Malicious
Malicious

25e1a98bf6b4ac5596ee8c805f80aea0

Share on LinkedIn
Print
PE Executable
MD5: 25e1a98bf6b4ac5596ee8c805f80aea0
Size: 86.35 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Size
86.35 KB · 86,350 B
First seen
2026-08-24 02:15 · 2 months ago
Last seen
2026-08-24 02:15 · 2 months ago
Last analysis
2026-08-31 22:51 · one month ago
Hashes
MD5 25e1a98bf6b4ac5596ee8c805f80aea0 Sha1 2dd5b7bee66dcd5090b0c2a8f8765dd9f886495b Sha256 255c08bad1b9fb0092be6870923e7918cdd11b07fde4657875df8363af9b8843 Sha384 ce2e387472e20b0ad17f62007a0333c655361ef202f4470ce0cf43e7d3231217319f9bfb2fcd2ec4e07960bda9dd3467 Sha512 5a1471962fa2b101542b227e5a8fc94379d2a52af4bf1ebf17e283ed34fd2b1809dd9d048e8a39afed2c1a3ef6fc3f997f1411086d227ff6ece9666236bcd09b SSDeep 1536:r0zrrtiJbi2Xj5XqnYFx+tqOW/AwSlWbYTjipvF2a:r0EB+IOWY2bYvQd2a TLSH A883F802F7879762D56C017500DB21A013F1AFDB5E73D51B3D88339DAA337929E89B8A
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
High
1 malicious · 11 files
EXE25e1a98bf6b4ac5596ee8c805f80aea0RevengeRat
Structure
BINOverlay_997cd534.bin
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Module Name
Nuclear Explosion.exe
Full Name
Nuclear Explosion.exe
EntryPoint
System.Void Nuclear_Explosion.Atomic::Main()
Scope Name
Nuclear Explosion.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v2.0.50727
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Nuclear Explosion
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Info
Overlay extracted: Overlay_997cd534.bin (30030 bytes)
Target Framework
<null>
Total Strings
42
Main Method
System.Void Nuclear_Explosion.Atomic::Main()
Main IL Instruction Count
91
Main IL 
br IL_0007: nop
pop <null>
ldc.i4.0 <null>
nop <null>
nop <null>
nop <null>
ldc.i4 206
call System.String at2y0bgxVD5QHkKIJf.s125XNdA5wMOGS9Ywn::zeWpEv8Gm(System.Int32)
call System.String System.Environment::GetEnvironmentVariable(System.String)
ldc.i4 222
call System.String at2y0bgxVD5QHkKIJf.s125XNdA5wMOGS9Ywn::zeWpEv8Gm(System.Int32)
call System.String System.String::Concat(System.String,System.String)
stloc.0 <null>
call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
callvirt System.Diagnostics.ProcessModule System.Diagnostics.Process::get_MainModule()
callvirt System.String System.Diagnostics.ProcessModule::get_FileName()
ldloc.0 <null>
ldc.i4.0 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean)
ldc.i4.0 <null>
cgt.un <null>
stloc.1 <null>
ldloc.1 <null>
brfalse IL_0068: nop
call System.String System.IO.Path::GetTempPath()
ldc.i4 318
call System.String at2y0bgxVD5QHkKIJf.s125XNdA5wMOGS9Ywn::zeWpEv8Gm(System.Int32)
call System.String System.String::Concat(System.String,System.String)
call System.String System.Windows.Forms.Application::get_ExecutablePath()
call System.Void System.IO.File::WriteAllText(System.String,System.String)
nop <null>
nop <null>
nop <null>
ldloc.0 <null>
ldnull <null>
ldsfld System.String Nuclear_Explosion.Atomic::App
call System.Byte[] System.IO.File::ReadAllBytes(System.String)
ldc.i4.0 <null>
call System.Boolean BLjsBuvKVlRj2MKW0X.mG62oANr4jx0wP4HJO::u55CyN0gE(System.String,System.String,System.Byte[],System.Boolean)
pop <null>
leave IL_00BC: nop
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
nop <null>
nop <null>
ldloc.0 <null>
ldnull <null>
ldsfld System.String Nuclear_Explosion.Atomic::App
call System.Byte[] System.IO.File::ReadAllBytes(System.String)
ldc.i4.1 <null>
call System.Boolean BLjsBuvKVlRj2MKW0X.mG62oANr4jx0wP4HJO::u55CyN0gE(System.String,System.String,System.Byte[],System.Boolean)
pop <null>
leave IL_00B1: nop
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave IL_00B1: nop
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave IL_00BC: nop
nop <null>
call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
callvirt System.Diagnostics.ProcessModule System.Diagnostics.Process::get_MainModule()
callvirt System.String System.Diagnostics.ProcessModule::get_FileName()
ldloc.0 <null>
ldc.i4.0 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean)
ldc.i4.0 <null>
cgt.un <null>
stloc.2 <null>
ldloc.2 <null>
brfalse IL_00E8: call System.String System.IO.Path::GetTempPath()
call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
callvirt System.Void System.Diagnostics.Process::Kill()
nop <null>
call System.String System.IO.Path::GetTempPath()
ldc.i4 350
call System.String at2y0bgxVD5QHkKIJf.s125XNdA5wMOGS9Ywn::zeWpEv8Gm(System.Int32)
call System.String System.String::Concat(System.String,System.String)
call System.String System.IO.File::ReadAllText(System.String)
stsfld System.String Nuclear_Explosion.Atomic::App
leave IL_011B: nop
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave IL_011B: nop
nop <null>
nop <null>
ldsfld Nuclear_Explosion.Atomic Nuclear_Explosion.Atomic::SCG
callvirt System.Void Nuclear_Explosion.Atomic::Execute()
nop <null>
ret <null>
Module Name
Nuclear Explosion.exe
Full Name
Nuclear Explosion.exe
EntryPoint
System.Void Nuclear_Explosion.Atomic::Main()
Scope Name
Nuclear Explosion.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v2.0.50727
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Nuclear Explosion
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
42
Main Method
System.Void Nuclear_Explosion.Atomic::Main()
Main IL Instruction Count
91
Main IL 
br IL_0007: nop
pop <null>
ldc.i4.0 <null>
nop <null>
nop <null>
nop <null>
ldc.i4 206
call System.String at2y0bgxVD5QHkKIJf.s125XNdA5wMOGS9Ywn::zeWpEv8Gm(System.Int32)
call System.String System.Environment::GetEnvironmentVariable(System.String)
ldc.i4 222
call System.String at2y0bgxVD5QHkKIJf.s125XNdA5wMOGS9Ywn::zeWpEv8Gm(System.Int32)
call System.String System.String::Concat(System.String,System.String)
stloc.0 <null>
call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
callvirt System.Diagnostics.ProcessModule System.Diagnostics.Process::get_MainModule()
callvirt System.String System.Diagnostics.ProcessModule::get_FileName()
ldloc.0 <null>
ldc.i4.0 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean)
ldc.i4.0 <null>
cgt.un <null>
stloc.1 <null>
ldloc.1 <null>
brfalse IL_0068: nop
call System.String System.IO.Path::GetTempPath()
ldc.i4 318
call System.String at2y0bgxVD5QHkKIJf.s125XNdA5wMOGS9Ywn::zeWpEv8Gm(System.Int32)
call System.String System.String::Concat(System.String,System.String)
call System.String System.Windows.Forms.Application::get_ExecutablePath()
call System.Void System.IO.File::WriteAllText(System.String,System.String)
nop <null>
nop <null>
nop <null>
ldloc.0 <null>
ldnull <null>
ldsfld System.String Nuclear_Explosion.Atomic::App
call System.Byte[] System.IO.File::ReadAllBytes(System.String)
ldc.i4.0 <null>
call System.Boolean BLjsBuvKVlRj2MKW0X.mG62oANr4jx0wP4HJO::u55CyN0gE(System.String,System.String,System.Byte[],System.Boolean)
pop <null>
leave IL_00BC: nop
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
nop <null>
nop <null>
ldloc.0 <null>
ldnull <null>
ldsfld System.String Nuclear_Explosion.Atomic::App
call System.Byte[] System.IO.File::ReadAllBytes(System.String)
ldc.i4.1 <null>
call System.Boolean BLjsBuvKVlRj2MKW0X.mG62oANr4jx0wP4HJO::u55CyN0gE(System.String,System.String,System.Byte[],System.Boolean)
pop <null>
leave IL_00B1: nop
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave IL_00B1: nop
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave IL_00BC: nop
nop <null>
call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
callvirt System.Diagnostics.ProcessModule System.Diagnostics.Process::get_MainModule()
callvirt System.String System.Diagnostics.ProcessModule::get_FileName()
ldloc.0 <null>
ldc.i4.0 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean)
ldc.i4.0 <null>
cgt.un <null>
stloc.2 <null>
ldloc.2 <null>
brfalse IL_00E8: call System.String System.IO.Path::GetTempPath()
call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
callvirt System.Void System.Diagnostics.Process::Kill()
nop <null>
call System.String System.IO.Path::GetTempPath()
ldc.i4 350
call System.String at2y0bgxVD5QHkKIJf.s125XNdA5wMOGS9Ywn::zeWpEv8Gm(System.Int32)
call System.String System.String::Concat(System.String,System.String)
call System.String System.IO.File::ReadAllText(System.String)
stsfld System.String Nuclear_Explosion.Atomic::App
leave IL_011B: nop
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave IL_011B: nop
nop <null>
nop <null>
ldsfld Nuclear_Explosion.Atomic Nuclear_Explosion.Atomic::SCG
callvirt System.Void Nuclear_Explosion.Atomic::Execute()
nop <null>
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙