Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5: 2fd4159228215be82a2e12dc2a21a4f7
Size: 44.03 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 2fd4159228215be82a2e12dc2a21a4f7
Sha1 e913ffb00fe22a1e2dfe650f5862edea89dc8479
Sha256 6d1aa6768394decd5f24bcabbc3ab3bf08f140fad1e11100240b471cc2a5aaf8
Sha384 fa667139ca58aa8921d0a0d82de9d61e47ae8355f3d9484bf29a12836d3b8b9771c0faa2452cd6cacc6dcb9c9de1666a
Sha512 7eaf1f07e2acad09f9a4478d1f4dff359d7a88805b36c009ab61326dccf9f0070c35aaa7d8f0d8614540c80f4c29301e4faae29b094cf4593cc1813e5e98ad65
SSDeep 384:TZyYO5clQ5GoyypblTI76M2EXnHrzIIij+ZsNO3PlpJKkkjh/TzF7pWnLYgreT0k:dhmolypbFILxNuXQ/ouM+L
TLSH E513E84CB794E174D5FF8BF1B4A2B2890B71A01BA802930F99F154D94B73EC09A11EE7
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
2fd4159228215be82a2e12dc2a21a4f7
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Stub.Resources.resources
Config. Field Value
packet_size [b] 5huhuhuhu
BD [BD] Thuhuhuhu
directory [DR] Usehuhuhuhu
executable_name [EXE] Dllhuhuhuhu
cnc_host [H] 126.huhuhuhuhuhuhu
icn #huhuhuhu
is_dir_defined [Idr] Thuhuhuhu
is_startup_folder [IsF] Thuhuhuhu
RegistrySt Thuhuhuhu
xDlol1 googlhuhuhuhuhuhuhu
Sleep Fhuhuhuhu
Sleep1 1huhuhuhu
reg_key [RG] explhuhuhuhu
task [Task] Thuhuhuhu
reg_path [sf] Softwahuhuhuhuhuhuhuhuhuhuhu
Hide Thuhuhuhu
HP Thuhuhuhu
SPR fhuhuhuhu
victim_name [VN] Hahuhuhuhu
version [VR] Njrat huhuhuhuhuhuhuhuhuhuhu
splitter [Y] |Hhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Stub.exe
Full Name
Stub.exe
EntryPoint
System.Void Stub.OK.j.A::main()
Scope Name
Stub.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Stub
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
436
Main Method
System.Void Stub.OK.j.A::main()
Main IL Instruction Count
20
Main IL 
ldc.i4.1 <null>
stsfld System.Boolean Stub.OK.j.A::runx
ldnull <null>
ldftn System.Void Stub.OK.j.A::timx_run()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stsfld System.Threading.Thread Stub.OK.j.A::thx
ldsfld System.Threading.Thread Stub.OK.j.A::thx
callvirt System.Void System.Threading.Thread::Start()
ldc.i4.1 <null>
stsfld System.Boolean Stub.OK.j.A::runy
ldnull <null>
ldftn System.Void Stub.OK.j.A::timy_run()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stsfld System.Threading.Thread Stub.OK.j.A::thy
ldsfld System.Threading.Thread Stub.OK.j.A::thy
callvirt System.Void System.Threading.Thread::Start()
call System.Void Stub.OK.j.OK::ko()
ret <null>
Module Name
Stub.exe
Full Name
Stub.exe
EntryPoint
System.Void Stub.OK.j.A::main()
Scope Name
Stub.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Stub
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
436
Main Method
System.Void Stub.OK.j.A::main()
Main IL Instruction Count
20
Main IL 
ldc.i4.1 <null>
stsfld System.Boolean Stub.OK.j.A::runx
ldnull <null>
ldftn System.Void Stub.OK.j.A::timx_run()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stsfld System.Threading.Thread Stub.OK.j.A::thx
ldsfld System.Threading.Thread Stub.OK.j.A::thx
callvirt System.Void System.Threading.Thread::Start()
ldc.i4.1 <null>
stsfld System.Boolean Stub.OK.j.A::runy
ldnull <null>
ldftn System.Void Stub.OK.j.A::timy_run()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stsfld System.Threading.Thread Stub.OK.j.A::thy
ldsfld System.Threading.Thread Stub.OK.j.A::thy
callvirt System.Void System.Threading.Thread::Start()
call System.Void Stub.OK.j.OK::ko()
ret <null>
CnC CNCmalicious
126.huhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙