Malicious
Malicious

4604d691d543ad0205bb65db7a49412e

PE Executable
MD5: 4604d691d543ad0205bb65db7a49412e
Size: 745.48 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Size
745.48 KB · 745,484 B
First seen
2025-11-23 01:06 · 11 months ago
Last seen
2025-11-23 01:06 · 11 months ago
Last analysis
2026-01-12 10:55 · 9 months ago
Hashes
MD5 4604d691d543ad0205bb65db7a49412e Sha1 ad082ac32558a29825a256585a31bb2e54237079 Sha256 ec13fb194cf289207af86f7439d4c152a93902961aee6f7d7e817eaa93bd0e76 Sha384 675ca29b4e9c3a4cdaa5eba7e3ec3e0a1db07a2894bb893da19231f467d7d69d2bb6aa96fad703f7b687c665784ffd3f Sha512 0df371474ec53205ecd8a701e28090c4cfe619c29baad30968ee2dc51f8bde9a2fc93334df1e079038e48a6b3944087c25dc3ee7947f5e9253bfe421f34c25e5 SSDeep 12288:VMcjA/VYbLEinwtEYwCKDsNKjvbT+/a7SzszgpB8L8:VMcgynEt/KzbnmsgpB8L8 TLSH ACF46B8033B8E62AE2BE5775E570092807F5E107AB66EF5F5940B1F92C63B419D423B3
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium
2 malicious · 8 files
EXE4604d691d543ad0205bb65db7a49412eAsyncRAT
EXE[Rebuild from dump]_e22ac464.exeAsyncRAT
BIN.Net Resources
BINAForge.Video.DirectShow.Properties.Resources.resources
BINcamera
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINAForge.Video.DirectShow.VideoCaptureDeviceForm.resources
LISTILRepack.List
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key D2973Fhuhuhuhuhuhuhuhuhuhuhu
Version 1huhuhuhu
Port 4huhuhuhu
Host YovngMhuhuhuhuhuhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
Key Suhuhuhuhu
SubDirectory Clihuhuhuhu
InstallName 0huhuhuhu
Install 0huhuhuhu
Startup 0ff0cahuhuhuhuhuhuhuhuhuhuhu
Mutex Quasarhuhuhuhuhuhuhuhuhuhuhu
StartupKey 0huhuhuhu
HideFile 0huhuhuhu
EnableLogger vichuhuhuhu
EncryptionKey Lhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Key (AES_256) -huhuhuhu
Pastebin -huhuhuhu
ServerSignature 7IOXuChuhuhuhuhuhuhuhuhuhuhu
Install File Sbihuhuhuhu
Mutex cmdvhuhuhuhu
Group cmdvhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client
Full Name
Client
EntryPoint
System.Void tjvcxwkzlqyamklktgas.삡Ⴈ秦�흼췂₾鹛쬵鏉揤቞襡଒陸鞢ㄷԘ빀::Main(System.String[])
Scope Name
Client
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.7.1.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
1957
Main Method
System.Void tjvcxwkzlqyamklktgas.삡Ⴈ秦�흼췂₾鹛쬵鏉揤቞襡଒陸鞢ㄷԘ빀::Main(System.String[])
Main IL Instruction Count
20
Main IL 
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
ldnull <null>
ldftn System.Void tjvcxwkzlqyamklktgas.삡Ⴈ秦�흼췂₾鹛쬵鏉揤቞襡଒陸鞢ㄷԘ빀::푩׈䕷Ꮹ螫뛞볟寽㸗⹑嶉␸慚Ĵ帋䧠愢⋊(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void tjvcxwkzlqyamklktgas.삡Ⴈ秦�흼췂₾鹛쬵鏉揤቞襡଒陸鞢ㄷԘ빀::ꙕ疬붧�᤽눭螢㴨柕鮀ꖶ煤䷁顠菍﹁ꎋ䊶(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.Void tjvcxwkzlqyamklktgas.삡Ⴈ秦�흼췂₾鹛쬵鏉揤቞襡଒陸鞢ㄷԘ빀::�欓㩾ᭆ征쪜涧㿕쨦䆷銳鯶滊莔粊聋걓仪䛦()
newobj System.Void tjvcxwkzlqyamklktgas.盰織콀㝷㴫섬祣熝�ꔶᕳ莣￢泦꣤໻㘽〔::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
Module Name
Client
Full Name
Client
EntryPoint
System.Void tjvcxwkzlqyamklktgas.삡Ⴈ秦�흼췂₾鹛쬵鏉揤቞襡଒陸鞢ㄷԘ빀::Main(System.String[])
Scope Name
Client
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.7.1.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
1957
Main Method
System.Void tjvcxwkzlqyamklktgas.삡Ⴈ秦�흼췂₾鹛쬵鏉揤቞襡଒陸鞢ㄷԘ빀::Main(System.String[])
Main IL Instruction Count
20
Main IL 
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
ldnull <null>
ldftn System.Void tjvcxwkzlqyamklktgas.삡Ⴈ秦�흼췂₾鹛쬵鏉揤቞襡଒陸鞢ㄷԘ빀::푩׈䕷Ꮹ螫뛞볟寽㸗⹑嶉␸慚Ĵ帋䧠愢⋊(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void tjvcxwkzlqyamklktgas.삡Ⴈ秦�흼췂₾鹛쬵鏉揤቞襡଒陸鞢ㄷԘ빀::ꙕ疬붧�᤽눭螢㴨柕鮀ꖶ煤䷁顠菍﹁ꎋ䊶(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.Void tjvcxwkzlqyamklktgas.삡Ⴈ秦�흼췂₾鹛쬵鏉揤቞襡଒陸鞢ㄷԘ빀::�欓㩾ᭆ征쪜涧㿕쨦䆷銳鯶滊莔粊聋걓仪䛦()
newobj System.Void tjvcxwkzlqyamklktgas.盰織콀㝷㴫섬祣熝�ꔶᕳ莣￢泦꣤໻㘽〔::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
CnC CNCmalicious
YovngMhuhuhuhuhuhuhuhuhuhuhu
Port PORTmalicious
4huhuhuhu
Key (AES_256) MUTEXmalicious
-huhuhuhu
Mutex MUTEXmalicious
cmdvhuhuhuhu
PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
2 malicious · 8 files
EXE4604d691d543ad0205bb65db7a49412eAsyncRAT
EXE[Rebuild from dump]_e22ac464.exeAsyncRAT
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key D2973Fhuhuhuhuhuhuhuhuhuhuhu
Version 1huhuhuhu
Port 4huhuhuhu
Host YovngMhuhuhuhuhuhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
Key Suhuhuhuhu
SubDirectory Clihuhuhuhu
InstallName 0huhuhuhu
Install 0huhuhuhu
Startup 0ff0cahuhuhuhuhuhuhuhuhuhuhu
Mutex Quasarhuhuhuhuhuhuhuhuhuhuhu
StartupKey 0huhuhuhu
HideFile 0huhuhuhu
EnableLogger vichuhuhuhu
EncryptionKey Lhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Key (AES_256) -huhuhuhu
Pastebin -huhuhuhu
ServerSignature 7IOXuChuhuhuhuhuhuhuhuhuhuhu
Install File Sbihuhuhuhu
Mutex cmdvhuhuhuhu
Group cmdvhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
CnC CNCmalicious
YovngMhuhuhuhuhuhuhuhuhuhuhu
4604d691d543ad0205bb65db7a49412e
Port PORTmalicious
4huhuhuhu
4604d691d543ad0205bb65db7a49412e
Key (AES_256) MUTEXmalicious
-huhuhuhu
4604d691d543ad0205bb65db7a49412e
Mutex MUTEXmalicious
cmdvhuhuhuhu
4604d691d543ad0205bb65db7a49412e
PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
4604d691d543ad0205bb65db7a49412e
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙