1b5a5babac0a893e6e7856c009925bc7

PE Executable

MD5: 1b5a5babac0a893e6e7856c009925bc7

Size: 1.9 MB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Low

MD5	1b5a5babac0a893e6e7856c009925bc7
Sha1	594ed95999b0f6ae906ec4341aa1b956b6b644fa
Sha256	0191502b467e289f76a0b85a6fdd5662275fe342c72122c2fa2bc40d2cf5dbd2
Sha384	65d0aca408639119a92b7846c036ff4877313a98b3a94ea7100857947ae309225353326e58bc631f80c400a517db5993
Sha512	144a64b93bd8525d886f61c7e0f421ce859c0ad24fe8a3a3195d869ffa9b0035157caf636b1e5b52048480ed8f3b7f4f2c0104f44efff1ae8416591bfa1a1380
SSDeep	24576:cJELPQ4wcNJQgtsnEtmi1LmTMPaIngK9rHjlgyyd84XwAhGpdWq:xD1wcjfuEIfMP9gK9rK3dcAcP
TLSH	7695BE0563F85715F2BB6B38993656208F32BC529739C79E368910AD0F71B928C72B73

PeID

Microsoft Visual C++ DLLMicrosoft Visual C++ v6.0Microsoft Visual C++ v6.0 DLL

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 6 STICH kept: 1secondary ignored: 5

img 3bin 2

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe>pe:dll

Shape pe:exe>pe:dll

2 nodes

Name	Value
Module Name	HuntBOT.exe
Full Name	HuntBOT.exe
EntryPoint	System.Int32 Program::Main(System.String[])
Scope Name	HuntBOT.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	HuntBOT
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	1982
Main Method	System.Int32 Program::Main(System.String[])
Main IL Instruction Count	68
Main IL	ldarg.0 <null> ldlen <null> conv.i4 <null> ldc.i4.0 <null> ble.s IL_001C: ldarg.0 ldarg.0 <null> ldc.i4.0 <null> ldelem.ref <null> ldstr --complete-update call System.Boolean System.String::op_Equality(System.String,System.String) brfalse.s IL_001C: ldarg.0 ldarg.0 <null> call System.Int32 HuntBot.SelfUpdate::Complete(System.String[]) ret <null> ldarg.0 <null> ldlen <null> conv.i4 <null> ldc.i4.0 <null> ble.s IL_008C: ldarg.0 ldarg.0 <null> ldc.i4.0 <null> ldelem.ref <null> ldstr --start call System.Boolean System.String::op_Equality(System.String,System.String) brfalse.s IL_008C: ldarg.0 call System.Int32 HuntBot.DataMigration::Run() pop <null> ldarg.0 <null> ldlen <null> conv.i4 <null> ldc.i4.1 <null> bgt.s IL_0040: ldarg.0 ldnull <null> br.s IL_0043: stloc.0 ldarg.0 <null> ldc.i4.1 <null> ldelem.ref <null> stloc.0 <null> ldnull <null> ldloc.0 <null> ldc.i4.1 <null> ldnull <null> ldftn System.Void HuntBot.AppLog::Write(System.String) newobj System.Void System.Action`1<System.String>::.ctor(System.Object,System.IntPtr) call System.Diagnostics.Process HuntBot.GameLoader::Load(System.String,System.String,System.Boolean,System.Action`1<System.String>) stloc.1 <null> ldstr SUCCESS PID= ldloc.1 <null> callvirt System.Int32 System.Diagnostics.Process::get_Id() box System.Int32 call System.String System.String::Concat(System.Object,System.Object) call System.Void HuntBot.AppLog::Write(System.String) ldc.i4.0 <null> stloc.3 <null> leave.s IL_0093: ldloc.3 stloc.2 <null> ldstr ERROR ldloc.2 <null> call System.String System.String::Concat(System.Object,System.Object) call System.Void HuntBot.AppLog::Write(System.String) ldc.i4.1 <null> stloc.3 <null> leave.s IL_0093: ldloc.3 ldarg.0 <null> call System.Int32 HuntBot.AppMain::Run(System.String[]) ret <null> ldloc.3 <null> ret <null>
Info	PE Detect: PeReader OK (file layout)

No malware configuration was found at this point.

You must be signed in to view YARA rules.