Malicious
PE Executable
MD5: 4f46075552500da5b19b711285a5152d
Size: 216.58 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Size
216.58 KB · 216,576 B
First seen
2026-06-30 04:30 · 3 months ago
Last seen
2026-06-30 04:30 · 3 months ago
Last analysis
2026-09-03 21:07 · one month ago
Hashes
MD5
4f46075552500da5b19b711285a5152d
Sha1
0fda1bfcc63a8198882a0bbfcfdc1e40bc001df8
Sha256
ea37cf74d52ae3a829b32b3c91f940132a649ec854b2d2377ef82c523fff7fe4
Sha384
69ad02b04e3df66e5cf5598e105fc3b7b55d64f406c7bd5bcde9419afe53e9365a765121f82edf34dabde2b8ec34f910
Sha512
092c97f3c56fd836ca77a64cae7b8de6ba538831ff3404bf6316d9b0d9dc0813abcf9725392767ae1fd6f1de67f7250bab71eed48e8359e7b170197d8aca8683
SSDeep
6144:n3WOArZU5HEl9YKmfeHvkZWNEbgN4YYYYE:3fA1U5HEl8eHvkZWNEHYYYY
TLSH
C3246B217680C13BC19B1A3196BF9FB618BCAA35176581CBB7904EB91E707D1FE3470A
Detection
PeID
MS Visual C++ v7.0 DLLMicrosoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ 7.0 - 8.0Microsoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamVisual C++ 2003 DLL -> MicrosoftVisual C++ 2005 DLL -> Microsoft
1 malicious · 2 files
EXE4f46075552500da5b19b711285a5152dValleyRat
Structure
BINResources
STICH
beta
No STICH Path has been generated for this analysis yet.
1 structural branch were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.
bin
1| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhuhuhuhuhu |
| Botnet | s���N�huhuhuhuhuhuhuhuhuhuhu |
| UserAgent | t�a�s�huhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhuhuhuhuhu |
| Botnet | 4���x�huhuhuhuhuhuhuhuhuhuhu |
| UserAgent | s�h�a�huhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential