Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
File Type
Portable Executable file
Size
2.34 MB · 2,335,232 B
First seen
2026-10-14 02:00 · 11 days ago
Last seen
2026-10-14 02:00 · 11 days ago
Last analysis
2026-10-14 02:00 · 11 days ago
Hashes MD5
35fa07119fcec6389bac83d4fb7f4cd8
Sha1
8c29c5240f485bbf9d6e6b9c3ccc1f63888e20d8
Sha256
c36ab8841d94861719e99c97d55a92c36d2a27c67e0d66a815dd31a50d2c538e
Sha384
f04f9513821c333c9e7057d5f03df80fa8bbe88aaf1df5bfa8765d3688a4e1c80d7d693ea6f2efedf9e083a00cae26df
Sha512
9fcb8171dab033f5edb7e414cba4bd64a4baecb7e5cb9c6abfa5bb8cd1055ce8f8bf448f0eb699ff5b20806e37a111e125700d183e6c737fabac9f0c656af524
SSDeep
24576:f2G/nvxW3Ww0toautb3DPlC9XxQpH9hl9AwLcIlDQ20NBtCxi4zyFoBkkAqmR3/j:fbA30o7t/9rhcwHp6RAWanq3/DiN
TLSH
F8B5BE017E44CE11F0191633C2EF4A0447B4AD51AAA6E72B7EFA37AD15223937D1DACB
Detection PeID
.NET executable Microsoft Visual C# / Basic .NET Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NET Microsoft Visual C++ 6.0 DLL (Debug) Microsoft Visual C++ 7.0 - 8.0 Microsoft Visual C++ v6.0 DLL Microsoft Visual Studio .NET
Symbol obfuscation
Very low
6 malicious · 104 files
Malicious chain only
Expand all
EXE 35fa07119fcec6389bac83d4fb7f4cd8 PE32 x86 T1027 · T1059 · T1059.005 Structure
DosHeader PE Header Optional Header (x86) .text .rsrc .reloc VBS 35fa07119fcec6389bac83d4fb7f4cd8.decoded.vbs VBScript T1027 · T1059 · T1059.005 VBS 35fa07119fcec6389bac83d4fb7f4cd8.decoded.vbs.deobfuscated.vbs deobfuscated · VBScript T1059.005 EXE Extractor.file_0.dat sub-stream · PE32 x86 Structure
DosHeader PE Header Optional Header (x86) .text .rdata .data .didat .rsrc .reloc RAR Overlay_5f7b4f34.bin overlay · Rar Archive BAT G3Qfs1kOHl20hun6eQCKvPdReFy.bat extracted from Rar Archive EXE winbroker.exe extracted from Rar Archive · PE32 x86 Structure
DosHeader PE Header Optional Header (x86) .text .sdata .rsrc .reloc VBS e1zmNuk6PgHvGo3oCCD0Yo1C0Wi.vbe extracted from Rar Archive · VBScript Encoded EXE Extractor.file_1.dat sub-stream · PE32+ x64 STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and
MITRE techniques from the initial file to each final payload.
STICH Path & Shape 12 STICH Path = the fingerprint (canonical chain with techniques)STICH Shape = structure onlyOnly determinant branches produce STICH Paths.
12 / 12
Path
pe:exe>pe:exe>arc:rar>pe:exe>pe:rsrc>bin
Shape
pe:exe>pe:exe>arc:rar>pe:exe>pe:rsrc>bin
6 nodes
Path
pe:exe>pe:exe>pe:dll>pe:rsrc>bin
Shape
pe:exe>pe:exe>pe:dll>pe:rsrc>bin
5 nodes
Name
Value Module Name
Full Name
EntryPoint
System.Void Extractor.Program::Main()
Scope Name
Scope Type
Kind
Runtime Version
Tables Header Version
WinMD Version
Assembly Name
Assembly Version
Assembly Culture
Has PublicKey
PublicKey Token
Target Framework
Total Strings
Main Method
System.Void Extractor.Program::Main()
Main IL Instruction Count
Main IL
nop <null>
nop <null>
call System.String System.IO.Path::GetTempPath()
ldstr bnd_
call System.Guid System.Guid::NewGuid()
stloc.s V_5
ldloca.s V_5
ldstr N
call System.String System.Guid::ToString(System.String)
ldc.i4.0 <null>
ldc.i4.8 <null>
callvirt System.String System.String::Substring(System.Int32,System.Int32)
call System.String System.String::Concat(System.String,System.String)
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.0 <null>
ldloc.0 <null>
call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String)
pop <null>
ldstr file_0.dat
ldloc.0 <null>
ldstr DCRatBuild.exe
call System.String System.IO.Path::Combine(System.String,System.String)
call System.Void Extractor.Program::ExtractFile(System.String,System.String)
nop <null>
ldstr file_1.dat
ldloc.0 <null>
ldstr FunSkyCollector.exe
call System.String System.IO.Path::Combine(System.String,System.String)
call System.Void Extractor.Program::ExtractFile(System.String,System.String)
nop <null>
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
ldloc.0 <null>
ldstr DCRatBuild.exe
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.1 <null>
ldloc.1 <null>
call System.Boolean System.IO.File::Exists(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.s V_6
ldloc.s V_6
brtrue.s IL_00DF: ldloc.0
nop <null>
nop <null>
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
stloc.2 <null>
ldloc.2 <null>
ldloc.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
nop <null>
ldloc.2 <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
nop <null>
ldloc.2 <null>
ldloc.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WorkingDirectory(System.String)
nop <null>
ldloc.2 <null>
ldstr runas
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String)
nop <null>
ldloc.2 <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
nop <null>
ldloc.2 <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
nop <null>
ldloc.2 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
ldc.i4.s 100
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
nop <null>
leave.s IL_00DD: nop
pop <null>
nop <null>
nop <null>
leave.s IL_00DD: nop
nop <null>
nop <null>
ldloc.0 <null>
ldstr FunSkyCollector.exe
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.3 <null>
ldloc.3 <null>
call System.Boolean System.IO.File::Exists(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.s V_6
ldloc.s V_6
brtrue.s IL_0157: nop
nop <null>
nop <null>
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
stloc.s V_4
ldloc.s V_4
ldloc.3 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
nop <null>
ldloc.s V_4
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
nop <null>
ldloc.s V_4
ldloc.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WorkingDirectory(System.String)
nop <null>
ldloc.s V_4
ldstr runas
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String)
nop <null>
ldloc.s V_4
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
nop <null>
ldloc.s V_4
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
nop <null>
ldloc.s V_4
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
ldc.i4.s 100
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
nop <null>
leave.s IL_0155: nop
pop <null>
nop <null>
nop <null>
leave.s IL_0155: nop
nop <null>
nop <null>
nop <null>
leave.s IL_015F: nop
pop <null>
nop <null>
nop <null>
leave.s IL_015F: nop
nop <null>
ret <null>Module Name
Full Name
EntryPoint
System.Void Extractor.Program::Main()
Scope Name
Scope Type
Kind
Runtime Version
Tables Header Version
WinMD Version
Assembly Name
Assembly Version
Assembly Culture
Has PublicKey
PublicKey Token
Target Framework
Total Strings
Main Method
System.Void Extractor.Program::Main()
Main IL Instruction Count
Main IL
nop <null>
nop <null>
call System.String System.IO.Path::GetTempPath()
ldstr bnd_
call System.Guid System.Guid::NewGuid()
stloc.s V_5
ldloca.s V_5
ldstr N
call System.String System.Guid::ToString(System.String)
ldc.i4.0 <null>
ldc.i4.8 <null>
callvirt System.String System.String::Substring(System.Int32,System.Int32)
call System.String System.String::Concat(System.String,System.String)
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.0 <null>
ldloc.0 <null>
call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String)
pop <null>
ldstr file_0.dat
ldloc.0 <null>
ldstr DCRatBuild.exe
call System.String System.IO.Path::Combine(System.String,System.String)
call System.Void Extractor.Program::ExtractFile(System.String,System.String)
nop <null>
ldstr file_1.dat
ldloc.0 <null>
ldstr FunSkyCollector.exe
call System.String System.IO.Path::Combine(System.String,System.String)
call System.Void Extractor.Program::ExtractFile(System.String,System.String)
nop <null>
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
ldloc.0 <null>
ldstr DCRatBuild.exe
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.1 <null>
ldloc.1 <null>
call System.Boolean System.IO.File::Exists(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.s V_6
ldloc.s V_6
brtrue.s IL_00DF: ldloc.0
nop <null>
nop <null>
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
stloc.2 <null>
ldloc.2 <null>
ldloc.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
nop <null>
ldloc.2 <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
nop <null>
ldloc.2 <null>
ldloc.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WorkingDirectory(System.String)
nop <null>
ldloc.2 <null>
ldstr runas
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String)
nop <null>
ldloc.2 <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
nop <null>
ldloc.2 <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
nop <null>
ldloc.2 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
ldc.i4.s 100
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
nop <null>
leave.s IL_00DD: nop
pop <null>
nop <null>
nop <null>
leave.s IL_00DD: nop
nop <null>
nop <null>
ldloc.0 <null>
ldstr FunSkyCollector.exe
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.3 <null>
ldloc.3 <null>
call System.Boolean System.IO.File::Exists(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.s V_6
ldloc.s V_6
brtrue.s IL_0157: nop
nop <null>
nop <null>
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
stloc.s V_4
ldloc.s V_4
ldloc.3 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
nop <null>
ldloc.s V_4
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
nop <null>
ldloc.s V_4
ldloc.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WorkingDirectory(System.String)
nop <null>
ldloc.s V_4
ldstr runas
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String)
nop <null>
ldloc.s V_4
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
nop <null>
ldloc.s V_4
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
nop <null>
ldloc.s V_4
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
ldc.i4.s 100
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
nop <null>
leave.s IL_0155: nop
pop <null>
nop <null>
nop <null>
leave.s IL_0155: nop
nop <null>
nop <null>
nop <null>
leave.s IL_015F: nop
pop <null>
nop <null>
nop <null>
leave.s IL_015F: nop
nop <null>
ret <null>
Command (COM trace) #1
UNKNWOWN malicious
C:/Por huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWN malicious
line 1 huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
6 malicious · 104 files
Malicious chain only
Expand all
EXE 35fa07119fcec6389bac83d4fb7f4cd8 PE32 x86 T1027 · T1059 · T1059.005 Structure
DosHeader PE Header Optional Header (x86) .text .rsrc .reloc VBS 35fa07119fcec6389bac83d4fb7f4cd8.decoded.vbs VBScript T1027 · T1059 · T1059.005 VBS 35fa07119fcec6389bac83d4fb7f4cd8.decoded.vbs.deobfuscated.vbs deobfuscated · VBScript T1059.005 EXE Extractor.file_0.dat sub-stream · PE32 x86 Structure
DosHeader PE Header Optional Header (x86) .text .rdata .data .didat .rsrc .reloc RAR Overlay_5f7b4f34.bin overlay · Rar Archive BAT G3Qfs1kOHl20hun6eQCKvPdReFy.bat extracted from Rar Archive EXE winbroker.exe extracted from Rar Archive · PE32 x86 Structure
DosHeader PE Header Optional Header (x86) .text .sdata .rsrc .reloc VBS e1zmNuk6PgHvGo3oCCD0Yo1C0Wi.vbe extracted from Rar Archive · VBScript Encoded EXE Extractor.file_1.dat sub-stream · PE32+ x64
No malware configuration was found at this point.
Command (COM trace) #1
UNKNWOWN malicious
C:/Por huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWN malicious
line 1 huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Coming soon: export of this report's indicators to MISP and EDR platforms.
