.NET Reflective Loader malware analysis – 847ec4c81c10

Ctrl + scroll to zoom · drag to pan

This sample is a 5.4 MB PE Executable identified by Malva.RE as .NET Reflective Loader (loader, crypter). Static analysis extracted 582 embedded or derived files. It matches 18 YARA rules. Observed behaviours map to MITRE ATT&CK T1059.007. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256: 847ec4c81c1034be7934e37f6f97cde1ff5b555157b344afd5475ffc71f29091
MD5: 106c94d5389cd09a776092507c2fca96
Verdict: Malicious
File type: PE Executable · 5.4 MB
Family: .NET Reflective Loader
Category: Loader, Crypter
MITRE ATT&CK: T1059.007

Cite this report: https://app.malva.re/sha256/847ec4c81c1034be7934e37f6f97cde1ff5b555157b344afd5475ffc71f29091

Related .NET Reflective Loader samples

e4076179d7aea59bc230fd138091d440fc48edf2844b9022835ca162ae428381 2026-10-28
d6055b5594b16f82fce35db1a693e65fcf6209facbd90f755815e0e7b7791e7f 2026-10-19
86dfa03616288994385a6aaf1106e1320d92096122b376f2ef6229c73fc1ee0d 2026-10-14
08954f9446234a2fafe12537884cfd684df960b6d28527f6777248518ab7e526 2026-10-09
08edc0df73427e600402e4f2529d5284b17ccb16f4c24594869ca7e6ddc33936 2026-09-28
080dfb9d893d2dd995e8fb81a4098a8d908c563e38d70a8e5bc15debcf1f065a 2026-09-10

All .NET Reflective Loader analyses →

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Size

5.65 MB · 5,646,848 B

First seen

2026-10-28 11:00 · 4 days ago

Last seen

2026-10-28 11:00 · 4 days ago

Last analysis

2026-10-28 11:01 · 4 days ago

Hashes

MD5 106c94d5389cd09a776092507c2fca96 Sha1 d548deafacfb0ba5cbfef6c28759974a62d4f07a Sha256 847ec4c81c1034be7934e37f6f97cde1ff5b555157b344afd5475ffc71f29091 Sha384 84f607cacb602e3af9f46ab4449bf2c67d7095e5718ef419a7e760cce184873e3f51079d151526ce8944ca781e89cb5a Sha512 dc91166f2ffbee6b0aa8518dcd1c04d3710a94a2171e49b8ce7725c8611c866717e332c763d760da9e7ac6159023635a1ab92de0d1f7d197ed03b91c566e4a8b SSDeep 98304:m4HXmKBm3513/itZ6vYbqiv0fRg9Q37PE4rm:m4Lm3P3/itZ6gWrg9Ibr TLSH 0046232B23C55A48D63E57F4843889C29BB17E4FAE11C31D79C9339C5E32296BB52723

Detection

Symbol obfuscation

Very high

2 malicious · 583 files

EXE106c94d5389cd09a776092507c2fca96.NET Reflective Loader

Structure

BIN.Net Reflective Loader

EXEMaselatki.562567.tsx [AES Decrypted]

Structure

BIN.Net Resources

BINOverlay_fef55cbd.bin

BINResources

BIN.Net Resources

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

4 / 4

Path pe:exe>pe:dll~T1059.007>pe:rsrc>bin

Shape pe:exe>pe:dll>pe:rsrc>bin

malicious 4 nodes

Path pe:exe>pe:dll~T1059.007>bin

Shape pe:exe>pe:dll>bin

malicious 3 nodes

Name	Value
Module Name	6Rj_Ct3e4Jg
Full Name	6Rj_Ct3e4Jg
EntryPoint	System.Void 6Rj_Ct3e4Jg.2Twzy7Bk::2MatKyr0w8Yk4()
Scope Name	6Rj_Ct3e4Jg
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	6Rj_Ct3e4Jg
Assembly Version	20.7.38.48
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	1083
Main Method	System.Void 6Rj_Ct3e4Jg.2Twzy7Bk::2MatKyr0w8Yk4()
Main IL Instruction Count	51
Main IL	nop <null> nop <null> ldc.i4.s 25 stloc.2 <null> ldloc.2 <null> ldc.i4.1 <null> sub.ovf <null> ldc.i4.1 <null> add.ovf <null> newarr System.Object stloc.3 <null> ldloc.3 <null> ldc.i4.0 <null> ldstr 562567.tsx stelem.ref <null> ldloc.3 <null> ldc.i4.1 <null> ldc.i4 8848948 stloc.s V_4 ldloca.s V_4 call System.String System.Int32::ToString() stelem.ref <null> ldloc.3 <null> ldc.i4.2 <null> ldloc.3 <null> ldc.i4.0 <null> ldelem.ref <null> call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.Byte[] 6Rj_Ct3e4Jg.5SmnqyL79/Qgs4n7nArp.mZa1L0f_5fRj::3RdkC(System.String) stelem.ref <null> ldloc.3 <null> ldc.i4.3 <null> ldloc.3 <null> ldc.i4.2 <null> ldelem.ref <null> castclass System.Byte[] call System.Byte[] 6Rj_Ct3e4Jg.7CtwWdr1::Tq6pmLr4W(System.Byte[]) stelem.ref <null> ldloc.3 <null> ldloc.2 <null> call System.Void 6Rj_Ct3e4Jg.Aa3om0Ef2waHb/eKn4kb8Z0t.ax4Q2::Yet7wf6BH(System.Object[],System.Int32) nop <null> leave.s IL_0063: nop dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_5 nop <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0063: nop nop <null> ret <null>

106c94d5389cd09a776092507c2fca96

Overview

Related .NET Reflective Loader samples

Summary by MalvaGPT

Characteristics

File Structure

Information19

106c94d5389cd09a776092507c2fca96 (5.65 MB)

File Structure