Malicious
2f61cb4b14e0cf839a4a823eceea88e9
PE Executable
MD5: 2f61cb4b14e0cf839a4a823eceea88e9
Size: 37.89 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Size
37.89 KB · 37,888 B
First seen
2026-06-29 18:46 · 4 months ago
Last seen
2026-06-29 18:46 · 4 months ago
Last analysis
2026-06-30 19:00 · 3 months ago
Hashes
MD5
2f61cb4b14e0cf839a4a823eceea88e9
Sha1
5bc1696dec9c0d82be4ff8910a7ae7c217e9e40e
Sha256
1086e2ec8e9274e1639f14084f27d3b47e606c37ccc2a1e4976db6633ef797d5
Sha384
f8fc43fc4d92b343aae24d02256a20ef3f780714494e27bc3b85e57c8126a76ad064f0fa33ea6efc4875c332b59bea1c
Sha512
ec941f09701d4b590777637262a1ea78e816b5121fae483848ad16a8e88460a1399da700f024c81aa0bcf8eb6608d66505bba47047ec63adf0e99268002d1534
SSDeep
384:VaDvkit2Zf5W9cTYXyc/lPM20zHFmnPuskrAF+rMRTyN/0L+EcoinblneHQM3ep4:kDqjjTYic/lkEPuprM+rMRa8NuSRt
TLSH
CA032A4D7FE18168C5FD0A7B05B2D41207BAE04B6E23D90E8EF5649A37636C58F50AF2
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Low
1 malicious · 2 files
EXE2f61cb4b14e0cf839a4a823eceea88e9njRat
Structure
BINResources
BINRT_MANIFEST
BINID:0001
BINID:0
| Config. Field | Value |
|---|---|
| packet_size [b] | 5huhuhuhu |
| BD [BD] | Fhuhuhuhu |
| directory [DR] | Thuhuhuhu |
| executable_name [EXE] | serhuhuhuhu |
| cnc_host [HH] | 155.1huhuhuhuhuhuhu |
| is_dir_defined [Idr] | Fhuhuhuhu |
| is_startup_folder [IsF] | Fhuhuhuhu |
| is_user_reg [Isu] | Fhuhuhuhu |
| NH [NH] | 0huhuhuhu |
| cnc_port [P] | 2huhuhuhu |
| reg_key [RG] | 7f17b6huhuhuhuhuhuhuhuhuhuhu |
| reg_path [sf] | Softwahuhuhuhuhuhuhuhuhuhuhu |
| sizk | 2huhuhuhu |
| victim_name [VN] | Hahuhuhuhu |
| version [VR] | ihuhuhuhu |
| splitter [Y] | |huhuhuhu |
| HD | Fhuhuhuhu |
| anti [anti] | Exsahuhuhuhu |
| anti2 [anti2] | Fhuhuhuhu |
| usb [usb] | Fhuhuhuhu |
| usbx [usbx] | svchuhuhuhu |
| task [task] | Fhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| Module Name | w.exe |
| Full Name | w.exe |
| EntryPoint | System.Void w.A::main() |
| Scope Name | w.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v2.0.50727 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | w |
| Assembly Version | 0.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | <null> |
| Total Strings | 338 |
| Main Method | System.Void w.A::main() |
| Main IL Instruction Count | 5 |
| Main IL | |
| Module Name | w.exe |
| Full Name | w.exe |
| EntryPoint | System.Void w.A::main() |
| Scope Name | w.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v2.0.50727 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | w |
| Assembly Version | 0.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | <null> |
| Total Strings | 338 |
| Main Method | System.Void w.A::main() |
| Main IL Instruction Count | 5 |
| Main IL | |
Port
PORTmalicious
2huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential1 malicious · 2 files
EXE2f61cb4b14e0cf839a4a823eceea88e9njRat
Structure
BINResources
| Config. Field | Value |
|---|---|
| packet_size [b] | 5huhuhuhu |
| BD [BD] | Fhuhuhuhu |
| directory [DR] | Thuhuhuhu |
| executable_name [EXE] | serhuhuhuhu |
| cnc_host [HH] | 155.1huhuhuhuhuhuhu |
| is_dir_defined [Idr] | Fhuhuhuhu |
| is_startup_folder [IsF] | Fhuhuhuhu |
| is_user_reg [Isu] | Fhuhuhuhu |
| NH [NH] | 0huhuhuhu |
| cnc_port [P] | 2huhuhuhu |
| reg_key [RG] | 7f17b6huhuhuhuhuhuhuhuhuhuhu |
| reg_path [sf] | Softwahuhuhuhuhuhuhuhuhuhuhu |
| sizk | 2huhuhuhu |
| victim_name [VN] | Hahuhuhuhu |
| version [VR] | ihuhuhuhu |
| splitter [Y] | |huhuhuhu |
| HD | Fhuhuhuhu |
| anti [anti] | Exsahuhuhuhu |
| anti2 [anti2] | Fhuhuhuhu |
| usb [usb] | Fhuhuhuhu |
| usbx [usbx] | svchuhuhuhu |
| task [task] | Fhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialPort
PORTmalicious
2huhuhuhu
2f61cb4b14e0cf839a4a823eceea88e9
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account