Malicious
13fe4fd84d2f0fe65fe209c4ee390752
PE Executable
MD5: 13fe4fd84d2f0fe65fe209c4ee390752
Size: 32.26 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Size
32.26 KB · 32,256 B
First seen
2026-08-25 14:45 · 2 months ago
Last seen
2026-08-25 14:45 · 2 months ago
Last analysis
2026-08-25 14:45 · 2 months ago
Hashes
MD5
13fe4fd84d2f0fe65fe209c4ee390752
Sha1
3bb02bfec1d2c0723baac811b7a2ed2a9eff3d2c
Sha256
895fea5f9576b02251d5c3b6d49e5d4611d4255789744d56599d5b5ede7dd563
Sha384
3c02bf07d3caddbe187804414b312d52f8e8b4c44cc9bbf80e4536b641728ef4b6b87900c25e20cd871369c476cee412
Sha512
7e4727eb2616933ead9c95269eb61fcba224d1514d269b9407456cca5ad26c0a64ea77bbb66e5ed00788c5dd329e4e64a50fa0def0a9ef14bde86bef3be6c5a7
SSDeep
768:UzUPYZxTDezxp+BG9a3AZ3vwdQmIDUu0tiRIj:vsahhkQVkTj
TLSH
91E21B6DFBF64466D2BD0AB50571950013B4E003E523F77E4ECB24A62B6B6D84B88DF2
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Low
1 malicious · 2 files
EXE13fe4fd84d2f0fe65fe209c4ee390752njRat
Structure
BINResources
BINRT_MANIFEST
BINID:0001
BINID:0
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe>pe:rsrc>bin
Shape
pe:exe>pe:rsrc>bin
malicious
3 nodes
| Config. Field | Value |
|---|---|
| packet_size [b] | 5huhuhuhu |
| BD [BD] | Fhuhuhuhu |
| directory [DR] | Thuhuhuhu |
| executable_name [EXE] | Windowhuhuhuhuhuhuhu |
| cnc_host [H] | beebhuhuhuhuhuhuhu |
| is_dir_defined [Idr] | Fhuhuhuhu |
| Anti_CH | Fhuhuhuhu |
| is_startup_folder [IsF] | Thuhuhuhu |
| USB_SP | Thuhuhuhu |
| is_user_reg [Isu] | Thuhuhuhu |
| cnc_port [P] | 4huhuhuhu |
| reg_key [RG] | 0e6033huhuhuhuhuhuhuhuhuhuhu |
| reg_path [sf] | Softwahuhuhuhuhuhuhuhuhuhuhu |
| victim_name [VN] | flyhuhuhuhu |
| version [VR] | 0huhuhuhu |
| splitter [Y] | Y262huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| Module Name | Stub.exe |
| Full Name | Stub.exe |
| EntryPoint | System.Void j.A::main() |
| Scope Name | Stub.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v2.0.50727 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | Stub |
| Assembly Version | 0.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | <null> |
| Total Strings | 241 |
| Main Method | System.Void j.A::main() |
| Main IL Instruction Count | 4 |
| Main IL | |
| Module Name | Stub.exe |
| Full Name | Stub.exe |
| EntryPoint | System.Void j.A::main() |
| Scope Name | Stub.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v2.0.50727 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | Stub |
| Assembly Version | 0.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | <null> |
| Total Strings | 241 |
| Main Method | System.Void j.A::main() |
| Main IL Instruction Count | 4 |
| Main IL | |
CnC
CNCmalicious
beebhuhuhuhuhuhuhu
Port
PORTmalicious
4huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential1 malicious · 2 files
EXE13fe4fd84d2f0fe65fe209c4ee390752njRat
Structure
BINResources
| Config. Field | Value |
|---|---|
| packet_size [b] | 5huhuhuhu |
| BD [BD] | Fhuhuhuhu |
| directory [DR] | Thuhuhuhu |
| executable_name [EXE] | Windowhuhuhuhuhuhuhu |
| cnc_host [H] | beebhuhuhuhuhuhuhu |
| is_dir_defined [Idr] | Fhuhuhuhu |
| Anti_CH | Fhuhuhuhu |
| is_startup_folder [IsF] | Thuhuhuhu |
| USB_SP | Thuhuhuhu |
| is_user_reg [Isu] | Thuhuhuhu |
| cnc_port [P] | 4huhuhuhu |
| reg_key [RG] | 0e6033huhuhuhuhuhuhuhuhuhuhu |
| reg_path [sf] | Softwahuhuhuhuhuhuhuhuhuhuhu |
| victim_name [VN] | flyhuhuhuhu |
| version [VR] | 0huhuhuhu |
| splitter [Y] | Y262huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialCnC
CNCmalicious
beebhuhuhuhuhuhuhu
13fe4fd84d2f0fe65fe209c4ee390752
Port
PORTmalicious
4huhuhuhu
13fe4fd84d2f0fe65fe209c4ee390752
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account