Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5: 3c3f3afaec1d4885f5521c8944d32fe0
Size: 68.1 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Size
68.1 KB · 68,096 B
First seen
2026-04-21 14:32 · 6 months ago
Last seen
2026-04-21 14:32 · 6 months ago
Last analysis
2026-04-22 05:24 · 6 months ago
Hashes
MD5 3c3f3afaec1d4885f5521c8944d32fe0 Sha1 70baa749af79b7fed486c4a753e535a830e1edd9 Sha256 1ca676cf77bf3d8d1f69b16016a3f722d501072c5d4111ddd8e0c96dc6a23608 Sha384 492af42757b3f1b827d4aff9463416c38c5aa2f9f13016e0b3861235af437d23114322c2cfef36bb0e1abd63418ba88e Sha512 596571747331b1f1dc3799f6666085e40f72d5504691431aa7fb650359ec23fd245d727e5763572b4985f5efd5c54a2dd94d06a244e53708050c3bbecf655d0a SSDeep 1536:LnRDMYMGN3PA4F74kYld+l9wTaY5wGbc19SV1bbsXxmT2/WpdoKN+as+SpqKmY7:LnJqGh447O1bbsX4hdlNK+xz TLSH AB636B003799C926E59D8AB4BCF2554106B5C63B2102DA0F7CC850DB9BAFFC64A427FE
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Low
1 malicious · 4 files
EXE3c3f3afaec1d4885f5521c8944d32fe0DcRat
Structure
Config. Field Value
Key (AES_256) UnlUSWhuhuhuhuhuhuhuhuhuhuhu
Pastebin -huhuhuhu
Certificate MIICMzhuhuhuhuhuhuhuhuhuhuhu
ServerSignature kIf1L7huhuhuhuhuhuhuhuhuhuhu
Install thuhuhuhu
BDOS fhuhuhuhu
Anti-VM fhuhuhuhu
Install File ctfhuhuhuhu
Install-Folder %Aphuhuhuhu
Hosts designhuhuhuhuhuhuhuhuhuhuhu
Ports 443,16huhuhuhuhuhuhu
Mutex Ctfmonhuhuhuhuhuhuhu
Delay 1huhuhuhu
Group VenomRhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
ctfmon.exe
Full Name
ctfmon.exe
EntryPoint
System.Void Client.Program::Main()
Scope Name
ctfmon.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
ctfmon
Assembly Version
5.0.0.3
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
160
Main Method
System.Void Client.Program::Main()
Main IL Instruction Count
77
Main IL 
ldc.i4.0 <null>
stloc.0 <null>
br IL_0015: ldloc.0
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
ldc.i4.1 <null>
add <null>
stloc.0 <null>
ldloc.0 <null>
ldsfld System.String Client.Settings::De_lay
call System.Int32 System.Convert::ToInt32(System.String)
blt.s IL_0007: ldc.i4 1000
call System.Boolean Client.Settings::InitializeSettings()
brtrue IL_0032: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
ldsfld System.String Client.Settings::An_ti
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_0047: leave IL_0052
call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis()
leave IL_0052: call System.Void Client.Helper.A::B()
pop <null>
leave IL_0052: call System.Void Client.Helper.A::B()
call System.Void Client.Helper.A::B()
call System.Boolean Client.Helper.MutexControl::CreateMutex()
brtrue IL_0067: leave IL_0072
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
leave IL_0072: nop
pop <null>
leave IL_0072: nop
nop <null>
ldsfld System.String Client.Settings::Anti_Process
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_0087: leave IL_0092
call System.Void Client.Helper.AntiProcess::StartBlock()
leave IL_0092: nop
pop <null>
leave IL_0092: nop
nop <null>
ldsfld System.String Client.Settings::BS_OD
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_00B1: leave IL_00BC
call System.Boolean Client.Helper.Methods::IsAdmin()
brfalse IL_00B1: leave IL_00BC
call System.Void Client.Helper.ProcessCritical::Set()
leave IL_00BC: nop
pop <null>
leave IL_00BC: nop
nop <null>
ldsfld System.String Client.Settings::In_stall
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_00D1: leave IL_00DC
call System.Void Client.Install.NormalStartup::Install()
leave IL_00DC: call System.Void Client.Helper.Methods::PreventSleep()
pop <null>
leave IL_00DC: call System.Void Client.Helper.Methods::PreventSleep()
call System.Void Client.Helper.Methods::PreventSleep()
call System.Boolean Client.Helper.Methods::IsAdmin()
brfalse IL_00F0: leave IL_00FB
call System.Void Client.Helper.Methods::ClearSetting()
leave IL_00FB: nop
pop <null>
leave IL_00FB: nop
nop <null>
call System.Boolean Client.Connection.ClientSocket::get_IsConnected()
brtrue IL_0110: leave IL_011B
call System.Void Client.Connection.ClientSocket::Reconnect()
call System.Void Client.Connection.ClientSocket::InitializeClient()
leave IL_011B: ldc.i4 5000
pop <null>
leave IL_011B: ldc.i4 5000
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_00FB: nop
Module Name
ctfmon.exe
Full Name
ctfmon.exe
EntryPoint
System.Void Client.Program::Main()
Scope Name
ctfmon.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
ctfmon
Assembly Version
5.0.0.3
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
160
Main Method
System.Void Client.Program::Main()
Main IL Instruction Count
77
Main IL 
ldc.i4.0 <null>
stloc.0 <null>
br IL_0015: ldloc.0
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
ldc.i4.1 <null>
add <null>
stloc.0 <null>
ldloc.0 <null>
ldsfld System.String Client.Settings::De_lay
call System.Int32 System.Convert::ToInt32(System.String)
blt.s IL_0007: ldc.i4 1000
call System.Boolean Client.Settings::InitializeSettings()
brtrue IL_0032: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
ldsfld System.String Client.Settings::An_ti
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_0047: leave IL_0052
call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis()
leave IL_0052: call System.Void Client.Helper.A::B()
pop <null>
leave IL_0052: call System.Void Client.Helper.A::B()
call System.Void Client.Helper.A::B()
call System.Boolean Client.Helper.MutexControl::CreateMutex()
brtrue IL_0067: leave IL_0072
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
leave IL_0072: nop
pop <null>
leave IL_0072: nop
nop <null>
ldsfld System.String Client.Settings::Anti_Process
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_0087: leave IL_0092
call System.Void Client.Helper.AntiProcess::StartBlock()
leave IL_0092: nop
pop <null>
leave IL_0092: nop
nop <null>
ldsfld System.String Client.Settings::BS_OD
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_00B1: leave IL_00BC
call System.Boolean Client.Helper.Methods::IsAdmin()
brfalse IL_00B1: leave IL_00BC
call System.Void Client.Helper.ProcessCritical::Set()
leave IL_00BC: nop
pop <null>
leave IL_00BC: nop
nop <null>
ldsfld System.String Client.Settings::In_stall
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_00D1: leave IL_00DC
call System.Void Client.Install.NormalStartup::Install()
leave IL_00DC: call System.Void Client.Helper.Methods::PreventSleep()
pop <null>
leave IL_00DC: call System.Void Client.Helper.Methods::PreventSleep()
call System.Void Client.Helper.Methods::PreventSleep()
call System.Boolean Client.Helper.Methods::IsAdmin()
brfalse IL_00F0: leave IL_00FB
call System.Void Client.Helper.Methods::ClearSetting()
leave IL_00FB: nop
pop <null>
leave IL_00FB: nop
nop <null>
call System.Boolean Client.Connection.ClientSocket::get_IsConnected()
brtrue IL_0110: leave IL_011B
call System.Void Client.Connection.ClientSocket::Reconnect()
call System.Void Client.Connection.ClientSocket::InitializeClient()
leave IL_011B: ldc.i4 5000
pop <null>
leave IL_011B: ldc.i4 5000
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_00FB: nop
Key (AES_256) MUTEXmalicious
UnlUSWhuhuhuhuhuhuhuhuhuhuhu
CnC CNCmalicious
designhuhuhuhuhuhuhu
CnC CNCmalicious
cbrahuhuhuhuhuhuhu
CnC CNCmalicious
sverhuhuhuhuhuhuhu
CnC CNCmalicious
slihuhuhuhu
CnC CNCmalicious
68ghuhuhuhu
CnC CNCmalicious
www.huhuhuhuhuhuhu
CnC CNCmalicious
66dhuhuhuhu
CnC CNCmalicious
lvkhuhuhuhu
CnC CNCmalicious
rrfhuhuhuhu
CnC CNCmalicious
hitchuhuhuhuhuhuhu
Ports PORTmalicious
4huhuhuhu
Ports PORTmalicious
1huhuhuhu
Ports PORTmalicious
4huhuhuhu
Ports PORTmalicious
4huhuhuhu
Mutex MUTEXmalicious
Ctfmonhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙