Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
2.34 MB · 2,335,232 B
First seen
2026-10-14 02:00 · 11 days ago
Last seen
2026-10-14 02:00 · 11 days ago
Last analysis
2026-10-14 02:00 · 11 days ago
Hashes
MD5 35fa07119fcec6389bac83d4fb7f4cd8 Sha1 8c29c5240f485bbf9d6e6b9c3ccc1f63888e20d8 Sha256 c36ab8841d94861719e99c97d55a92c36d2a27c67e0d66a815dd31a50d2c538e Sha384 f04f9513821c333c9e7057d5f03df80fa8bbe88aaf1df5bfa8765d3688a4e1c80d7d693ea6f2efedf9e083a00cae26df Sha512 9fcb8171dab033f5edb7e414cba4bd64a4baecb7e5cb9c6abfa5bb8cd1055ce8f8bf448f0eb699ff5b20806e37a111e125700d183e6c737fabac9f0c656af524 SSDeep 24576:f2G/nvxW3Ww0toautb3DPlC9XxQpH9hl9AwLcIlDQ20NBtCxi4zyFoBkkAqmR3/j:fbA30o7t/9rhcwHp6RAWanq3/DiN TLSH F8B5BE017E44CE11F0191633C2EF4A0447B4AD51AAA6E72B7EFA37AD15223937D1DACB
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ 7.0 - 8.0Microsoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET
Symbol obfuscation
Very low
6 malicious · 104 files
EXE35fa07119fcec6389bac83d4fb7f4cd8
Structure
BINResources
BINRT_ICON
BINID:0002
IMGID:0
IMGID:0-preview.png
BINRT_GROUP_CURSOR4
BINID:7F00
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
VBS35fa07119fcec6389bac83d4fb7f4cd8.decoded.vbs
VBS35fa07119fcec6389bac83d4fb7f4cd8.decoded.vbs.deobfuscated.vbs
BIN.Net Resources
EXEExtractor.file_0.dat
Structure
RAROverlay_5f7b4f34.bin
BATG3Qfs1kOHl20hun6eQCKvPdReFy.bat
EXEwinbroker.exe
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
BIN.Net Resources
BINh3T8KwP0aqNmPDh8Nn.xNDNpqFr0LTTGOPf8o
BINIIBSjebJsVToxD36qu.kFibJTmxPJlIEXY6o5
VBSe1zmNuk6PgHvGo3oCCD0Yo1C0Wi.vbe
BINResources
BINPNG
BINID:0065
IMGID:1033
IMGID:1033-preview.png
BINID:0066
IMGID:1033
IMGID:1033-preview.png
BINRT_ICON
BINID:0001
BINID:1033
BINID:0002
BINID:1033
BINID:0003
BINID:1033
BINID:0004
BINID:1033
BINID:0005
BINID:1033
BINID:0006
BINID:1033
BINID:0007
IMGID:1033
IMGID:1033-preview.png
BINRT_DIALOG
BINID:0000
BINID:1033
BINRT_STRING
BINID:0007
BINID:1033
BINID:0008
BINID:1033
BINID:0009
BINID:1033
BINID:000A
BINID:1033
BINID:000B
BINID:1033
BINID:000C
BINID:1033
BINID:000D
BINID:1033
BINID:000E
BINID:1033
BINID:000F
BINID:1033
BINID:0010
BINID:1033
BINRT_GROUP_CURSOR4
BINID:0064
BINID:1033
BINRT_MANIFEST
BINID:0001
BINID:1033
EXEExtractor.file_1.dat
Structure
BIN.Net Resources
BINFunSkyCollector.g.resources
JSONFunSkyCollector.tools.json
JSONFunSkyCollector.signatures.json
TXTFunSkyCollector.strings.txt
TXTFunSkyCollector.zxc.txt
BINcostura.costura.dll.compressed
DLLcostura.costura.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.costura.pdb.compressed
PDBcostura.costura.pdb
BINcostura.microsoft.bcl.asyncinterfaces.dll.compressed
DLLcostura.microsoft.bcl.asyncinterfaces.dll
Structure
P7B[Authenticode]_75086844.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.system.buffers.dll.compressed
DLLcostura.system.buffers.dll
Structure
P7B[Authenticode]_8c38879e.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
BINFxResources.System.Buffers.SR.resources
BINcostura.system.diagnostics.diagnosticsource.dll.compressed
DLLcostura.system.diagnostics.diagnosticsource.dll
Structure
P7B[Authenticode]_50c89911.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.system.memory.dll.compressed
DLLcostura.system.memory.dll
Structure
P7B[Authenticode]_15ab3250.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
BINFxResources.System.Memory.SR.resources
BINcostura.system.numerics.vectors.dll.compressed
DLLcostura.system.numerics.vectors.dll
Structure
BIN.Net Resources
BINFxResources.System.Numerics.Vectors.SR.resources
P7B[Authenticode]_ae030d4d.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.system.runtime.compilerservices.unsafe.dll.compressed
DLLcostura.system.runtime.compilerservices.unsafe.dll
Structure
P7B[Authenticode]_81de04f4.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.system.text.encodings.web.dll.compressed
DLLcostura.system.text.encodings.web.dll
Structure
BIN.Net Resources
BINFxResources.System.Text.Encodings.Web.SR.resources
XMLILLink.Substitutions.xml
P7B[Authenticode]_06fd6b5d.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.system.text.json.dll.compressed
DLLcostura.system.text.json.dll
Structure
P7B[Authenticode]_b52de434.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
BINFxResources.System.Text.Json.SR.resources
XMLILLink.Substitutions.xml
BINcostura.system.threading.tasks.extensions.dll.compressed
DLLcostura.system.threading.tasks.extensions.dll
Structure
P7B[Authenticode]_7121b905.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.system.valuetuple.dll.compressed
DLLcostura.system.valuetuple.dll
Structure
BIN.Net Resources
BINFxResources.System.ValueTuple.SR.resources
P7B[Authenticode]_5e4e41f0.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.metadata
BINResources
BINRT_GROUP_CURSOR4
BINID:7F00
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
12 / 12
Path pe:exe>pe:exe>arc:rar>pe:exe>pe:rsrc>bin
Shape pe:exe>pe:exe>arc:rar>pe:exe>pe:rsrc>bin
malicious 6 nodes
Path pe:exe>pe:exe>pe:dll>pe:rsrc>bin
Shape pe:exe>pe:exe>pe:dll>pe:rsrc>bin
malicious 5 nodes
Name Value
Module Name
FunskyCollector.exe
Full Name
FunskyCollector.exe
EntryPoint
System.Void Extractor.Program::Main()
Scope Name
FunskyCollector.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
FunskyCollector
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
11
Main Method
System.Void Extractor.Program::Main()
Main IL Instruction Count
147
Main IL 
nop <null>
nop <null>
call System.String System.IO.Path::GetTempPath()
ldstr bnd_
call System.Guid System.Guid::NewGuid()
stloc.s V_5
ldloca.s V_5
ldstr N
call System.String System.Guid::ToString(System.String)
ldc.i4.0 <null>
ldc.i4.8 <null>
callvirt System.String System.String::Substring(System.Int32,System.Int32)
call System.String System.String::Concat(System.String,System.String)
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.0 <null>
ldloc.0 <null>
call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String)
pop <null>
ldstr file_0.dat
ldloc.0 <null>
ldstr DCRatBuild.exe
call System.String System.IO.Path::Combine(System.String,System.String)
call System.Void Extractor.Program::ExtractFile(System.String,System.String)
nop <null>
ldstr file_1.dat
ldloc.0 <null>
ldstr FunSkyCollector.exe
call System.String System.IO.Path::Combine(System.String,System.String)
call System.Void Extractor.Program::ExtractFile(System.String,System.String)
nop <null>
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
ldloc.0 <null>
ldstr DCRatBuild.exe
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.1 <null>
ldloc.1 <null>
call System.Boolean System.IO.File::Exists(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.s V_6
ldloc.s V_6
brtrue.s IL_00DF: ldloc.0
nop <null>
nop <null>
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
stloc.2 <null>
ldloc.2 <null>
ldloc.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
nop <null>
ldloc.2 <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
nop <null>
ldloc.2 <null>
ldloc.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WorkingDirectory(System.String)
nop <null>
ldloc.2 <null>
ldstr runas
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String)
nop <null>
ldloc.2 <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
nop <null>
ldloc.2 <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
nop <null>
ldloc.2 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
ldc.i4.s 100
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
nop <null>
leave.s IL_00DD: nop
pop <null>
nop <null>
nop <null>
leave.s IL_00DD: nop
nop <null>
nop <null>
ldloc.0 <null>
ldstr FunSkyCollector.exe
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.3 <null>
ldloc.3 <null>
call System.Boolean System.IO.File::Exists(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.s V_6
ldloc.s V_6
brtrue.s IL_0157: nop
nop <null>
nop <null>
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
stloc.s V_4
ldloc.s V_4
ldloc.3 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
nop <null>
ldloc.s V_4
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
nop <null>
ldloc.s V_4
ldloc.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WorkingDirectory(System.String)
nop <null>
ldloc.s V_4
ldstr runas
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String)
nop <null>
ldloc.s V_4
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
nop <null>
ldloc.s V_4
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
nop <null>
ldloc.s V_4
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
ldc.i4.s 100
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
nop <null>
leave.s IL_0155: nop
pop <null>
nop <null>
nop <null>
leave.s IL_0155: nop
nop <null>
nop <null>
nop <null>
leave.s IL_015F: nop
pop <null>
nop <null>
nop <null>
leave.s IL_015F: nop
nop <null>
ret <null>
Module Name
FunskyCollector.exe
Full Name
FunskyCollector.exe
EntryPoint
System.Void Extractor.Program::Main()
Scope Name
FunskyCollector.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
FunskyCollector
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
11
Main Method
System.Void Extractor.Program::Main()
Main IL Instruction Count
147
Main IL 
nop <null>
nop <null>
call System.String System.IO.Path::GetTempPath()
ldstr bnd_
call System.Guid System.Guid::NewGuid()
stloc.s V_5
ldloca.s V_5
ldstr N
call System.String System.Guid::ToString(System.String)
ldc.i4.0 <null>
ldc.i4.8 <null>
callvirt System.String System.String::Substring(System.Int32,System.Int32)
call System.String System.String::Concat(System.String,System.String)
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.0 <null>
ldloc.0 <null>
call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String)
pop <null>
ldstr file_0.dat
ldloc.0 <null>
ldstr DCRatBuild.exe
call System.String System.IO.Path::Combine(System.String,System.String)
call System.Void Extractor.Program::ExtractFile(System.String,System.String)
nop <null>
ldstr file_1.dat
ldloc.0 <null>
ldstr FunSkyCollector.exe
call System.String System.IO.Path::Combine(System.String,System.String)
call System.Void Extractor.Program::ExtractFile(System.String,System.String)
nop <null>
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
ldloc.0 <null>
ldstr DCRatBuild.exe
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.1 <null>
ldloc.1 <null>
call System.Boolean System.IO.File::Exists(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.s V_6
ldloc.s V_6
brtrue.s IL_00DF: ldloc.0
nop <null>
nop <null>
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
stloc.2 <null>
ldloc.2 <null>
ldloc.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
nop <null>
ldloc.2 <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
nop <null>
ldloc.2 <null>
ldloc.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WorkingDirectory(System.String)
nop <null>
ldloc.2 <null>
ldstr runas
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String)
nop <null>
ldloc.2 <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
nop <null>
ldloc.2 <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
nop <null>
ldloc.2 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
ldc.i4.s 100
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
nop <null>
leave.s IL_00DD: nop
pop <null>
nop <null>
nop <null>
leave.s IL_00DD: nop
nop <null>
nop <null>
ldloc.0 <null>
ldstr FunSkyCollector.exe
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.3 <null>
ldloc.3 <null>
call System.Boolean System.IO.File::Exists(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.s V_6
ldloc.s V_6
brtrue.s IL_0157: nop
nop <null>
nop <null>
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
stloc.s V_4
ldloc.s V_4
ldloc.3 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
nop <null>
ldloc.s V_4
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
nop <null>
ldloc.s V_4
ldloc.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WorkingDirectory(System.String)
nop <null>
ldloc.s V_4
ldstr runas
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String)
nop <null>
ldloc.s V_4
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
nop <null>
ldloc.s V_4
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
nop <null>
ldloc.s V_4
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
ldc.i4.s 100
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
nop <null>
leave.s IL_0155: nop
pop <null>
nop <null>
nop <null>
leave.s IL_0155: nop
nop <null>
nop <null>
nop <null>
leave.s IL_015F: nop
pop <null>
nop <null>
nop <null>
leave.s IL_015F: nop
nop <null>
ret <null>
Command (COM trace) #1 UNKNWOWNmalicious
C:/Porhuhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
6 malicious · 104 files
EXE35fa07119fcec6389bac83d4fb7f4cd8
Structure
VBS35fa07119fcec6389bac83d4fb7f4cd8.decoded.vbs
VBS35fa07119fcec6389bac83d4fb7f4cd8.decoded.vbs.deobfuscated.vbs
BIN.Net Resources
EXEExtractor.file_0.dat
Structure
RAROverlay_5f7b4f34.bin
BATG3Qfs1kOHl20hun6eQCKvPdReFy.bat
EXEwinbroker.exe
Structure
VBSe1zmNuk6PgHvGo3oCCD0Yo1C0Wi.vbe
No malware configuration was found at this point.
Command (COM trace) #1 UNKNWOWNmalicious
C:/Porhuhuhuhuhuhuhuhuhuhuhu
35fa07119fcec6389bac83d4fb7f4cd8 › 35fa07119fcec6389bac83d4fb7f4cd8.decoded.vbs
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
35fa07119fcec6389bac83d4fb7f4cd8 › 35fa07119fcec6389bac83d4fb7f4cd8.decoded.vbs
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙