Malicious
Malicious

24fa693615d733878490e8a5672a7351

Share on LinkedIn
Print
PE Executable
MD5: 24fa693615d733878490e8a5672a7351
Size: 63.49 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
63.49 KB · 63,488 B
Hashes
MD5 24fa693615d733878490e8a5672a7351 Sha1 84ef04fab3713c847101ed3ec69aa4058f308e1c Sha256 94996736d6917702bae5aa7ce888ee896be94fa6e620c0b155e9f3c7bbe5a369 Sha384 bc47cdab13df1672c192bfbe0d0ae8eb0ceabc4947e216c7de006d9d548cd1fb12984e80e77bb6e8fe9dafb487a154aa Sha512 deb42869f9c1438c048121e0fdadb053bc624d812104b141f1e87a50419d3d9041bdb4c72a1569c26f9d9ea00225e7b8fd692e3743338ef6e77c74a05154e8ea SSDeep 1536:S2L7ggM0iHN+XB1ONJbvlt7XEIr3LpbrXyFDlO1mv0UwHPcVlllllBZrzbTOaF39:S2L7ggM0iHN+XB1ONJbv77XEIr3LpbrO TLSH 6A535B4C77959620E7BE4EF818B2A6260A70D2935556E70E0CD170E97B6F7C0A344EF3
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Low
1 malicious · 5 files
EXE24fa693615d733878490e8a5672a7351njRat
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Config. Field Value
packet_size [b] 5huhuhuhu
BD [BD] Fhuhuhuhu
directory [DR] Aphuhuhuhu
executable_name [EXE] Microshuhuhuhuhuhuhuhuhuhuhu
isConnecting 0huhuhuhu
is_dir_defined [Idr] Fhuhuhuhu
is_startup_folder [IsF] Fhuhuhuhu
is_user_reg [Isu] Fhuhuhuhu
reg_key [RG] MyAppMhuhuhuhuhuhuhuhuhuhuhu
reg_path [sf] Softwahuhuhuhuhuhuhuhuhuhuhu
victim_name [VN] Hahuhuhuhu
version [VR] 0huhuhuhu
splitter [Y] |huhuhuhu
lastGoodPort 0huhuhuhu
netWatchInit 0huhuhuhu
lastNetEventTick 0huhuhuhu
reconnectStartTick 0huhuhuhu
p95ReconnectMs 8huhuhuhu
lastFailAllTick 0huhuhuhu
consecutiveFailAll 0huhuhuhu
consecutiveFails 0huhuhuhu
lastConnectedTick 0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
MergedApp
Full Name
MergedApp
EntryPoint
System.Void explorer.j.A::main()
Scope Name
MergedApp
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
MergedApp
Assembly Version
6.1.7800.8900
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
512
Main Method
System.Void explorer.j.A::main()
Main IL Instruction Count
14
Main IL 
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
ldsfld System.Net.Security.RemoteCertificateValidationCallback explorer.j.A/_Closure$__::$I1-0
brfalse.s IL_0018: ldsfld explorer.j.A/_Closure$__ explorer.j.A/_Closure$__::$I
ldsfld System.Net.Security.RemoteCertificateValidationCallback explorer.j.A/_Closure$__::$I1-0
br.s IL_002E: call System.Void System.Net.ServicePointManager::set_ServerCertificateValidationCallback(System.Net.Security.RemoteCertificateValidationCallback)
ldsfld explorer.j.A/_Closure$__ explorer.j.A/_Closure$__::$I
ldftn System.Boolean explorer.j.A/_Closure$__::_Lambda$__1-0(System.Object,System.Security.Cryptography.X509Certificates.X509Certificate,System.Security.Cryptography.X509Certificates.X509Chain,System.Net.Security.SslPolicyErrors)
newobj System.Void System.Net.Security.RemoteCertificateValidationCallback::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Net.Security.RemoteCertificateValidationCallback explorer.j.A/_Closure$__::$I1-0
call System.Void System.Net.ServicePointManager::set_ServerCertificateValidationCallback(System.Net.Security.RemoteCertificateValidationCallback)
call System.Void explorer.j.OK::ko()
ret <null>
Info
PE Detect: PeReader OK (file layout)
Module Name
MergedApp
Full Name
MergedApp
EntryPoint
System.Void explorer.j.A::main()
Scope Name
MergedApp
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
MergedApp
Assembly Version
6.1.7800.8900
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
512
Main Method
System.Void explorer.j.A::main()
Main IL Instruction Count
14
Main IL 
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
ldsfld System.Net.Security.RemoteCertificateValidationCallback explorer.j.A/_Closure$__::$I1-0
brfalse.s IL_0018: ldsfld explorer.j.A/_Closure$__ explorer.j.A/_Closure$__::$I
ldsfld System.Net.Security.RemoteCertificateValidationCallback explorer.j.A/_Closure$__::$I1-0
br.s IL_002E: call System.Void System.Net.ServicePointManager::set_ServerCertificateValidationCallback(System.Net.Security.RemoteCertificateValidationCallback)
ldsfld explorer.j.A/_Closure$__ explorer.j.A/_Closure$__::$I
ldftn System.Boolean explorer.j.A/_Closure$__::_Lambda$__1-0(System.Object,System.Security.Cryptography.X509Certificates.X509Certificate,System.Security.Cryptography.X509Certificates.X509Chain,System.Net.Security.SslPolicyErrors)
newobj System.Void System.Net.Security.RemoteCertificateValidationCallback::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Net.Security.RemoteCertificateValidationCallback explorer.j.A/_Closure$__::$I1-0
call System.Void System.Net.ServicePointManager::set_ServerCertificateValidationCallback(System.Net.Security.RemoteCertificateValidationCallback)
call System.Void explorer.j.OK::ko()
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙