Malicious
29d87ed8ebc9b05426800ad3c13a8fcd
PE Executable
MD5: 29d87ed8ebc9b05426800ad3c13a8fcd
Size: 56.32 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Size
56.32 KB · 56,320 B
First seen
2026-09-10 04:30 · one month ago
Last seen
2026-09-10 04:30 · one month ago
Last analysis
2026-09-10 04:30 · one month ago
Hashes
MD5
29d87ed8ebc9b05426800ad3c13a8fcd
Sha1
96add574a522e59eadea6ee8355f74a43c46f742
Sha256
c92f2e4f8ebfa4a61f3b17663076cb8513f26bc60fbdbe6faea232f621b6e802
Sha384
000562c22cc244b56e8bc5e216bd7e80028b5c3f3f42c35fdbc5a82f87e168ffd50a6299e19a2ff3f8e4f7bf83e14d4f
Sha512
0ccbaf3997e5d34c304bfcbdcacfe459ed4f4607e6a982f30fb388d7ce28e9651f8556d4e9a3f70aa593575ef52f0c68b19208bfd48d13e73acd6d072877260a
SSDeep
1536:sqCUbsDnyNho6JypySDxwsNMDjXExI3pmhm:NCEsDn4o6I4SDxwsNMDjXExI3pm
TLSH
65431744BFEA4A05E2BD8F3468F655150634BA63E932EB1E4CD668DB13327C58C40FE6
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Low
1 malicious · 2 files
EXE29d87ed8ebc9b05426800ad3c13a8fcdnjRat
Structure
BINResources
BINRT_MANIFEST
BINID:0001
BINID:0
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe>pe:rsrc>bin
Shape
pe:exe>pe:rsrc>bin
malicious
3 nodes
| Config. Field | Value |
|---|---|
| packet_size [b] | 5huhuhuhu |
| BD [BD] | Fhuhuhuhu |
| directory [DR] | Thuhuhuhu |
| executable_name [EXE] | dllhuhuhuhu |
| cnc_host [H] | 18.tcphuhuhuhuhuhuhu |
| is_dir_defined [Idr] | Fhuhuhuhu |
| Anti_CH | Fhuhuhuhu |
| is_startup_folder [IsF] | Fhuhuhuhu |
| USB_SP | Fhuhuhuhu |
| is_user_reg [Isu] | Fhuhuhuhu |
| cnc_port [P] | 1huhuhuhu |
| reg_key [RG] | 0caff8huhuhuhuhuhuhuhuhuhuhu |
| reg_path [sf] | Softwahuhuhuhuhuhuhuhuhuhuhu |
| victim_name [VN] | Vihuhuhuhu |
| version [VR] | <- NjRhuhuhuhuhuhuhuhuhuhuhu |
| splitter [Y] | Y262huhuhuhu |
| MSGE | Dihuhuhuhu |
| MSGT | Thhuhuhuhu |
| MSGB | Sorry,huhuhuhuhuhuhuhuhuhuhu |
| MSGSYM | vbChuhuhuhu |
| OBITO | Dihuhuhuhu |
| TSKE | Dihuhuhuhu |
| TSK | Wirehuhuhuhuhuhuhu |
| KAKASHI | Dihuhuhuhu |
| AKATSUKI | Dihuhuhuhu |
| CLEANSWEEP | Dihuhuhuhu |
| PASTEE | Dihuhuhuhu |
| PASTEBIN | https:huhuhuhuhuhuhuhuhuhuhu |
| CLIP | nhuhuhuhu |
| UAC | Dihuhuhuhu |
| nowifi | ohuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| Module Name | Stub.exe |
| Full Name | Stub.exe |
| EntryPoint | System.Void j.A::main() |
| Scope Name | Stub.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v2.0.50727 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | Stub |
| Assembly Version | 0.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | <null> |
| Total Strings | 539 |
| Main Method | System.Void j.A::main() |
| Main IL Instruction Count | 2 |
| Main IL | |
| Module Name | Stub.exe |
| Full Name | Stub.exe |
| EntryPoint | System.Void j.A::main() |
| Scope Name | Stub.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v2.0.50727 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | Stub |
| Assembly Version | 0.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | <null> |
| Total Strings | 539 |
| Main Method | System.Void j.A::main() |
| Main IL Instruction Count | 2 |
| Main IL | |
CnC
CNCmalicious
18.tcphuhuhuhuhuhuhu
Port
PORTmalicious
1huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential1 malicious · 2 files
EXE29d87ed8ebc9b05426800ad3c13a8fcdnjRat
Structure
BINResources
| Config. Field | Value |
|---|---|
| packet_size [b] | 5huhuhuhu |
| BD [BD] | Fhuhuhuhu |
| directory [DR] | Thuhuhuhu |
| executable_name [EXE] | dllhuhuhuhu |
| cnc_host [H] | 18.tcphuhuhuhuhuhuhu |
| is_dir_defined [Idr] | Fhuhuhuhu |
| Anti_CH | Fhuhuhuhu |
| is_startup_folder [IsF] | Fhuhuhuhu |
| USB_SP | Fhuhuhuhu |
| is_user_reg [Isu] | Fhuhuhuhu |
| cnc_port [P] | 1huhuhuhu |
| reg_key [RG] | 0caff8huhuhuhuhuhuhuhuhuhuhu |
| reg_path [sf] | Softwahuhuhuhuhuhuhuhuhuhuhu |
| victim_name [VN] | Vihuhuhuhu |
| version [VR] | <- NjRhuhuhuhuhuhuhuhuhuhuhu |
| splitter [Y] | Y262huhuhuhu |
| MSGE | Dihuhuhuhu |
| MSGT | Thhuhuhuhu |
| MSGB | Sorry,huhuhuhuhuhuhuhuhuhuhu |
| MSGSYM | vbChuhuhuhu |
| OBITO | Dihuhuhuhu |
| TSKE | Dihuhuhuhu |
| TSK | Wirehuhuhuhuhuhuhu |
| KAKASHI | Dihuhuhuhu |
| AKATSUKI | Dihuhuhuhu |
| CLEANSWEEP | Dihuhuhuhu |
| PASTEE | Dihuhuhuhu |
| PASTEBIN | https:huhuhuhuhuhuhuhuhuhuhu |
| CLIP | nhuhuhuhu |
| UAC | Dihuhuhuhu |
| nowifi | ohuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialCnC
CNCmalicious
18.tcphuhuhuhuhuhuhu
29d87ed8ebc9b05426800ad3c13a8fcd
Port
PORTmalicious
1huhuhuhu
29d87ed8ebc9b05426800ad3c13a8fcd
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account