Malicious
Malicious

57566bc0003ee4be731e2d585755a489

PE Executable
MD5: 57566bc0003ee4be731e2d585755a489
Size: 92.67 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
92.67 KB · 92,672 B
First seen
2026-09-06 20:00 · one month ago
Last seen
2026-09-06 20:00 · one month ago
Last analysis
2026-09-06 20:00 · one month ago
Hashes
MD5 57566bc0003ee4be731e2d585755a489 Sha1 8547fb670fb27b98b25a20e8a4c2ae5bae563bd2 Sha256 b6f9fc16a92bb2e422f20db1a4c32018e070a20d50adde6742cd066b0c9aa870 Sha384 eeddd19fcb75c8f63fccc1c5385a5e79950ef8ea3dd6eb0c4b8881e9808e4fc415397a7ac2de4a4e931ddc7f341b1b36 Sha512 289defd9eb4945ec40015947d87d4698456e0f9d898315cf727d3ff12bf09c589e76ab3a0e94d4ffcd568be93ff2f61e8e3d87484583d7443248d0c19e29beba SSDeep 1536:uffVRqlAkAqN4z/klApuDv1EbDsB+r4qthvddR8V3wDu3Y6Uk9jg+rr6GbOsKpeN:uXjqW89NDNEbDW+UqtpnPDud7r6GiX8N TLSH C4937D007BD88529F6BEDB38A8B2434507B5BD576802DA9D0DD439AF0A737C099067FE
Detection
PeID
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual Studio .NET
Symbol obfuscation
Low
1 malicious · 10 files
EXE57566bc0003ee4be731e2d585755a489AsyncRAT
Structure
BINResources
BINRT_ICON
BINID:0001
BINID:0
BINID:0002
BINID:0
BINID:0003
BINID:0
BINID:0004
BINID:0
BINID:0005
IMGID:0
IMGID:0-preview.png
BINRT_GROUP_CURSOR4
BINID:0001
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>pe:rsrc>img
Shape pe:exe>pe:rsrc>img
malicious 3 nodes
Config. Field Value
Key (AES_256) QTBJcGhuhuhuhuhuhuhuhuhuhuhu
Pastebin -huhuhuhu
Certificate MIIE8jhuhuhuhuhuhuhuhuhuhuhu
ServerSignature bYegsohuhuhuhuhuhuhuhuhuhuhu
Install thuhuhuhu
BDOS fhuhuhuhu
Anti-VM fhuhuhuhu
Install File tele@ehuhuhuhuhuhuhu
Install-Folder %Thuhuhuhu
Hosts 688vbehuhuhuhuhuhuhuhuhuhuhu
Ports 44huhuhuhu
Mutex 7EqUhuhuhuhu
Version 0huhuhuhu
Delay 3huhuhuhu
Group Dehuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
from kiwi okvip with love.exe
Full Name
from kiwi okvip with love.exe
EntryPoint
System.Void Client.Program::Main()
Scope Name
from kiwi okvip with love.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
from kiwi okvip with love
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
197
Main Method
System.Void Client.Program::Main()
Main IL Instruction Count
64
Main IL 
ldc.i4.0 <null>
stloc.0 <null>
ldsfld System.String Client.Settings::Delay
ldloca.s V_0
call System.Boolean System.Int32::TryParse(System.String,System.Int32&)
brtrue IL_0015: ldc.i4.0
ldc.i4.0 <null>
stloc.0 <null>
ldc.i4.0 <null>
stloc.1 <null>
br IL_002A: ldloc.1
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.1 <null>
ldc.i4.1 <null>
add <null>
stloc.1 <null>
ldloc.1 <null>
ldloc.0 <null>
blt.s IL_001C: ldc.i4 1000
leave IL_0039: call System.Boolean Client.Settings::InitializeSettings()
pop <null>
leave IL_0039: call System.Boolean Client.Settings::InitializeSettings()
call System.Boolean Client.Settings::InitializeSettings()
brtrue IL_0053: call System.Threading.Tasks.Task Client.Program::SendRequests()
ldstr Settings initialization failed. Exiting.
call System.Void System.Console::WriteLine(System.String)
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Threading.Tasks.Task Client.Program::SendRequests()
pop <null>
call System.Boolean Client.Helper.MutexControl::CreateMutex()
brtrue IL_0069: ldsfld System.String Client.Settings::Anti
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String Client.Settings::Anti
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_007D: ldsfld System.String Client.Settings::Install
call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis()
ldsfld System.String Client.Settings::Install
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_0091: ldsfld System.String Client.Settings::BDOS
call System.Void Client.Install.NormalStartup::Install()
ldsfld System.String Client.Settings::BDOS
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_00AF: call System.Void Client.Helper.Methods::PreventSleep()
call System.Boolean Client.Helper.Methods::IsAdmin()
brfalse IL_00AF: call System.Void Client.Helper.Methods::PreventSleep()
call System.Void Client.Helper.ProcessCritical::Set()
call System.Void Client.Helper.Methods::PreventSleep()
leave IL_00BF: nop
pop <null>
leave IL_00BF: nop
nop <null>
call System.Boolean Client.Connection.ClientSocket::get_IsConnected()
brtrue IL_00D4: leave IL_00DF
call System.Void Client.Connection.ClientSocket::Reconnect()
call System.Void Client.Connection.ClientSocket::InitializeClient()
leave IL_00DF: ldc.i4 5000
pop <null>
leave IL_00DF: ldc.i4 5000
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_00BF: nop
Module Name
from kiwi okvip with love.exe
Full Name
from kiwi okvip with love.exe
EntryPoint
System.Void Client.Program::Main()
Scope Name
from kiwi okvip with love.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
from kiwi okvip with love
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
197
Main Method
System.Void Client.Program::Main()
Main IL Instruction Count
64
Main IL 
ldc.i4.0 <null>
stloc.0 <null>
ldsfld System.String Client.Settings::Delay
ldloca.s V_0
call System.Boolean System.Int32::TryParse(System.String,System.Int32&)
brtrue IL_0015: ldc.i4.0
ldc.i4.0 <null>
stloc.0 <null>
ldc.i4.0 <null>
stloc.1 <null>
br IL_002A: ldloc.1
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.1 <null>
ldc.i4.1 <null>
add <null>
stloc.1 <null>
ldloc.1 <null>
ldloc.0 <null>
blt.s IL_001C: ldc.i4 1000
leave IL_0039: call System.Boolean Client.Settings::InitializeSettings()
pop <null>
leave IL_0039: call System.Boolean Client.Settings::InitializeSettings()
call System.Boolean Client.Settings::InitializeSettings()
brtrue IL_0053: call System.Threading.Tasks.Task Client.Program::SendRequests()
ldstr Settings initialization failed. Exiting.
call System.Void System.Console::WriteLine(System.String)
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Threading.Tasks.Task Client.Program::SendRequests()
pop <null>
call System.Boolean Client.Helper.MutexControl::CreateMutex()
brtrue IL_0069: ldsfld System.String Client.Settings::Anti
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String Client.Settings::Anti
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_007D: ldsfld System.String Client.Settings::Install
call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis()
ldsfld System.String Client.Settings::Install
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_0091: ldsfld System.String Client.Settings::BDOS
call System.Void Client.Install.NormalStartup::Install()
ldsfld System.String Client.Settings::BDOS
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_00AF: call System.Void Client.Helper.Methods::PreventSleep()
call System.Boolean Client.Helper.Methods::IsAdmin()
brfalse IL_00AF: call System.Void Client.Helper.Methods::PreventSleep()
call System.Void Client.Helper.ProcessCritical::Set()
call System.Void Client.Helper.Methods::PreventSleep()
leave IL_00BF: nop
pop <null>
leave IL_00BF: nop
nop <null>
call System.Boolean Client.Connection.ClientSocket::get_IsConnected()
brtrue IL_00D4: leave IL_00DF
call System.Void Client.Connection.ClientSocket::Reconnect()
call System.Void Client.Connection.ClientSocket::InitializeClient()
leave IL_00DF: ldc.i4 5000
pop <null>
leave IL_00DF: ldc.i4 5000
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_00BF: nop
Key (AES_256) MUTEXmalicious
QTBJcGhuhuhuhuhuhuhuhuhuhuhu
CnC CNCmalicious
688huhuhuhu
CnC CNCmalicious
www.6huhuhuhuhuhuhu
Ports PORTmalicious
4huhuhuhu
Ports PORTmalicious
8huhuhuhu
Mutex MUTEXmalicious
7EqUhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
1 malicious · 10 files
EXE57566bc0003ee4be731e2d585755a489AsyncRAT
Structure
Config. Field Value
Key (AES_256) QTBJcGhuhuhuhuhuhuhuhuhuhuhu
Pastebin -huhuhuhu
Certificate MIIE8jhuhuhuhuhuhuhuhuhuhuhu
ServerSignature bYegsohuhuhuhuhuhuhuhuhuhuhu
Install thuhuhuhu
BDOS fhuhuhuhu
Anti-VM fhuhuhuhu
Install File tele@ehuhuhuhuhuhuhu
Install-Folder %Thuhuhuhu
Hosts 688vbehuhuhuhuhuhuhuhuhuhuhu
Ports 44huhuhuhu
Mutex 7EqUhuhuhuhu
Version 0huhuhuhu
Delay 3huhuhuhu
Group Dehuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Key (AES_256) MUTEXmalicious
QTBJcGhuhuhuhuhuhuhuhuhuhuhu
57566bc0003ee4be731e2d585755a489
CnC CNCmalicious
688huhuhuhu
57566bc0003ee4be731e2d585755a489
CnC CNCmalicious
www.6huhuhuhuhuhuhu
57566bc0003ee4be731e2d585755a489
Ports PORTmalicious
4huhuhuhu
57566bc0003ee4be731e2d585755a489
Ports PORTmalicious
8huhuhuhu
57566bc0003ee4be731e2d585755a489
Mutex MUTEXmalicious
7EqUhuhuhuhu
57566bc0003ee4be731e2d585755a489
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙