Malicious
Malicious

49ea87c8e7d5345854df7d224e4c6e32

PE Executable
MD5: 49ea87c8e7d5345854df7d224e4c6e32
Size: 47.1 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 49ea87c8e7d5345854df7d224e4c6e32
Sha1 6d3cfe3ee75e1469becc8eb64444d94dc0902caa
Sha256 8054026c22d6f84e6d6040d704a8f759e8364575df5ad03ef72d3f981262bee3
Sha384 544d0d13aa7c63cf7b7be96b5013c2e8109461568b6e04fc7a24296bd67acf3773b6b7f2dd946d355c706777b4808ff2
Sha512 b1ac69f680eef339a37c76b9dd49ec92aaf9d9fad7aad45533e9513e58c2aeee5645deef6abe2c9493450da3b7c616e5f40c76c0c320516031d1189906c74172
SSDeep 768:LqdpXbXX0fIAkOicvHk3eHlWMPbPgF0qUYDAtf1+ZYI6OCC2tYcFmVc6K:LtIAXvZH0ub4FrRSfy6OnKmVcl
TLSH 06233B003BD98126E2FE5FB89CF56141877AE6232603D65E3CC841DB5B13BC6CA526F6
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
49ea87c8e7d5345854df7d224e4c6e32
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Config. Field Value
Key (AES_256) OWNSN0huhuhuhuhuhuhuhuhuhuhu
Pastebin -huhuhuhu
Certificate MIIE8jhuhuhuhuhuhuhuhuhuhuhu
ServerSignature h8X9qKhuhuhuhuhuhuhuhuhuhuhu
Install fhuhuhuhu
BDOS fhuhuhuhu
Anti-VM fhuhuhuhu
Install File svchuhuhuhu
Install-Folder %Aphuhuhuhu
Version 0.huhuhuhu
Hosts irohuhuhuhu
Ports 4huhuhuhu
Mutex mkhuhuhuhu
Delay 5huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Stub.exe
Full Name
Stub.exe
EntryPoint
System.Void Client.Program::Main()
Scope Name
Stub.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Stub
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
130
Main Method
System.Void Client.Program::Main()
Main IL Instruction Count
53
Main IL 
ldc.i4.0 <null>
stloc.0 <null>
br.s IL_0012: ldloc.0
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
ldc.i4.1 <null>
add <null>
stloc.0 <null>
ldloc.0 <null>
ldsfld System.String Client.Settings::Delay
call System.Int32 System.Convert::ToInt32(System.String)
blt.s IL_0004: ldc.i4 1000
call System.Boolean Client.Settings::InitializeSettings()
brtrue.s IL_002C: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Boolean Client.Helper.MutexControl::CreateMutex()
brtrue.s IL_003A: ldsfld System.String Client.Settings::Anti
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String Client.Settings::Anti
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_004B: ldsfld System.String Client.Settings::Install
call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis()
ldsfld System.String Client.Settings::Install
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_005C: ldsfld System.String Client.Settings::BDOS
call System.Void Client.Install.NormalStartup::Install()
ldsfld System.String Client.Settings::BDOS
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_0074: call System.Void Client.Helper.Methods::PreventSleep()
call System.Boolean Client.Helper.Methods::IsAdmin()
brfalse.s IL_0074: call System.Void Client.Helper.Methods::PreventSleep()
call System.Void Client.Helper.ProcessCritical::Set()
call System.Void Client.Helper.Methods::PreventSleep()
newobj System.Void Client.Helper.CheckMiner::.ctor()
call System.String Client.Helper.CheckMiner::GetProcess()
pop <null>
leave.s IL_0089: call System.Boolean Client.Connection.ClientSocket::get_IsConnected()
pop <null>
leave.s IL_0089: call System.Boolean Client.Connection.ClientSocket::get_IsConnected()
call System.Boolean Client.Connection.ClientSocket::get_IsConnected()
brtrue.s IL_009A: newobj System.Void System.Random::.ctor()
call System.Void Client.Connection.ClientSocket::Reconnect()
call System.Void Client.Connection.ClientSocket::InitializeClient()
newobj System.Void System.Random::.ctor()
ldc.i4 1000
ldc.i4 5000
callvirt System.Int32 System.Random::Next(System.Int32,System.Int32)
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_0089: call System.Boolean Client.Connection.ClientSocket::get_IsConnected()
Info
PE Detect: PeReader OK (file layout)
Module Name
Stub.exe
Full Name
Stub.exe
EntryPoint
System.Void Client.Program::Main()
Scope Name
Stub.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Stub
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
130
Main Method
System.Void Client.Program::Main()
Main IL Instruction Count
53
Main IL 
ldc.i4.0 <null>
stloc.0 <null>
br.s IL_0012: ldloc.0
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
ldc.i4.1 <null>
add <null>
stloc.0 <null>
ldloc.0 <null>
ldsfld System.String Client.Settings::Delay
call System.Int32 System.Convert::ToInt32(System.String)
blt.s IL_0004: ldc.i4 1000
call System.Boolean Client.Settings::InitializeSettings()
brtrue.s IL_002C: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Boolean Client.Helper.MutexControl::CreateMutex()
brtrue.s IL_003A: ldsfld System.String Client.Settings::Anti
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String Client.Settings::Anti
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_004B: ldsfld System.String Client.Settings::Install
call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis()
ldsfld System.String Client.Settings::Install
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_005C: ldsfld System.String Client.Settings::BDOS
call System.Void Client.Install.NormalStartup::Install()
ldsfld System.String Client.Settings::BDOS
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_0074: call System.Void Client.Helper.Methods::PreventSleep()
call System.Boolean Client.Helper.Methods::IsAdmin()
brfalse.s IL_0074: call System.Void Client.Helper.Methods::PreventSleep()
call System.Void Client.Helper.ProcessCritical::Set()
call System.Void Client.Helper.Methods::PreventSleep()
newobj System.Void Client.Helper.CheckMiner::.ctor()
call System.String Client.Helper.CheckMiner::GetProcess()
pop <null>
leave.s IL_0089: call System.Boolean Client.Connection.ClientSocket::get_IsConnected()
pop <null>
leave.s IL_0089: call System.Boolean Client.Connection.ClientSocket::get_IsConnected()
call System.Boolean Client.Connection.ClientSocket::get_IsConnected()
brtrue.s IL_009A: newobj System.Void System.Random::.ctor()
call System.Void Client.Connection.ClientSocket::Reconnect()
call System.Void Client.Connection.ClientSocket::InitializeClient()
newobj System.Void System.Random::.ctor()
ldc.i4 1000
ldc.i4 5000
callvirt System.Int32 System.Random::Next(System.Int32,System.Int32)
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_0089: call System.Boolean Client.Connection.ClientSocket::get_IsConnected()
Key (AES_256) MUTEXmalicious
OWNSN0huhuhuhuhuhuhuhuhuhuhu
CnC CNCmalicious
irohuhuhuhu
Ports PORTmalicious
4huhuhuhu
Mutex MUTEXmalicious
mkhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
49ea87c8e7d5345854df7d224e4c6e32
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Config. Field Value
Key (AES_256) OWNSN0huhuhuhuhuhuhuhuhuhuhu
Pastebin -huhuhuhu
Certificate MIIE8jhuhuhuhuhuhuhuhuhuhuhu
ServerSignature h8X9qKhuhuhuhuhuhuhuhuhuhuhu
Install fhuhuhuhu
BDOS fhuhuhuhu
Anti-VM fhuhuhuhu
Install File svchuhuhuhu
Install-Folder %Aphuhuhuhu
Version 0.huhuhuhu
Hosts irohuhuhuhu
Ports 4huhuhuhu
Mutex mkhuhuhuhu
Delay 5huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Key (AES_256) MUTEXmalicious
OWNSN0huhuhuhuhuhuhuhuhuhuhu
49ea87c8e7d5345854df7d224e4c6e32
CnC CNCmalicious
irohuhuhuhu
49ea87c8e7d5345854df7d224e4c6e32
Ports PORTmalicious
4huhuhuhu
49ea87c8e7d5345854df7d224e4c6e32
Mutex MUTEXmalicious
mkhuhuhuhu
49ea87c8e7d5345854df7d224e4c6e32
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙