Malicious
Malicious

51e64c2ff5c48a36454b023e75ca146f

Share on LinkedIn
Print
PE Executable
MD5: 51e64c2ff5c48a36454b023e75ca146f
Size: 93.18 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
93.18 KB · 93,184 B
First seen
2026-09-06 20:00 · one month ago
Last seen
2026-09-06 20:00 · one month ago
Last analysis
2026-09-06 20:00 · one month ago
Hashes
MD5 51e64c2ff5c48a36454b023e75ca146f Sha1 350079a36c0e81911cc3cda143047b2514c27e5a Sha256 579e244c821b155684cec762f68b7ce76d806da76f5367a4798b97c9246500c7 Sha384 967dd1335d351a66f45d7d8891c76501cfb08a9a78a4325c52fc9e2c58ac7a68d27ad39cd02347677041ee446e574d52 Sha512 3b66f9c001bc2e28861d16fea5fe382378dacbd360de5d71718288fab66a199b2be0a084f3650da47f431b9bede1dc95ffeda0bf5ca07b61339170eb31a85445 SSDeep 1536:cfQhqlSvUAth+Mqf7/SBEbxsBuMxDKwzqH853wDu3Y6Uk9jg+rr6GbOsKpeQiQKV:cEqEfxBEbxWuM4rDud7r6GiX8QiQ/1S TLSH EE936D007BD88529F67E8B38A8B3438507B4AD576802DA9D0DD439AF1A737C59D063BF
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Low
1 malicious · 10 files
EXE51e64c2ff5c48a36454b023e75ca146fAsyncRAT
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>pe:rsrc>img
Shape pe:exe>pe:rsrc>img
malicious 3 nodes
Config. Field Value
Key (AES_256) QjR4d1huhuhuhuhuhuhuhuhuhuhu
Pastebin -huhuhuhu
Certificate MIIE8jhuhuhuhuhuhuhuhuhuhuhu
ServerSignature NTjwuthuhuhuhuhuhuhuhuhuhuhu
Install thuhuhuhu
BDOS fhuhuhuhu
Anti-VM fhuhuhuhu
Install File tele@ehuhuhuhuhuhuhu
Install-Folder %Aphuhuhuhu
Hosts pulsa1huhuhuhuhuhuhuhuhuhuhu
Ports 44huhuhuhu
Mutex eW9Fhuhuhuhu
Version 0huhuhuhu
Delay 3huhuhuhu
Group Dehuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
from au88 with love.exe
Full Name
from au88 with love.exe
EntryPoint
System.Void Client.Program::Main()
Scope Name
from au88 with love.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
from au88 with love
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
197
Main Method
System.Void Client.Program::Main()
Main IL Instruction Count
64
Main IL 
ldc.i4.0 <null>
stloc.0 <null>
ldsfld System.String Client.Settings::Delay
ldloca.s V_0
call System.Boolean System.Int32::TryParse(System.String,System.Int32&)
brtrue IL_0015: ldc.i4.0
ldc.i4.0 <null>
stloc.0 <null>
ldc.i4.0 <null>
stloc.1 <null>
br IL_002A: ldloc.1
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.1 <null>
ldc.i4.1 <null>
add <null>
stloc.1 <null>
ldloc.1 <null>
ldloc.0 <null>
blt.s IL_001C: ldc.i4 1000
leave IL_0039: call System.Boolean Client.Settings::InitializeSettings()
pop <null>
leave IL_0039: call System.Boolean Client.Settings::InitializeSettings()
call System.Boolean Client.Settings::InitializeSettings()
brtrue IL_0053: call System.Threading.Tasks.Task Client.Program::SendRequests()
ldstr Settings initialization failed. Exiting.
call System.Void System.Console::WriteLine(System.String)
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Threading.Tasks.Task Client.Program::SendRequests()
pop <null>
call System.Boolean Client.Helper.MutexControl::CreateMutex()
brtrue IL_0069: ldsfld System.String Client.Settings::Anti
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String Client.Settings::Anti
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_007D: ldsfld System.String Client.Settings::Install
call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis()
ldsfld System.String Client.Settings::Install
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_0091: ldsfld System.String Client.Settings::BDOS
call System.Void Client.Install.NormalStartup::Install()
ldsfld System.String Client.Settings::BDOS
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_00AF: call System.Void Client.Helper.Methods::PreventSleep()
call System.Boolean Client.Helper.Methods::IsAdmin()
brfalse IL_00AF: call System.Void Client.Helper.Methods::PreventSleep()
call System.Void Client.Helper.ProcessCritical::Set()
call System.Void Client.Helper.Methods::PreventSleep()
leave IL_00BF: nop
pop <null>
leave IL_00BF: nop
nop <null>
call System.Boolean Client.Connection.ClientSocket::get_IsConnected()
brtrue IL_00D4: leave IL_00DF
call System.Void Client.Connection.ClientSocket::Reconnect()
call System.Void Client.Connection.ClientSocket::InitializeClient()
leave IL_00DF: ldc.i4 5000
pop <null>
leave IL_00DF: ldc.i4 5000
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_00BF: nop
Module Name
from au88 with love.exe
Full Name
from au88 with love.exe
EntryPoint
System.Void Client.Program::Main()
Scope Name
from au88 with love.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
from au88 with love
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
197
Main Method
System.Void Client.Program::Main()
Main IL Instruction Count
64
Main IL 
ldc.i4.0 <null>
stloc.0 <null>
ldsfld System.String Client.Settings::Delay
ldloca.s V_0
call System.Boolean System.Int32::TryParse(System.String,System.Int32&)
brtrue IL_0015: ldc.i4.0
ldc.i4.0 <null>
stloc.0 <null>
ldc.i4.0 <null>
stloc.1 <null>
br IL_002A: ldloc.1
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.1 <null>
ldc.i4.1 <null>
add <null>
stloc.1 <null>
ldloc.1 <null>
ldloc.0 <null>
blt.s IL_001C: ldc.i4 1000
leave IL_0039: call System.Boolean Client.Settings::InitializeSettings()
pop <null>
leave IL_0039: call System.Boolean Client.Settings::InitializeSettings()
call System.Boolean Client.Settings::InitializeSettings()
brtrue IL_0053: call System.Threading.Tasks.Task Client.Program::SendRequests()
ldstr Settings initialization failed. Exiting.
call System.Void System.Console::WriteLine(System.String)
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Threading.Tasks.Task Client.Program::SendRequests()
pop <null>
call System.Boolean Client.Helper.MutexControl::CreateMutex()
brtrue IL_0069: ldsfld System.String Client.Settings::Anti
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String Client.Settings::Anti
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_007D: ldsfld System.String Client.Settings::Install
call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis()
ldsfld System.String Client.Settings::Install
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_0091: ldsfld System.String Client.Settings::BDOS
call System.Void Client.Install.NormalStartup::Install()
ldsfld System.String Client.Settings::BDOS
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_00AF: call System.Void Client.Helper.Methods::PreventSleep()
call System.Boolean Client.Helper.Methods::IsAdmin()
brfalse IL_00AF: call System.Void Client.Helper.Methods::PreventSleep()
call System.Void Client.Helper.ProcessCritical::Set()
call System.Void Client.Helper.Methods::PreventSleep()
leave IL_00BF: nop
pop <null>
leave IL_00BF: nop
nop <null>
call System.Boolean Client.Connection.ClientSocket::get_IsConnected()
brtrue IL_00D4: leave IL_00DF
call System.Void Client.Connection.ClientSocket::Reconnect()
call System.Void Client.Connection.ClientSocket::InitializeClient()
leave IL_00DF: ldc.i4 5000
pop <null>
leave IL_00DF: ldc.i4 5000
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_00BF: nop
Key (AES_256) MUTEXmalicious
QjR4d1huhuhuhuhuhuhuhuhuhuhu
CnC CNCmalicious
pulsahuhuhuhuhuhuhu
CnC CNCmalicious
www.puhuhuhuhuhuhuhu
Ports PORTmalicious
4huhuhuhu
Ports PORTmalicious
8huhuhuhu
Mutex MUTEXmalicious
eW9Fhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙