Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
97.79 KB · 97,792 B
First seen
2025-10-30 15:48 · one year ago
Last seen
2025-10-30 15:48 · one year ago
Last analysis
2025-10-30 17:43 · one year ago
Hashes
MD5 26431da49778011246ad5721f4d3620f Sha1 29f8d3a6206729a88e4356d8312efcb18fd387a7 Sha256 9ab17bc9b2a86a555d7a9ad791e7f6c16de2fc3d04e6fb5adfb3729561468c93 Sha384 f15f9313ae4505d493bb22c975bb130d3c030050d3e53ee5a637d3c39ce9b613bc984e3156f39f88650c9d97927b154d Sha512 e029cbc436eb00a8b9c6c525081123a324a9183f1b5541781d3ab86ac05d47af87cf3b7dadfea1e7ee246a0b5c12f9938738dc4e14622fcfca27f3aa48fdf9ef SSDeep 1536:FqsIhaqpalbG6jejoigIP43Ywzi0Zb78ivombfexv0ujXyyed2ltmulgS6pQl:DGaKaYP+zi0ZbYe1g0ujyzd9Q TLSH 09A35D20679C9F19EAFD1B74B4B2012043F1E08A9091FB4B4DC154E71FA7B866957EF2
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Low
1 malicious · 3 files
EXE26431da49778011246ad5721f4d3620fRECORDSTEALER
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
Config. Field Value
[Configuration Module Name] Enthuhuhuhu
[Configuration Module Full Name] Enthuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Happy.exe
Full Name
Happy.exe
EntryPoint
System.Void Program::Main(System.String[])
Scope Name
Happy.exe
Scope Type
ModuleDef
Kind
Console
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Happy
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
234
Main Method
System.Void Program::Main(System.String[])
Main IL Instruction Count
3
Main IL 
newobj System.Void EntryPoint::.ctor()
call System.Void Program::Execute(EntryPoint)
ret <null>
Module Name
Happy.exe
Full Name
Happy.exe
EntryPoint
System.Void Program::Main(System.String[])
Scope Name
Happy.exe
Scope Type
ModuleDef
Kind
Console
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Happy
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
234
Main Method
System.Void Program::Main(System.String[])
Main IL Instruction Count
3
Main IL 
newobj System.Void EntryPoint::.ctor()
call System.Void Program::Execute(EntryPoint)
ret <null>
1 malicious · 3 files
EXE26431da49778011246ad5721f4d3620fRECORDSTEALER
Structure
Config. Field Value
[Configuration Module Name] Enthuhuhuhu
[Configuration Module Full Name] Enthuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙