Malicious
Malicious

206c8259c5fd44762f20e4857db0c6ad

PE Executable
MD5: 206c8259c5fd44762f20e4857db0c6ad
Size: 438.27 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
438.27 KB · 438,272 B
First seen
2026-08-13 06:46 · 2 months ago
Last seen
2026-08-13 06:46 · 2 months ago
Last analysis
2026-08-13 06:50 · 2 months ago
Hashes
MD5 206c8259c5fd44762f20e4857db0c6ad Sha1 72fe53df687b6dc517a5c9fa1012fa00dd1afcf9 Sha256 c66052e6deca51833f260eeed639d78a7424bb244e9682ae736616d45d342e1c Sha384 0e4d6ebaf258f5cc5e32c0b2a3acbfaea5f400355f83aa42d0374e5b0fa30bb509fe14ded03d1d8c7756fbc25713693d Sha512 c2114a2a577e47573bd788f35f887b6dbf52b244ac57f3e297ac1b0af0ae24e45a2685404c8d51a9236310a5b226508bb9324f94d33e68fcc9ceb1c7d20a425d SSDeep 6144:aeqt2XD0rGLtX4KS64Y49+3rpcBYhq7Yg2Uh9dtNPbu7N79B3r:x3z0w4T+bpcLHhHTu799 TLSH 34941A2A36564E91C2890B73C1DB950087E3A686B9F3F74FB54403661D073EFE94BA93
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
1 malicious · 7 files
EXE206c8259c5fd44762f20e4857db0c6ad
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN.Net Resources
BINHrCBgyR5YDsF5xrt82.N8pI59fIPA9H5dxdUP
BIN9T1GixE5GZPp5s3LLO.slrUhDlNoIYyVWG1oA
BINnw3u0uMB6bHdp5XgTf.eVXiwoQJCUWH8VrhIn
BINIAUUv8de3JX9yXecxS.uwCLnheOvMdmLRG2P4
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Module Name
Vceerm.exe
Full Name
Vceerm.exe
EntryPoint
System.Void DgXK9Pr1LBTYJjQoNh.bDSuWFUZVaB6bWw7wA::rcBYv8rQd()
Scope Name
Vceerm.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Vceerm
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void DgXK9Pr1LBTYJjQoNh.bDSuWFUZVaB6bWw7wA::rcBYv8rQd()
Main IL Instruction Count
96
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_0188: ret
nop <null>
ldsfld NJgrm5UIESA498Qy93U NJgrm5UIESA498Qy93U::qOGUjsUTEh
call System.Byte[] NJgrm5UIESA498Qy93U::UPFUo0asJx(NJgrm5UIESA498Qy93U)
stloc.s V_1
ldc.i4 0
ldsfld <Module>{f71cb1c4-8ab1-4d56-ba88-d419f6bed85e} <Module>{f71cb1c4-8ab1-4d56-ba88-d419f6bed85e}::m_6c3562039b7b40899df005ee39f47bc3
ldfld System.Int32 <Module>{f71cb1c4-8ab1-4d56-ba88-d419f6bed85e}::m_40d02c21869643cb88c28a133ab306c0
brfalse IL_0076: switch(IL_0096,IL_0111)
pop <null>
ldc.i4 0
br IL_0076: switch(IL_0096,IL_0111)
br IL_0072: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_0072: ldloc V_2
br IL_0111: leave IL_0188
ldc.i4 -12289396
ldc.i4 -816957814
xor <null>
ldsfld <Module>{f71cb1c4-8ab1-4d56-ba88-d419f6bed85e} <Module>{f71cb1c4-8ab1-4d56-ba88-d419f6bed85e}::m_6c3562039b7b40899df005ee39f47bc3
ldfld System.Int32 <Module>{f71cb1c4-8ab1-4d56-ba88-d419f6bed85e}::m_6de22a478c44490f905d7397af4b3967
xor <null>
ldsfld iwR5RSUAoIPKxoWRgSh iwR5RSUAoIPKxoWRgSh::JBxUHPLULF
call System.String iwR5RSUAoIPKxoWRgSh::UPFUo0asJx(System.Int32,iwR5RSUAoIPKxoWRgSh)
ldc.i4 -1661582187
ldc.i4 2
shl <null>
ldc.i4 1818128202
xor <null>
ldsfld <Module>{f71cb1c4-8ab1-4d56-ba88-d419f6bed85e} <Module>{f71cb1c4-8ab1-4d56-ba88-d419f6bed85e}::m_6c3562039b7b40899df005ee39f47bc3
ldfld System.Int32 <Module>{f71cb1c4-8ab1-4d56-ba88-d419f6bed85e}::m_16ea785f5423435aad7fff5dafd31579
xor <null>
ldsfld iwR5RSUAoIPKxoWRgSh iwR5RSUAoIPKxoWRgSh::JBxUHPLULF
call System.String iwR5RSUAoIPKxoWRgSh::UPFUo0asJx(System.Int32,iwR5RSUAoIPKxoWRgSh)
newobj System.Void OuLtW3Gx4clEoeXZQN.gC0hxw6bUSv6VOb97x::.ctor(System.String,System.String)
newobj System.Void CXEHDKeRsU5s5J5uYTg.h0T0NOeQPnpDkBb3ujh::.ctor(OuLtW3Gx4clEoeXZQN.gC0hxw6bUSv6VOb97x)
ldloc.s V_1
ldsfld L4bIYqUvxpyZoB1gvn4 L4bIYqUvxpyZoB1gvn4::o5vUzPvuCj
call System.Void L4bIYqUvxpyZoB1gvn4::UPFUo0asJx(System.Object,System.Byte[],L4bIYqUvxpyZoB1gvn4)
ldc.i4 1
ldsfld <Module>{f71cb1c4-8ab1-4d56-ba88-d419f6bed85e} <Module>{f71cb1c4-8ab1-4d56-ba88-d419f6bed85e}::m_6c3562039b7b40899df005ee39f47bc3
ldfld System.Int32 <Module>{f71cb1c4-8ab1-4d56-ba88-d419f6bed85e}::m_40d02c21869643cb88c28a133ab306c0
brfalse IL_0076: switch(IL_0096,IL_0111)
pop <null>
ldc.i4 4
br IL_0076: switch(IL_0096,IL_0111)
leave IL_0188: ret
pop <null>
ldc.i4 0
ldsfld <Module>{f71cb1c4-8ab1-4d56-ba88-d419f6bed85e} <Module>{f71cb1c4-8ab1-4d56-ba88-d419f6bed85e}::m_6c3562039b7b40899df005ee39f47bc3
ldfld System.Int32 <Module>{f71cb1c4-8ab1-4d56-ba88-d419f6bed85e}::m_4e7dd19529dc4bb9bf405eeaa7fd181a
brtrue IL_0148: switch(IL_0164)
pop <null>
ldc.i4 3
br IL_0148: switch(IL_0164)
br IL_0144: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_0144: ldloc V_3
br IL_0164: leave IL_0188
leave IL_0188: ret
ldc.i4 2
ldsfld <Module>{f71cb1c4-8ab1-4d56-ba88-d419f6bed85e} <Module>{f71cb1c4-8ab1-4d56-ba88-d419f6bed85e}::m_6c3562039b7b40899df005ee39f47bc3
ldfld System.Int32 <Module>{f71cb1c4-8ab1-4d56-ba88-d419f6bed85e}::m_9bcb1e1a783a4fd3bf2f390b004f38cf
brtrue IL_0014: switch(IL_0038,IL_0189,IL_0188)
pop <null>
ldc.i4 4
br IL_0014: switch(IL_0038,IL_0189,IL_0188)
ret <null>
ldsfld aqdEhRUqL949EENWj8g aqdEhRUqL949EENWj8g::f44UkKCeK0
call System.Void aqdEhRUqL949EENWj8g::UPFUo0asJx(aqdEhRUqL949EENWj8g)
ldc.i4 3
ldsfld <Module>{f71cb1c4-8ab1-4d56-ba88-d419f6bed85e} <Module>{f71cb1c4-8ab1-4d56-ba88-d419f6bed85e}::m_6c3562039b7b40899df005ee39f47bc3
ldfld System.Int32 <Module>{f71cb1c4-8ab1-4d56-ba88-d419f6bed85e}::m_be10ac7149db47018e4bcacc0c157d6c
brfalse IL_0014: switch(IL_0038,IL_0189,IL_0188)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_0189,IL_0188)
Module Name
Vceerm.exe
Full Name
Vceerm.exe
EntryPoint
System.Void DgXK9Pr1LBTYJjQoNh.bDSuWFUZVaB6bWw7wA::rcBYv8rQd()
Scope Name
Vceerm.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Vceerm
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void DgXK9Pr1LBTYJjQoNh.bDSuWFUZVaB6bWw7wA::rcBYv8rQd()
Main IL Instruction Count
96
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_0188: ret
nop <null>
ldsfld NJgrm5UIESA498Qy93U NJgrm5UIESA498Qy93U::qOGUjsUTEh
call System.Byte[] NJgrm5UIESA498Qy93U::UPFUo0asJx(NJgrm5UIESA498Qy93U)
stloc.s V_1
ldc.i4 0
ldsfld <Module>{f71cb1c4-8ab1-4d56-ba88-d419f6bed85e} <Module>{f71cb1c4-8ab1-4d56-ba88-d419f6bed85e}::m_6c3562039b7b40899df005ee39f47bc3
ldfld System.Int32 <Module>{f71cb1c4-8ab1-4d56-ba88-d419f6bed85e}::m_40d02c21869643cb88c28a133ab306c0
brfalse IL_0076: switch(IL_0096,IL_0111)
pop <null>
ldc.i4 0
br IL_0076: switch(IL_0096,IL_0111)
br IL_0072: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_0072: ldloc V_2
br IL_0111: leave IL_0188
ldc.i4 -12289396
ldc.i4 -816957814
xor <null>
ldsfld <Module>{f71cb1c4-8ab1-4d56-ba88-d419f6bed85e} <Module>{f71cb1c4-8ab1-4d56-ba88-d419f6bed85e}::m_6c3562039b7b40899df005ee39f47bc3
ldfld System.Int32 <Module>{f71cb1c4-8ab1-4d56-ba88-d419f6bed85e}::m_6de22a478c44490f905d7397af4b3967
xor <null>
ldsfld iwR5RSUAoIPKxoWRgSh iwR5RSUAoIPKxoWRgSh::JBxUHPLULF
call System.String iwR5RSUAoIPKxoWRgSh::UPFUo0asJx(System.Int32,iwR5RSUAoIPKxoWRgSh)
ldc.i4 -1661582187
ldc.i4 2
shl <null>
ldc.i4 1818128202
xor <null>
ldsfld <Module>{f71cb1c4-8ab1-4d56-ba88-d419f6bed85e} <Module>{f71cb1c4-8ab1-4d56-ba88-d419f6bed85e}::m_6c3562039b7b40899df005ee39f47bc3
ldfld System.Int32 <Module>{f71cb1c4-8ab1-4d56-ba88-d419f6bed85e}::m_16ea785f5423435aad7fff5dafd31579
xor <null>
ldsfld iwR5RSUAoIPKxoWRgSh iwR5RSUAoIPKxoWRgSh::JBxUHPLULF
call System.String iwR5RSUAoIPKxoWRgSh::UPFUo0asJx(System.Int32,iwR5RSUAoIPKxoWRgSh)
newobj System.Void OuLtW3Gx4clEoeXZQN.gC0hxw6bUSv6VOb97x::.ctor(System.String,System.String)
newobj System.Void CXEHDKeRsU5s5J5uYTg.h0T0NOeQPnpDkBb3ujh::.ctor(OuLtW3Gx4clEoeXZQN.gC0hxw6bUSv6VOb97x)
ldloc.s V_1
ldsfld L4bIYqUvxpyZoB1gvn4 L4bIYqUvxpyZoB1gvn4::o5vUzPvuCj
call System.Void L4bIYqUvxpyZoB1gvn4::UPFUo0asJx(System.Object,System.Byte[],L4bIYqUvxpyZoB1gvn4)
ldc.i4 1
ldsfld <Module>{f71cb1c4-8ab1-4d56-ba88-d419f6bed85e} <Module>{f71cb1c4-8ab1-4d56-ba88-d419f6bed85e}::m_6c3562039b7b40899df005ee39f47bc3
ldfld System.Int32 <Module>{f71cb1c4-8ab1-4d56-ba88-d419f6bed85e}::m_40d02c21869643cb88c28a133ab306c0
brfalse IL_0076: switch(IL_0096,IL_0111)
pop <null>
ldc.i4 4
br IL_0076: switch(IL_0096,IL_0111)
leave IL_0188: ret
pop <null>
ldc.i4 0
ldsfld <Module>{f71cb1c4-8ab1-4d56-ba88-d419f6bed85e} <Module>{f71cb1c4-8ab1-4d56-ba88-d419f6bed85e}::m_6c3562039b7b40899df005ee39f47bc3
ldfld System.Int32 <Module>{f71cb1c4-8ab1-4d56-ba88-d419f6bed85e}::m_4e7dd19529dc4bb9bf405eeaa7fd181a
brtrue IL_0148: switch(IL_0164)
pop <null>
ldc.i4 3
br IL_0148: switch(IL_0164)
br IL_0144: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_0144: ldloc V_3
br IL_0164: leave IL_0188
leave IL_0188: ret
ldc.i4 2
ldsfld <Module>{f71cb1c4-8ab1-4d56-ba88-d419f6bed85e} <Module>{f71cb1c4-8ab1-4d56-ba88-d419f6bed85e}::m_6c3562039b7b40899df005ee39f47bc3
ldfld System.Int32 <Module>{f71cb1c4-8ab1-4d56-ba88-d419f6bed85e}::m_9bcb1e1a783a4fd3bf2f390b004f38cf
brtrue IL_0014: switch(IL_0038,IL_0189,IL_0188)
pop <null>
ldc.i4 4
br IL_0014: switch(IL_0038,IL_0189,IL_0188)
ret <null>
ldsfld aqdEhRUqL949EENWj8g aqdEhRUqL949EENWj8g::f44UkKCeK0
call System.Void aqdEhRUqL949EENWj8g::UPFUo0asJx(aqdEhRUqL949EENWj8g)
ldc.i4 3
ldsfld <Module>{f71cb1c4-8ab1-4d56-ba88-d419f6bed85e} <Module>{f71cb1c4-8ab1-4d56-ba88-d419f6bed85e}::m_6c3562039b7b40899df005ee39f47bc3
ldfld System.Int32 <Module>{f71cb1c4-8ab1-4d56-ba88-d419f6bed85e}::m_be10ac7149db47018e4bcacc0c157d6c
brfalse IL_0014: switch(IL_0038,IL_0189,IL_0188)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_0189,IL_0188)
1 malicious · 7 files
EXE206c8259c5fd44762f20e4857db0c6ad
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙