Malicious
Malicious

3ba1d62b27d60491904422bbec123493

PE Executable
MD5: 3ba1d62b27d60491904422bbec123493
Size: 49.66 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 3ba1d62b27d60491904422bbec123493
Sha1 b709e74cbe335b95a06782441bcdc7755ef98c17
Sha256 fd50b29196735ec9680a0f9c8b1c6c49e9bfaf6a98614705751620852ab75d8d
Sha384 d94efbd050aeafa1866ad1e98e469184a2db60d59acaf32705435661ba65d8645fcfebe6ce8799975e7d25d19f623c4c
Sha512 8f69d9dc50fbd38e56f8ef0d12e50715ec5a37543689c9a00ed4667f8ee5b43c0ee9f8267d0c30757e108375ebd94fb7557188ac7be09959274336da7c259f4c
SSDeep 768:eqdpXbXX0fIiNBUFs0ICNQ+0bja58fgvx+3ljWLb6qHK8gZCMnYI6OC12tYcFmVY:etIY1ENQxbja5omTb5er6OYKmVcl
TLSH A9233D003BE98126E2FE4FB89DF1214686BBF5273502D65E3CC841D65B137C6CA52AF6
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
3ba1d62b27d60491904422bbec123493
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Config. Field Value
Key (AES_256) eVlKUXhuhuhuhuhuhuhuhuhuhuhu
Pastebin -huhuhuhu
Certificate MIIE8jhuhuhuhuhuhuhuhuhuhuhu
ServerSignature DidAJqhuhuhuhuhuhuhuhuhuhuhu
Install thuhuhuhu
BDOS fhuhuhuhu
Anti-VM fhuhuhuhu
Install File svchuhuhuhu
Install-Folder %Aphuhuhuhu
Version 0.huhuhuhu
Hosts r2bhuhuhuhu
Ports 4huhuhuhu
Mutex mkhuhuhuhu
Delay 5huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
tfZbKMzYlSuBUp
Full Name
tfZbKMzYlSuBUp
EntryPoint
System.Void WIgTGtleflkg.xcCXmfJxLJZI::Main()
Scope Name
tfZbKMzYlSuBUp
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Stub
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
130
Main Method
System.Void WIgTGtleflkg.xcCXmfJxLJZI::Main()
Main IL Instruction Count
53
Main IL 
ldc.i4.0 <null>
stloc.0 <null>
br.s IL_0012: ldloc.0
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
ldc.i4.1 <null>
add <null>
stloc.0 <null>
ldloc.0 <null>
ldsfld System.String WIgTGtleflkg.bXTFYqeUmBX::cpkxaPzxwInEyh
call System.Int32 System.Convert::ToInt32(System.String)
blt.s IL_0004: ldc.i4 1000
call System.Boolean WIgTGtleflkg.bXTFYqeUmBX::uYaCRQTXfsMPn()
brtrue.s IL_002C: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Boolean kakDoRcGIhz.zrMplhlawPHR::UUFjUvlCkcT()
brtrue.s IL_003A: ldsfld System.String WIgTGtleflkg.bXTFYqeUmBX::SwtuxpThpsUL
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String WIgTGtleflkg.bXTFYqeUmBX::SwtuxpThpsUL
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_004B: ldsfld System.String WIgTGtleflkg.bXTFYqeUmBX::PsGwgPRJlwgFX
call System.Void kakDoRcGIhz.LoNHUIteJhUoGlda::zGHRNehurIGCP()
ldsfld System.String WIgTGtleflkg.bXTFYqeUmBX::PsGwgPRJlwgFX
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_005C: ldsfld System.String WIgTGtleflkg.bXTFYqeUmBX::xjjOrOtgVJBThd
call System.Void LUoDPjHSFoIh.ObxmjFLTxGMwSEc::rTyoaSGjUCxxeX()
ldsfld System.String WIgTGtleflkg.bXTFYqeUmBX::xjjOrOtgVJBThd
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_0074: call System.Void kakDoRcGIhz.cZpJFcILYecpr::cgsspFXRbsyG()
call System.Boolean kakDoRcGIhz.cZpJFcILYecpr::TzuMwJRjyu()
brfalse.s IL_0074: call System.Void kakDoRcGIhz.cZpJFcILYecpr::cgsspFXRbsyG()
call System.Void kakDoRcGIhz.iUfhNHBlKeBhzd::XQbvwMyzjWbDgtV()
call System.Void kakDoRcGIhz.cZpJFcILYecpr::cgsspFXRbsyG()
newobj System.Void kakDoRcGIhz.zTonZyNwLU::.ctor()
call System.String kakDoRcGIhz.zTonZyNwLU::nTuVwstCbUbwI()
pop <null>
leave.s IL_0089: call System.Boolean LZMpkjWKmTOqj.TPOZulVLRadC::get_IsConnected()
pop <null>
leave.s IL_0089: call System.Boolean LZMpkjWKmTOqj.TPOZulVLRadC::get_IsConnected()
call System.Boolean LZMpkjWKmTOqj.TPOZulVLRadC::get_IsConnected()
brtrue.s IL_009A: newobj System.Void System.Random::.ctor()
call System.Void LZMpkjWKmTOqj.TPOZulVLRadC::WFIxMELSfDVug()
call System.Void LZMpkjWKmTOqj.TPOZulVLRadC::rRAMUYHBSPmZye()
newobj System.Void System.Random::.ctor()
ldc.i4 1000
ldc.i4 5000
callvirt System.Int32 System.Random::Next(System.Int32,System.Int32)
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_0089: call System.Boolean LZMpkjWKmTOqj.TPOZulVLRadC::get_IsConnected()
Module Name
tfZbKMzYlSuBUp
Full Name
tfZbKMzYlSuBUp
EntryPoint
System.Void WIgTGtleflkg.xcCXmfJxLJZI::Main()
Scope Name
tfZbKMzYlSuBUp
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Stub
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
130
Main Method
System.Void WIgTGtleflkg.xcCXmfJxLJZI::Main()
Main IL Instruction Count
53
Main IL 
ldc.i4.0 <null>
stloc.0 <null>
br.s IL_0012: ldloc.0
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
ldc.i4.1 <null>
add <null>
stloc.0 <null>
ldloc.0 <null>
ldsfld System.String WIgTGtleflkg.bXTFYqeUmBX::cpkxaPzxwInEyh
call System.Int32 System.Convert::ToInt32(System.String)
blt.s IL_0004: ldc.i4 1000
call System.Boolean WIgTGtleflkg.bXTFYqeUmBX::uYaCRQTXfsMPn()
brtrue.s IL_002C: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Boolean kakDoRcGIhz.zrMplhlawPHR::UUFjUvlCkcT()
brtrue.s IL_003A: ldsfld System.String WIgTGtleflkg.bXTFYqeUmBX::SwtuxpThpsUL
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String WIgTGtleflkg.bXTFYqeUmBX::SwtuxpThpsUL
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_004B: ldsfld System.String WIgTGtleflkg.bXTFYqeUmBX::PsGwgPRJlwgFX
call System.Void kakDoRcGIhz.LoNHUIteJhUoGlda::zGHRNehurIGCP()
ldsfld System.String WIgTGtleflkg.bXTFYqeUmBX::PsGwgPRJlwgFX
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_005C: ldsfld System.String WIgTGtleflkg.bXTFYqeUmBX::xjjOrOtgVJBThd
call System.Void LUoDPjHSFoIh.ObxmjFLTxGMwSEc::rTyoaSGjUCxxeX()
ldsfld System.String WIgTGtleflkg.bXTFYqeUmBX::xjjOrOtgVJBThd
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_0074: call System.Void kakDoRcGIhz.cZpJFcILYecpr::cgsspFXRbsyG()
call System.Boolean kakDoRcGIhz.cZpJFcILYecpr::TzuMwJRjyu()
brfalse.s IL_0074: call System.Void kakDoRcGIhz.cZpJFcILYecpr::cgsspFXRbsyG()
call System.Void kakDoRcGIhz.iUfhNHBlKeBhzd::XQbvwMyzjWbDgtV()
call System.Void kakDoRcGIhz.cZpJFcILYecpr::cgsspFXRbsyG()
newobj System.Void kakDoRcGIhz.zTonZyNwLU::.ctor()
call System.String kakDoRcGIhz.zTonZyNwLU::nTuVwstCbUbwI()
pop <null>
leave.s IL_0089: call System.Boolean LZMpkjWKmTOqj.TPOZulVLRadC::get_IsConnected()
pop <null>
leave.s IL_0089: call System.Boolean LZMpkjWKmTOqj.TPOZulVLRadC::get_IsConnected()
call System.Boolean LZMpkjWKmTOqj.TPOZulVLRadC::get_IsConnected()
brtrue.s IL_009A: newobj System.Void System.Random::.ctor()
call System.Void LZMpkjWKmTOqj.TPOZulVLRadC::WFIxMELSfDVug()
call System.Void LZMpkjWKmTOqj.TPOZulVLRadC::rRAMUYHBSPmZye()
newobj System.Void System.Random::.ctor()
ldc.i4 1000
ldc.i4 5000
callvirt System.Int32 System.Random::Next(System.Int32,System.Int32)
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_0089: call System.Boolean LZMpkjWKmTOqj.TPOZulVLRadC::get_IsConnected()
Key (AES_256) MUTEXmalicious
eVlKUXhuhuhuhuhuhuhuhuhuhuhu
CnC CNCmalicious
r2bhuhuhuhu
Ports PORTmalicious
4huhuhuhu
Mutex MUTEXmalicious
mkhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
3ba1d62b27d60491904422bbec123493
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Config. Field Value
Key (AES_256) eVlKUXhuhuhuhuhuhuhuhuhuhuhu
Pastebin -huhuhuhu
Certificate MIIE8jhuhuhuhuhuhuhuhuhuhuhu
ServerSignature DidAJqhuhuhuhuhuhuhuhuhuhuhu
Install thuhuhuhu
BDOS fhuhuhuhu
Anti-VM fhuhuhuhu
Install File svchuhuhuhu
Install-Folder %Aphuhuhuhu
Version 0.huhuhuhu
Hosts r2bhuhuhuhu
Ports 4huhuhuhu
Mutex mkhuhuhuhu
Delay 5huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Key (AES_256) MUTEXmalicious
eVlKUXhuhuhuhuhuhuhuhuhuhuhu
3ba1d62b27d60491904422bbec123493
CnC CNCmalicious
r2bhuhuhuhu
3ba1d62b27d60491904422bbec123493
Ports PORTmalicious
4huhuhuhu
3ba1d62b27d60491904422bbec123493
Mutex MUTEXmalicious
mkhuhuhuhu
3ba1d62b27d60491904422bbec123493
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙