Malicious
Malicious

2b6e59dedec39c9633d9d247d3c43d47

PE Executable
MD5: 2b6e59dedec39c9633d9d247d3c43d47
Size: 419.84 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
419.84 KB · 419,840 B
First seen
2026-10-13 02:45 · 12 days ago
Last seen
2026-10-13 02:45 · 12 days ago
Last analysis
2026-10-13 02:45 · 12 days ago
Hashes
MD5 2b6e59dedec39c9633d9d247d3c43d47 Sha1 c3ca3c40acd22ad9fb94b613573a115385697368 Sha256 4d75d51f4439a5706e061891065844a5201185fe345ed3f4aa72d8b2ec8bb914 Sha384 4d197f7dbc4dc626c43b783e8aadc73d5b28356d5cce036af5285835689c8f255b81697ec35bdf6ac86bd9a9df641731 Sha512 bab9809330db800d14504167890384afda086f4c512f95252ddbf79608cc78522f3f6ea073dde70797a82e27508279eb3a987de3e6e5433b05d862f5f48b0e71 SSDeep 3072:0iRHZGFCerAAtYkbgJ4qC2D5qYgD57A1W05edQLeR0v2dZCNA/qczmYyoci5GBff:0mHsFCbwk6kc4AiAZz1ZPY0dPKVCX TLSH AE942A1B37564E21C2994737D1E7810083DA96833AEBE32B399113D62D437FEEA06797
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
1 malicious · 7 files
EXE2b6e59dedec39c9633d9d247d3c43d47
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN.Net Resources
BINvtwNXdOgZ2bG7m3hMm.qe4nAsrwfMbsViYrhQ
BINdJZvOm0UPOjaaZ4Kk5.NQY86GVkDYOL5FeNw0
BINLV3ljKlUrfjIQtHhHc.k4n9WG4EMXy4DqRYCv
BINKI5cjIcUoob0JpXe4c.Wap37xPEDwx7IPEZSh
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Module Name
Gzlevy.exe
Full Name
Gzlevy.exe
EntryPoint
System.Void UfYEC5fDn6AcYuBYUk.zA9aZQUPvo88Zat31e::DZ6ZILK2x()
Scope Name
Gzlevy.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Gzlevy
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void UfYEC5fDn6AcYuBYUk.zA9aZQUPvo88Zat31e::DZ6ZILK2x()
Main IL Instruction Count
98
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_0062: nop
ldsfld bLg7K1UhsHh77qXeNtu bLg7K1UhsHh77qXeNtu::k6DUC9fA2N
call System.Void bLg7K1UhsHh77qXeNtu::i0gUIyhyLa(bLg7K1UhsHh77qXeNtu)
ldc.i4 1
ldsfld <Module>{9a2a4c5d-1a96-464e-9d30-7daada2407aa} <Module>{9a2a4c5d-1a96-464e-9d30-7daada2407aa}::m_39828e919bf94950a9f2a061e322f67a
ldfld System.Int32 <Module>{9a2a4c5d-1a96-464e-9d30-7daada2407aa}::m_72013d3c0d01492980969f3fd552f81f
brfalse IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
ret <null>
nop <null>
ldsfld sTue6OUqBhFUnVUZjmv sTue6OUqBhFUnVUZjmv::VdrUGqovEH
call System.Byte[] sTue6OUqBhFUnVUZjmv::i0gUIyhyLa(sTue6OUqBhFUnVUZjmv)
stloc.s V_3
ldc.i4 4
ldsfld <Module>{9a2a4c5d-1a96-464e-9d30-7daada2407aa} <Module>{9a2a4c5d-1a96-464e-9d30-7daada2407aa}::m_39828e919bf94950a9f2a061e322f67a
ldfld System.Int32 <Module>{9a2a4c5d-1a96-464e-9d30-7daada2407aa}::m_f1c8e7661d924ef9814df72efa334912
brtrue IL_00A0: switch(IL_0141,IL_00C0)
pop <null>
ldc.i4 1
br IL_00A0: switch(IL_0141,IL_00C0)
br IL_009C: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_009C: ldloc V_1
br IL_00C0: ldc.i4 -511124931
ldc.i4 -511124931
ldc.i4 2113712000
add <null>
ldc.i4 1313141427
xor <null>
ldsfld <Module>{9a2a4c5d-1a96-464e-9d30-7daada2407aa} <Module>{9a2a4c5d-1a96-464e-9d30-7daada2407aa}::m_39828e919bf94950a9f2a061e322f67a
ldfld System.Int32 <Module>{9a2a4c5d-1a96-464e-9d30-7daada2407aa}::m_37c24e9450c74386a53c9abe943a9f07
xor <null>
ldsfld rGVH2hUdxHOkgI1DGel rGVH2hUdxHOkgI1DGel::R19UbJ27qq
call System.String rGVH2hUdxHOkgI1DGel::i0gUIyhyLa(System.Int32,rGVH2hUdxHOkgI1DGel)
ldc.i4 -1732412442
ldc.i4 1144161997
add <null>
ldc.i4 -1446102493
xor <null>
ldsfld <Module>{9a2a4c5d-1a96-464e-9d30-7daada2407aa} <Module>{9a2a4c5d-1a96-464e-9d30-7daada2407aa}::m_39828e919bf94950a9f2a061e322f67a
ldfld System.Int32 <Module>{9a2a4c5d-1a96-464e-9d30-7daada2407aa}::m_607c7e8ec44a428281c1029ef64f4d50
xor <null>
ldsfld rGVH2hUdxHOkgI1DGel rGVH2hUdxHOkgI1DGel::R19UbJ27qq
call System.String rGVH2hUdxHOkgI1DGel::i0gUIyhyLa(System.Int32,rGVH2hUdxHOkgI1DGel)
newobj System.Void XbV61TFkLkdjlql21Z.kM5nt3aqM8wsxOrEBd::.ctor(System.String,System.String)
newobj System.Void L24OnVcBx6mWKZB0cgQ.AUn8llc5JFYVCYUcYyX::.ctor(XbV61TFkLkdjlql21Z.kM5nt3aqM8wsxOrEBd)
ldloc.s V_3
ldsfld E3iXIoUJl2s4eCQ3sLg E3iXIoUJl2s4eCQ3sLg::JNoUi9S8Ux
call System.Void E3iXIoUJl2s4eCQ3sLg::i0gUIyhyLa(System.Object,System.Byte[],E3iXIoUJl2s4eCQ3sLg)
ldc.i4 1
ldsfld <Module>{9a2a4c5d-1a96-464e-9d30-7daada2407aa} <Module>{9a2a4c5d-1a96-464e-9d30-7daada2407aa}::m_39828e919bf94950a9f2a061e322f67a
ldfld System.Int32 <Module>{9a2a4c5d-1a96-464e-9d30-7daada2407aa}::m_f2c2c5dfb388401994ea4b7a37dd40d2
brtrue IL_00A0: switch(IL_0141,IL_00C0)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_0141,IL_00C0)
leave IL_0061: ret
pop <null>
ldc.i4 4
ldsfld <Module>{9a2a4c5d-1a96-464e-9d30-7daada2407aa} <Module>{9a2a4c5d-1a96-464e-9d30-7daada2407aa}::m_39828e919bf94950a9f2a061e322f67a
ldfld System.Int32 <Module>{9a2a4c5d-1a96-464e-9d30-7daada2407aa}::m_1e405b259ab94c11973ad1118b6d549a
brfalse IL_0178: switch(IL_0194)
pop <null>
ldc.i4 0
br IL_0178: switch(IL_0194)
br IL_0174: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_0174: ldloc V_2
br IL_0194: leave IL_0061
leave IL_0061: ret
ldc.i4 2
ldsfld <Module>{9a2a4c5d-1a96-464e-9d30-7daada2407aa} <Module>{9a2a4c5d-1a96-464e-9d30-7daada2407aa}::m_39828e919bf94950a9f2a061e322f67a
ldfld System.Int32 <Module>{9a2a4c5d-1a96-464e-9d30-7daada2407aa}::m_5201aafdbc9e4889a949ce8fe29f7146
brfalse IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 6
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
Module Name
Gzlevy.exe
Full Name
Gzlevy.exe
EntryPoint
System.Void UfYEC5fDn6AcYuBYUk.zA9aZQUPvo88Zat31e::DZ6ZILK2x()
Scope Name
Gzlevy.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Gzlevy
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void UfYEC5fDn6AcYuBYUk.zA9aZQUPvo88Zat31e::DZ6ZILK2x()
Main IL Instruction Count
98
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_0062: nop
ldsfld bLg7K1UhsHh77qXeNtu bLg7K1UhsHh77qXeNtu::k6DUC9fA2N
call System.Void bLg7K1UhsHh77qXeNtu::i0gUIyhyLa(bLg7K1UhsHh77qXeNtu)
ldc.i4 1
ldsfld <Module>{9a2a4c5d-1a96-464e-9d30-7daada2407aa} <Module>{9a2a4c5d-1a96-464e-9d30-7daada2407aa}::m_39828e919bf94950a9f2a061e322f67a
ldfld System.Int32 <Module>{9a2a4c5d-1a96-464e-9d30-7daada2407aa}::m_72013d3c0d01492980969f3fd552f81f
brfalse IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
ret <null>
nop <null>
ldsfld sTue6OUqBhFUnVUZjmv sTue6OUqBhFUnVUZjmv::VdrUGqovEH
call System.Byte[] sTue6OUqBhFUnVUZjmv::i0gUIyhyLa(sTue6OUqBhFUnVUZjmv)
stloc.s V_3
ldc.i4 4
ldsfld <Module>{9a2a4c5d-1a96-464e-9d30-7daada2407aa} <Module>{9a2a4c5d-1a96-464e-9d30-7daada2407aa}::m_39828e919bf94950a9f2a061e322f67a
ldfld System.Int32 <Module>{9a2a4c5d-1a96-464e-9d30-7daada2407aa}::m_f1c8e7661d924ef9814df72efa334912
brtrue IL_00A0: switch(IL_0141,IL_00C0)
pop <null>
ldc.i4 1
br IL_00A0: switch(IL_0141,IL_00C0)
br IL_009C: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_009C: ldloc V_1
br IL_00C0: ldc.i4 -511124931
ldc.i4 -511124931
ldc.i4 2113712000
add <null>
ldc.i4 1313141427
xor <null>
ldsfld <Module>{9a2a4c5d-1a96-464e-9d30-7daada2407aa} <Module>{9a2a4c5d-1a96-464e-9d30-7daada2407aa}::m_39828e919bf94950a9f2a061e322f67a
ldfld System.Int32 <Module>{9a2a4c5d-1a96-464e-9d30-7daada2407aa}::m_37c24e9450c74386a53c9abe943a9f07
xor <null>
ldsfld rGVH2hUdxHOkgI1DGel rGVH2hUdxHOkgI1DGel::R19UbJ27qq
call System.String rGVH2hUdxHOkgI1DGel::i0gUIyhyLa(System.Int32,rGVH2hUdxHOkgI1DGel)
ldc.i4 -1732412442
ldc.i4 1144161997
add <null>
ldc.i4 -1446102493
xor <null>
ldsfld <Module>{9a2a4c5d-1a96-464e-9d30-7daada2407aa} <Module>{9a2a4c5d-1a96-464e-9d30-7daada2407aa}::m_39828e919bf94950a9f2a061e322f67a
ldfld System.Int32 <Module>{9a2a4c5d-1a96-464e-9d30-7daada2407aa}::m_607c7e8ec44a428281c1029ef64f4d50
xor <null>
ldsfld rGVH2hUdxHOkgI1DGel rGVH2hUdxHOkgI1DGel::R19UbJ27qq
call System.String rGVH2hUdxHOkgI1DGel::i0gUIyhyLa(System.Int32,rGVH2hUdxHOkgI1DGel)
newobj System.Void XbV61TFkLkdjlql21Z.kM5nt3aqM8wsxOrEBd::.ctor(System.String,System.String)
newobj System.Void L24OnVcBx6mWKZB0cgQ.AUn8llc5JFYVCYUcYyX::.ctor(XbV61TFkLkdjlql21Z.kM5nt3aqM8wsxOrEBd)
ldloc.s V_3
ldsfld E3iXIoUJl2s4eCQ3sLg E3iXIoUJl2s4eCQ3sLg::JNoUi9S8Ux
call System.Void E3iXIoUJl2s4eCQ3sLg::i0gUIyhyLa(System.Object,System.Byte[],E3iXIoUJl2s4eCQ3sLg)
ldc.i4 1
ldsfld <Module>{9a2a4c5d-1a96-464e-9d30-7daada2407aa} <Module>{9a2a4c5d-1a96-464e-9d30-7daada2407aa}::m_39828e919bf94950a9f2a061e322f67a
ldfld System.Int32 <Module>{9a2a4c5d-1a96-464e-9d30-7daada2407aa}::m_f2c2c5dfb388401994ea4b7a37dd40d2
brtrue IL_00A0: switch(IL_0141,IL_00C0)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_0141,IL_00C0)
leave IL_0061: ret
pop <null>
ldc.i4 4
ldsfld <Module>{9a2a4c5d-1a96-464e-9d30-7daada2407aa} <Module>{9a2a4c5d-1a96-464e-9d30-7daada2407aa}::m_39828e919bf94950a9f2a061e322f67a
ldfld System.Int32 <Module>{9a2a4c5d-1a96-464e-9d30-7daada2407aa}::m_1e405b259ab94c11973ad1118b6d549a
brfalse IL_0178: switch(IL_0194)
pop <null>
ldc.i4 0
br IL_0178: switch(IL_0194)
br IL_0174: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_0174: ldloc V_2
br IL_0194: leave IL_0061
leave IL_0061: ret
ldc.i4 2
ldsfld <Module>{9a2a4c5d-1a96-464e-9d30-7daada2407aa} <Module>{9a2a4c5d-1a96-464e-9d30-7daada2407aa}::m_39828e919bf94950a9f2a061e322f67a
ldfld System.Int32 <Module>{9a2a4c5d-1a96-464e-9d30-7daada2407aa}::m_5201aafdbc9e4889a949ce8fe29f7146
brfalse IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 6
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
1 malicious · 7 files
EXE2b6e59dedec39c9633d9d247d3c43d47
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙