Malicious
1807503a422d180ea91f0a23cbd76962
PE Executable
MD5: 1807503a422d180ea91f0a23cbd76962
Size: 56.32 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Size
56.32 KB · 56,320 B
First seen
2026-08-31 19:15 · one month ago
Last seen
2026-08-31 19:15 · one month ago
Last analysis
2026-08-31 19:15 · one month ago
Hashes
MD5
1807503a422d180ea91f0a23cbd76962
Sha1
33759ebbbc586e2f574838c7fdba7421862e4689
Sha256
79b3612d856a4949395de781b875c1625ff8bd1c9cb8790209bfb4819a2240d9
Sha384
5505f404af429442a3806c5141b25c666d65a842fd1ee81539364c2bbe1257b2957f6cd142dac835ea5000903da42786
Sha512
47a2f2ff72f5b62ef31c32447d709b92de2ab81deb6672cbf4c5921349c09a65d1c55a51cd7961ced7b826dbb6cc9181fd42710444b6c138185423c65c9bd763
SSDeep
1536:mdv4Dnpe/NoTcwiDESPDywsNMDwWXExI3pmSm:e4Dn8ymDRPDywsNMDvXExI3pm
TLSH
95432844BFEA4A01E2BD8F3469F655150A34BA63E932DB1F4CD168DB13326C58C80FE6
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Low
1 malicious · 2 files
EXE1807503a422d180ea91f0a23cbd76962njRat
Structure
BINResources
BINRT_MANIFEST
BINID:0001
BINID:0
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe>pe:rsrc>bin
Shape
pe:exe>pe:rsrc>bin
malicious
3 nodes
| Config. Field | Value |
|---|---|
| packet_size [b] | 5huhuhuhu |
| BD [BD] | Fhuhuhuhu |
| directory [DR] | Thuhuhuhu |
| executable_name [EXE] | dllhuhuhuhu |
| cnc_host [H] | 185.huhuhuhuhuhuhu |
| is_dir_defined [Idr] | Fhuhuhuhu |
| Anti_CH | Fhuhuhuhu |
| is_startup_folder [IsF] | Thuhuhuhu |
| USB_SP | Fhuhuhuhu |
| is_user_reg [Isu] | Thuhuhuhu |
| cnc_port [P] | 1huhuhuhu |
| reg_key [RG] | c52b32huhuhuhuhuhuhuhuhuhuhu |
| reg_path [sf] | Softwahuhuhuhuhuhuhuhuhuhuhu |
| victim_name [VN] | |
| version [VR] | <- NjRhuhuhuhuhuhuhuhuhuhuhu |
| splitter [Y] | Y262huhuhuhu |
| MSGE | Dihuhuhuhu |
| MSGT | Thhuhuhuhu |
| MSGB | Sorry,huhuhuhuhuhuhuhuhuhuhu |
| MSGSYM | vbChuhuhuhu |
| OBITO | Dihuhuhuhu |
| TSKE | Dihuhuhuhu |
| TSK | Wirehuhuhuhuhuhuhu |
| KAKASHI | Dihuhuhuhu |
| AKATSUKI | Dihuhuhuhu |
| CLEANSWEEP | Dihuhuhuhu |
| PASTEE | Dihuhuhuhu |
| PASTEBIN | https:huhuhuhuhuhuhuhuhuhuhu |
| CLIP | nhuhuhuhu |
| UAC | Dihuhuhuhu |
| nowifi | ohuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| Module Name | Stub.exe |
| Full Name | Stub.exe |
| EntryPoint | System.Void j.A::main() |
| Scope Name | Stub.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v2.0.50727 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | Stub |
| Assembly Version | 0.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | <null> |
| Total Strings | 539 |
| Main Method | System.Void j.A::main() |
| Main IL Instruction Count | 2 |
| Main IL | |
| Module Name | Stub.exe |
| Full Name | Stub.exe |
| EntryPoint | System.Void j.A::main() |
| Scope Name | Stub.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v2.0.50727 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | Stub |
| Assembly Version | 0.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | <null> |
| Total Strings | 539 |
| Main Method | System.Void j.A::main() |
| Main IL Instruction Count | 2 |
| Main IL | |
CnC
CNCmalicious
185.huhuhuhuhuhuhu
Port
PORTmalicious
1huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential1 malicious · 2 files
EXE1807503a422d180ea91f0a23cbd76962njRat
Structure
BINResources
| Config. Field | Value |
|---|---|
| packet_size [b] | 5huhuhuhu |
| BD [BD] | Fhuhuhuhu |
| directory [DR] | Thuhuhuhu |
| executable_name [EXE] | dllhuhuhuhu |
| cnc_host [H] | 185.huhuhuhuhuhuhu |
| is_dir_defined [Idr] | Fhuhuhuhu |
| Anti_CH | Fhuhuhuhu |
| is_startup_folder [IsF] | Thuhuhuhu |
| USB_SP | Fhuhuhuhu |
| is_user_reg [Isu] | Thuhuhuhu |
| cnc_port [P] | 1huhuhuhu |
| reg_key [RG] | c52b32huhuhuhuhuhuhuhuhuhuhu |
| reg_path [sf] | Softwahuhuhuhuhuhuhuhuhuhuhu |
| victim_name [VN] | |
| version [VR] | <- NjRhuhuhuhuhuhuhuhuhuhuhu |
| splitter [Y] | Y262huhuhuhu |
| MSGE | Dihuhuhuhu |
| MSGT | Thhuhuhuhu |
| MSGB | Sorry,huhuhuhuhuhuhuhuhuhuhu |
| MSGSYM | vbChuhuhuhu |
| OBITO | Dihuhuhuhu |
| TSKE | Dihuhuhuhu |
| TSK | Wirehuhuhuhuhuhuhu |
| KAKASHI | Dihuhuhuhu |
| AKATSUKI | Dihuhuhuhu |
| CLEANSWEEP | Dihuhuhuhu |
| PASTEE | Dihuhuhuhu |
| PASTEBIN | https:huhuhuhuhuhuhuhuhuhuhu |
| CLIP | nhuhuhuhu |
| UAC | Dihuhuhuhu |
| nowifi | ohuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialCnC
CNCmalicious
185.huhuhuhuhuhuhu
1807503a422d180ea91f0a23cbd76962
Port
PORTmalicious
1huhuhuhu
1807503a422d180ea91f0a23cbd76962
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account