Malicious
Malicious

1b37fb289ad1e3da62510caf740de1ce

PE Executable
MD5: 1b37fb289ad1e3da62510caf740de1ce
Size: 48.64 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Size
48.64 KB · 48,640 B
First seen
2026-06-20 20:46 · 4 months ago
Last seen
2026-06-20 20:46 · 4 months ago
Last analysis
2026-06-20 21:22 · 4 months ago
Hashes
MD5 1b37fb289ad1e3da62510caf740de1ce Sha1 0468dca0ebefd05537dfa9a770b7c9e332aa4093 Sha256 c9eadf5f3be0996c41ad4c42f7bf530b74d8682ac630cea018dd0edefa07d4ea Sha384 599ffe391574047063c57a6fd7e0ce64f2502af6313ef1e314d1475b49470333406a339efc52eaadf9f88e97a758ca1d Sha512 5483b4cad4dcaaf63c6438bcb58ca085037c4ef4ca95361a5f05347e2cecbf1d66ebf6cdcf95bfebac125707af2f11dd6ded1afba583309ea898e943c0c8fa57 SSDeep 768:kuSEa5TAYOTSWUkC+zmo2qLnrSBHYPrUmIPImXQIJXOBjr0bEDx/wreq0YlAm+dS:kuSEa5TAxv2qrSGrUamXLp2gbEDx+eqt TLSH 8B233D003BF9C12BF27E4F7858F22145867AF2673603D54E2CC4469B5A13BC29A525FE
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
1 malicious · 3 files
EXE1b37fb289ad1e3da62510caf740de1ceAsyncRAT
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
Config. Field Value
Key (AES_256) Q0thZXhuhuhuhuhuhuhuhuhuhuhu
Pastebin -huhuhuhu
Certificate MIIE8jhuhuhuhuhuhuhuhuhuhuhu
ServerSignature aIIXGohuhuhuhuhuhuhuhuhuhuhu
Install fhuhuhuhu
BDOS fhuhuhuhu
Anti-VM fhuhuhuhu
Install-Folder %Aphuhuhuhu
Hosts 127.0.huhuhuhuhuhuhuhuhuhuhu
Ports 1605,6huhuhuhuhuhuhu
Mutex kknChuhuhuhu
Version 0huhuhuhu
Delay 3huhuhuhu
Group Dehuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
wDzpZixuWcs
Full Name
wDzpZixuWcs
EntryPoint
System.Void XLhLHpiIIVVxH.pQSAsAOqmeHq::Main()
Scope Name
wDzpZixuWcs
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
duh
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
120
Main Method
System.Void XLhLHpiIIVVxH.pQSAsAOqmeHq::Main()
Main IL Instruction Count
51
Main IL 
ldc.i4.0 <null>
stloc.0 <null>
br IL_0015: ldloc.0
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
ldc.i4.1 <null>
add <null>
stloc.0 <null>
ldloc.0 <null>
ldsfld System.String XLhLHpiIIVVxH.lKyPDNDjcybjCP::sXYQGbkfAuFEN
call System.Int32 System.Convert::ToInt32(System.String)
blt.s IL_0007: ldc.i4 1000
call System.Boolean XLhLHpiIIVVxH.lKyPDNDjcybjCP::IpyxmWJvlBuvm()
brtrue IL_0032: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Boolean WcDbFqSfFHJM.ZWkeXweLcAR::mGkLbZkyTaR()
brtrue IL_0043: ldsfld System.String XLhLHpiIIVVxH.lKyPDNDjcybjCP::hHbulrKqsmv
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String XLhLHpiIIVVxH.lKyPDNDjcybjCP::hHbulrKqsmv
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_0057: ldsfld System.String XLhLHpiIIVVxH.lKyPDNDjcybjCP::UdsohqXqrUtn
call System.Void WcDbFqSfFHJM.ZynZPNMePqt::JTwgUsTmzJRacyLZF()
ldsfld System.String XLhLHpiIIVVxH.lKyPDNDjcybjCP::UdsohqXqrUtn
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_006B: ldsfld System.String XLhLHpiIIVVxH.lKyPDNDjcybjCP::UQvaWVcHOdRzWn
call System.Void ikLRDRdPpVxvTpB.FmckbTwYoaEa::JnUsmRJyDUDkV()
ldsfld System.String XLhLHpiIIVVxH.lKyPDNDjcybjCP::UQvaWVcHOdRzWn
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_0089: call System.Void WcDbFqSfFHJM.fHZlKfwGQTeuNVUH::nwaSwVWUOoq()
call System.Boolean WcDbFqSfFHJM.fHZlKfwGQTeuNVUH::XCXHvefLUImTuz()
brfalse IL_0089: call System.Void WcDbFqSfFHJM.fHZlKfwGQTeuNVUH::nwaSwVWUOoq()
call System.Void WcDbFqSfFHJM.rsIRgGZqUgGmueM::lkhEtZMCuOSUvq()
call System.Void WcDbFqSfFHJM.fHZlKfwGQTeuNVUH::nwaSwVWUOoq()
leave IL_0099: nop
pop <null>
leave IL_0099: nop
nop <null>
call System.Boolean KosCRPUeCwDij.EHfmnOJfuHnkxfhKIN::get_IsConnected()
brtrue IL_00AE: leave IL_00B9
call System.Void KosCRPUeCwDij.EHfmnOJfuHnkxfhKIN::owFDhTeylAJqlOoz()
call System.Void KosCRPUeCwDij.EHfmnOJfuHnkxfhKIN::bBoMhHFiBHjBb()
leave IL_00B9: ldc.i4 5000
pop <null>
leave IL_00B9: ldc.i4 5000
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_0099: nop
Module Name
wDzpZixuWcs
Full Name
wDzpZixuWcs
EntryPoint
System.Void XLhLHpiIIVVxH.pQSAsAOqmeHq::Main()
Scope Name
wDzpZixuWcs
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
duh
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
120
Main Method
System.Void XLhLHpiIIVVxH.pQSAsAOqmeHq::Main()
Main IL Instruction Count
51
Main IL 
ldc.i4.0 <null>
stloc.0 <null>
br IL_0015: ldloc.0
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
ldc.i4.1 <null>
add <null>
stloc.0 <null>
ldloc.0 <null>
ldsfld System.String XLhLHpiIIVVxH.lKyPDNDjcybjCP::sXYQGbkfAuFEN
call System.Int32 System.Convert::ToInt32(System.String)
blt.s IL_0007: ldc.i4 1000
call System.Boolean XLhLHpiIIVVxH.lKyPDNDjcybjCP::IpyxmWJvlBuvm()
brtrue IL_0032: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Boolean WcDbFqSfFHJM.ZWkeXweLcAR::mGkLbZkyTaR()
brtrue IL_0043: ldsfld System.String XLhLHpiIIVVxH.lKyPDNDjcybjCP::hHbulrKqsmv
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String XLhLHpiIIVVxH.lKyPDNDjcybjCP::hHbulrKqsmv
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_0057: ldsfld System.String XLhLHpiIIVVxH.lKyPDNDjcybjCP::UdsohqXqrUtn
call System.Void WcDbFqSfFHJM.ZynZPNMePqt::JTwgUsTmzJRacyLZF()
ldsfld System.String XLhLHpiIIVVxH.lKyPDNDjcybjCP::UdsohqXqrUtn
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_006B: ldsfld System.String XLhLHpiIIVVxH.lKyPDNDjcybjCP::UQvaWVcHOdRzWn
call System.Void ikLRDRdPpVxvTpB.FmckbTwYoaEa::JnUsmRJyDUDkV()
ldsfld System.String XLhLHpiIIVVxH.lKyPDNDjcybjCP::UQvaWVcHOdRzWn
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_0089: call System.Void WcDbFqSfFHJM.fHZlKfwGQTeuNVUH::nwaSwVWUOoq()
call System.Boolean WcDbFqSfFHJM.fHZlKfwGQTeuNVUH::XCXHvefLUImTuz()
brfalse IL_0089: call System.Void WcDbFqSfFHJM.fHZlKfwGQTeuNVUH::nwaSwVWUOoq()
call System.Void WcDbFqSfFHJM.rsIRgGZqUgGmueM::lkhEtZMCuOSUvq()
call System.Void WcDbFqSfFHJM.fHZlKfwGQTeuNVUH::nwaSwVWUOoq()
leave IL_0099: nop
pop <null>
leave IL_0099: nop
nop <null>
call System.Boolean KosCRPUeCwDij.EHfmnOJfuHnkxfhKIN::get_IsConnected()
brtrue IL_00AE: leave IL_00B9
call System.Void KosCRPUeCwDij.EHfmnOJfuHnkxfhKIN::owFDhTeylAJqlOoz()
call System.Void KosCRPUeCwDij.EHfmnOJfuHnkxfhKIN::bBoMhHFiBHjBb()
leave IL_00B9: ldc.i4 5000
pop <null>
leave IL_00B9: ldc.i4 5000
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_0099: nop
Key (AES_256) MUTEXmalicious
Q0thZXhuhuhuhuhuhuhuhuhuhuhu
CnC CNCmalicious
127huhuhuhu
CnC CNCmalicious
185.huhuhuhuhuhuhu
CnC CNCmalicious
host.shuhuhuhuhuhuhu
Ports PORTmalicious
1huhuhuhu
Ports PORTmalicious
6huhuhuhu
Ports PORTmalicious
7huhuhuhu
Ports PORTmalicious
8huhuhuhu
Mutex MUTEXmalicious
kknChuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
1 malicious · 3 files
EXE1b37fb289ad1e3da62510caf740de1ceAsyncRAT
Structure
Config. Field Value
Key (AES_256) Q0thZXhuhuhuhuhuhuhuhuhuhuhu
Pastebin -huhuhuhu
Certificate MIIE8jhuhuhuhuhuhuhuhuhuhuhu
ServerSignature aIIXGohuhuhuhuhuhuhuhuhuhuhu
Install fhuhuhuhu
BDOS fhuhuhuhu
Anti-VM fhuhuhuhu
Install-Folder %Aphuhuhuhu
Hosts 127.0.huhuhuhuhuhuhuhuhuhuhu
Ports 1605,6huhuhuhuhuhuhu
Mutex kknChuhuhuhu
Version 0huhuhuhu
Delay 3huhuhuhu
Group Dehuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Key (AES_256) MUTEXmalicious
Q0thZXhuhuhuhuhuhuhuhuhuhuhu
1b37fb289ad1e3da62510caf740de1ce
CnC CNCmalicious
127huhuhuhu
1b37fb289ad1e3da62510caf740de1ce
CnC CNCmalicious
185.huhuhuhuhuhuhu
1b37fb289ad1e3da62510caf740de1ce
CnC CNCmalicious
host.shuhuhuhuhuhuhu
1b37fb289ad1e3da62510caf740de1ce
Ports PORTmalicious
1huhuhuhu
1b37fb289ad1e3da62510caf740de1ce
Ports PORTmalicious
6huhuhuhu
1b37fb289ad1e3da62510caf740de1ce
Ports PORTmalicious
7huhuhuhu
1b37fb289ad1e3da62510caf740de1ce
Ports PORTmalicious
8huhuhuhu
1b37fb289ad1e3da62510caf740de1ce
Mutex MUTEXmalicious
kknChuhuhuhu
1b37fb289ad1e3da62510caf740de1ce
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙