j.A::main() |
| Scope Name | Stub.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v2.0.50727 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | Stub |
| Assembly Version | 0.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | <null> |
| Total Strings | 539 |
| Main Method | System.Void j.A::main() |
| Main IL Instruction Count | 2 |
| Main IL | |
| Module Name | Stub.exe |
| Full Name | Stub.exe |
| EntryPoint | System.Void j.A::main() |
| Scope Name | Stub.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v2.0.50727 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | Stub |
| Assembly Version | 0.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | <null> |
| Total Strings | 539 |
| Main Method | System.Void j.A::main() |
| Main IL Instruction Count | 2 |
| Main IL | |
CnC
CNCmalicious
27.tchuhuhuhuhuhuhu
Port
PORTmalicious
1huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential1 malicious · 2 files
EXE0af61a3613cb79aec77d9d2a6e2756e1njRat
Structure
BINResources
| Config. Field | Value |
|---|---|
| packet_size [b] | 5huhuhuhu |
| BD [BD] | Fhuhuhuhu |
| directory [DR] | Thuhuhuhu |
| executable_name [EXE] | dllhuhuhuhu |
| cnc_host [H] | 27.tchuhuhuhuhuhuhu |
| is_dir_defined [Idr] | Fhuhuhuhu |
| Anti_CH | Fhuhuhuhu |
| is_startup_folder [IsF] | Fhuhuhuhu |
| USB_SP | Fhuhuhuhu |
| is_user_reg [Isu] | Fhuhuhuhu |
| cnc_port [P] | 1huhuhuhu |
| reg_key [RG] | 998ee0huhuhuhuhuhuhuhuhuhuhu |
| reg_path [sf] | Softwahuhuhuhuhuhuhuhuhuhuhu |
| victim_name [VN] | Vihuhuhuhu |
| version [VR] | <- NjRhuhuhuhuhuhuhuhuhuhuhu |
| splitter [Y] | Y262huhuhuhu |
| MSGE | Dihuhuhuhu |
| MSGT | Thhuhuhuhu |
| MSGB | Sorry,huhuhuhuhuhuhuhuhuhuhu |
| MSGSYM | vbChuhuhuhu |
| OBITO | Dihuhuhuhu |
| TSKE | Dihuhuhuhu |
| TSK | Wirehuhuhuhuhuhuhu |
| KAKASHI | Dihuhuhuhu |
| AKATSUKI | Dihuhuhuhu |
| CLEANSWEEP | Dihuhuhuhu |
| PASTEE | Dihuhuhuhu |
| PASTEBIN | https:huhuhuhuhuhuhuhuhuhuhu |
| CLIP | nhuhuhuhu |
| UAC | Dihuhuhuhu |
| nowifi | ohuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialCnC
CNCmalicious
27.tchuhuhuhuhuhuhu
0af61a3613cb79aec77d9d2a6e2756e1
Port
PORTmalicious
1huhuhuhu
0af61a3613cb79aec77d9d2a6e2756e1
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account