Malicious
Malicious

41b60b889c0a403674131e69880e8f9c

PE Executable
MD5: 41b60b889c0a403674131e69880e8f9c
Size: 92.67 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
92.67 KB · 92,672 B
First seen
2026-09-06 20:00 · one month ago
Last seen
2026-09-06 20:00 · one month ago
Last analysis
2026-09-06 20:00 · one month ago
Hashes
MD5 41b60b889c0a403674131e69880e8f9c Sha1 c88e2b991983883e668dd8fbfb1d99d3a73d322e Sha256 cccce5d5491d76a7aef09599c91b10bd109c03b307095be10ed85a95ce54ad8e Sha384 dba052ada4e927cc72616b096f18dfff0df840859c5dee557d84c470582472dd001eb993739f8b6aed2e208891a78664 Sha512 c2fe63123ad7652a5d9b213c4bc15444d723b5d5cd08717790c78947aec39e9cdcc563d72ec62de6cde917bd4351c10ab7e736256acb24100a197b3f57bd5b2a SSDeep 1536:ef4RqLgUAGnKnIhtMhjbysJJfj2bvwb8l3wDu3Y6Uk9jg+rr6GbOsKpeQiQKW1S:ecqcgnshjby2JW6Dud7r6GiX8QiQ/1S TLSH BD937D007BD88529F6BEDB38A8B2434507B4BD572812D68D0DD439AF1A73BC099427BF
Detection
Symbol obfuscation
Low
1 malicious · 10 files
EXE41b60b889c0a403674131e69880e8f9cAsyncRAT
Structure
BINResources
BINRT_ICON
BINID:0001
BINID:0
BINID:0002
BINID:0
BINID:0003
BINID:0
BINID:0004
BINID:0
BINID:0005
IMGID:0
IMGID:0-preview.png
BINRT_GROUP_CURSOR4
BINID:0001
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>pe:rsrc>img
Shape pe:exe>pe:rsrc>img
malicious 3 nodes
Config. Field Value
Key (AES_256) c3B1ajhuhuhuhuhuhuhuhuhuhuhu
Pastebin -huhuhuhu
Certificate MIIE8jhuhuhuhuhuhuhuhuhuhuhu
ServerSignature r6Jz+0huhuhuhuhuhuhuhuhuhuhu
Install thuhuhuhu
BDOS fhuhuhuhu
Anti-VM fhuhuhuhu
Install File tele@ehuhuhuhuhuhuhu
Install-Folder %Aphuhuhuhu
Hosts kolaybhuhuhuhuhuhuhuhuhuhuhu
Ports 44huhuhuhu
Mutex yXejhuhuhuhu
Version 0huhuhuhu
Delay 3huhuhuhu
Group Dehuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
from kiwi okvip with love hehe.exe
Full Name
from kiwi okvip with love hehe.exe
EntryPoint
System.Void Client.Program::Main()
Scope Name
from kiwi okvip with love hehe.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
from kiwi okvip with love hehe
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
197
Main Method
System.Void Client.Program::Main()
Main IL Instruction Count
64
Main IL 
ldc.i4.0 <null>
stloc.0 <null>
ldsfld System.String Client.Settings::Delay
ldloca.s V_0
call System.Boolean System.Int32::TryParse(System.String,System.Int32&)
brtrue IL_0015: ldc.i4.0
ldc.i4.0 <null>
stloc.0 <null>
ldc.i4.0 <null>
stloc.1 <null>
br IL_002A: ldloc.1
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.1 <null>
ldc.i4.1 <null>
add <null>
stloc.1 <null>
ldloc.1 <null>
ldloc.0 <null>
blt.s IL_001C: ldc.i4 1000
leave IL_0039: call System.Boolean Client.Settings::InitializeSettings()
pop <null>
leave IL_0039: call System.Boolean Client.Settings::InitializeSettings()
call System.Boolean Client.Settings::InitializeSettings()
brtrue IL_0053: call System.Threading.Tasks.Task Client.Program::SendRequests()
ldstr Settings initialization failed. Exiting.
call System.Void System.Console::WriteLine(System.String)
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Threading.Tasks.Task Client.Program::SendRequests()
pop <null>
call System.Boolean Client.Helper.MutexControl::CreateMutex()
brtrue IL_0069: ldsfld System.String Client.Settings::Anti
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String Client.Settings::Anti
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_007D: ldsfld System.String Client.Settings::Install
call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis()
ldsfld System.String Client.Settings::Install
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_0091: ldsfld System.String Client.Settings::BDOS
call System.Void Client.Install.NormalStartup::Install()
ldsfld System.String Client.Settings::BDOS
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_00AF: call System.Void Client.Helper.Methods::PreventSleep()
call System.Boolean Client.Helper.Methods::IsAdmin()
brfalse IL_00AF: call System.Void Client.Helper.Methods::PreventSleep()
call System.Void Client.Helper.ProcessCritical::Set()
call System.Void Client.Helper.Methods::PreventSleep()
leave IL_00BF: nop
pop <null>
leave IL_00BF: nop
nop <null>
call System.Boolean Client.Connection.ClientSocket::get_IsConnected()
brtrue IL_00D4: leave IL_00DF
call System.Void Client.Connection.ClientSocket::Reconnect()
call System.Void Client.Connection.ClientSocket::InitializeClient()
leave IL_00DF: ldc.i4 5000
pop <null>
leave IL_00DF: ldc.i4 5000
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_00BF: nop
Key (AES_256) MUTEXmalicious
c3B1ajhuhuhuhuhuhuhuhuhuhuhu
CnC CNCmalicious
kolahuhuhuhuhuhuhu
CnC CNCmalicious
www.khuhuhuhuhuhuhu
Ports PORTmalicious
4huhuhuhu
Ports PORTmalicious
8huhuhuhu
Mutex MUTEXmalicious
yXejhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
1 malicious · 10 files
EXE41b60b889c0a403674131e69880e8f9cAsyncRAT
Structure
Config. Field Value
Key (AES_256) c3B1ajhuhuhuhuhuhuhuhuhuhuhu
Pastebin -huhuhuhu
Certificate MIIE8jhuhuhuhuhuhuhuhuhuhuhu
ServerSignature r6Jz+0huhuhuhuhuhuhuhuhuhuhu
Install thuhuhuhu
BDOS fhuhuhuhu
Anti-VM fhuhuhuhu
Install File tele@ehuhuhuhuhuhuhu
Install-Folder %Aphuhuhuhu
Hosts kolaybhuhuhuhuhuhuhuhuhuhuhu
Ports 44huhuhuhu
Mutex yXejhuhuhuhu
Version 0huhuhuhu
Delay 3huhuhuhu
Group Dehuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Key (AES_256) MUTEXmalicious
c3B1ajhuhuhuhuhuhuhuhuhuhuhu
41b60b889c0a403674131e69880e8f9c
CnC CNCmalicious
kolahuhuhuhuhuhuhu
41b60b889c0a403674131e69880e8f9c
CnC CNCmalicious
www.khuhuhuhuhuhuhu
41b60b889c0a403674131e69880e8f9c
Ports PORTmalicious
4huhuhuhu
41b60b889c0a403674131e69880e8f9c
Ports PORTmalicious
8huhuhuhu
41b60b889c0a403674131e69880e8f9c
Mutex MUTEXmalicious
yXejhuhuhuhu
41b60b889c0a403674131e69880e8f9c
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙