Malicious
Malicious

5dbe32faa16cec73b47dd659ee91f902

PE Executable
MD5: 5dbe32faa16cec73b47dd659ee91f902
Size: 18.01 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
18.01 MB · 18,007,552 B
First seen
2026-09-23 00:15 · one month ago
Last seen
2026-09-23 00:15 · one month ago
Last analysis
2026-09-23 00:17 · one month ago
Hashes
MD5 5dbe32faa16cec73b47dd659ee91f902 Sha1 7cb00239c35c36e81d3b92f02cac65d224a9ade7 Sha256 202c71cccc63a9bad0c94b898a6447c2723724c7c534bfb7f2143eb6a50a2196 Sha384 92e4e93a656b34a58e60f055a56131c16e016d25275de296c15d7ec348e5c58fa6799311c076bd11e0442b73892c430d Sha512 3ce8ca5473d563439cf318a1ca8d8a5f314911f6868e397093f212bdbb4d5de9a41eb59eff8ceaf23ae0d66c5c1123209b7cf9dfea5772553c0136b97edf1dfe SSDeep 393216:vJGJBJydNBUUwDzCTsFfnpIwsDZ0uiDgpMJgLwLEhJkSITH:v0JBJ1CopIwsDZO5L1 TLSH EF0723DA2BB84FD2E23D03B5087537B8E77A72B53422C7597D9031D65A06F262982D0F
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NETUPolyX 0.3 -> delikon
Symbol obfuscation
Medium
2 malicious · 919 files
EXE5dbe32faa16cec73b47dd659ee91f902AgentTesla
Structure
BINResources
BINRT_ICON
BINID:0001
BINID:0
BINRT_GROUP_CURSOR4
BINID:7F00
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN.Net Resources
BINGalacticToolsV3.Apps.resources
ICON$this.Icon
BIN[NBF]root.IconData
BINGalacticToolsV3.Coming_Soon.resources
BINGalacticToolsV3.Error.resources
ICON$this.Icon
BIN[NBF]root.IconData
BINGalacticToolsV3.Properties.Resources.resources
SVG1024px-Eo_circle_deep-purple_pause.svg
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BIN1200px-OBS_Studio_Logo_128x129
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BIN16182609953574579341748529190482_128x129
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BIN16182610568647591714541588417574_128x129
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BIN179-1793019_windows-10-file-explorer-icon-hd-png-download_128x129
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BIN220px-Grand_Theft_Auto_V_185x270
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BIN220px-Max_Payne_3_Cover_185x270
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BIN29145659-a3038400-7d23-11e7-8cf4-02a20ee4d59d_183x168
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BIN300px-Doom_Eternal_cover_185x270
IMG[NBF]root.Data
EXIF[NBF]root.Data.exif
IMG[NBF]root.Data-preview.png
BIN300px-Hitman_2_cover_185x270
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BIN300px-Prey_for_the_Gods_cover_185x270
IMG[NBF]root.Data
EXIF[NBF]root.Data.exif
IMG[NBF]root.Data-preview.png
BIN300px-Resident_Evil_3_cover_185x270
IMG[NBF]root.Data
EXIF[NBF]root.Data.exif
IMG[NBF]root.Data-preview.png
BIN3037cb576e8a708c486e67b8ef6d7dcc
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BIN329975-emp_185x270
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BIN364-3640589_desktop-comments-desktop-vector-icon-png
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BIN432px-Yuzu_Emulator_SVG.svg_183x168
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BIN4ca3bc4d28e97fe9f36f755458733449 (1)
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BIN4ca3bc4d28e97fe9f36f755458733449_1_161x154
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BIN4ca3bc4d28e97fe9f36f755458733449_1_161x154_183x168
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BIN4ca3bc4d28e97fe9f36f755458733449_1_161x154_1_128x129
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BIN4ca3bc4d28e97fe9f36f755458733449_1_161x154_40x40
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BIN4ea88a5395a3618cb13479f6b5172f79_185x270
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BIN518OkiXrUL_128x129
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BIN519-5198145_bluestacks-icon-bluestacks-logo-png_183x168
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BIN51uRGn90-4L
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BIN58482afbcef1014c0b5e4a21_128x129
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BIN5857242931556279648-512
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BIN588a64e7d06f6719692a2d11
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BIN588a64f5d06f6719692a2d13
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BIN66-663254_dolphin-emulator-dolphin-wii-icon-clipart_183x168
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BIN7605670_183x168
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BIN7f775f51c40dc7fdac86dad5cd63be0d
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
SVG7ziplogo.svg
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BIN882px-Epic_Games_logo_128x129
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BIN91--4R2rAjL_185x270
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BIN9ee51b63631ad330327b5eeddbab4370
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINACOdysseyCoverArt_185x270
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINACOrigins_cover_185x270
IMG[NBF]root.Data
EXIF[NBF]root.Data.exif
IMG[NBF]root.Data-preview.png
BINAdvanced_Warfare_185x270
IMG[NBF]root.Data
EXIF[NBF]root.Data.exif
IMG[NBF]root.Data-preview.png
BINAmong-Us-Wallpaper_185x270
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINAssassins_Creed_2_Box_Art_185x270
IMG[NBF]root.Data
EXIF[NBF]root.Data.exif
IMG[NBF]root.Data-preview.png
BINBattlefield_V_standard_edition_box_art_185x270
IMG[NBF]root.Data
EXIF[NBF]root.Data.exif
IMG[NBF]root.Data-preview.png
BINBlizzard_Battle.net_logo_128x129
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINCloud_Force_1_1_190x168
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINCtrlTab_159-2_128x129
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINCyberpunk_2077_box_art_1_185x270
IMG[NBF]root.Data
EXIF[NBF]root.Data.exif
IMG[NBF]root.Data-preview.png
BINDeath_Stranding_185x270
IMG[NBF]root.Data
EXIF[NBF]root.Data.exif
IMG[NBF]root.Data-preview.png
BINDetroit_Become_Human_Cover_001_185x270
IMG[NBF]root.Data
EXIF[NBF]root.Data.exif
IMG[NBF]root.Data-preview.png
BINDolphin-logo.svg_183x168
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINFile-Explorer-fluent-icon_128x129
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINFirefox_logo_128x129
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINGalactic_tools_190x168
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINGalactic_tools_190x168_183x168
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINGoogle_Chrome_icon_2011_1_128x129
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINGrand_Theft_Auto_IV_cover_185x270
IMG[NBF]root.Data
EXIF[NBF]root.Data.exif
IMG[NBF]root.Data-preview.png
BINHITMAN_III_art_185x270
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINHorizon_Zero_Dawn_185x270
IMG[NBF]root.Data
EXIF[NBF]root.Data.exif
IMG[NBF]root.Data-preview.png
BINMV5BYjY3ODFmNWUtNjhjNC00NTExLWIxYmEtYmQ0YTk5NjkzYTUwXkEyXkFqcGdeQXVyNzEyNjcwNTk._V1__231x270
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINMafia_Definitive_Edition_185x270
IMG[NBF]root.Data
EXIF[NBF]root.Data.exif
IMG[NBF]root.Data-preview.png
BINModern_Warfare_2_cover_185x270
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
SVGNotepad++_Logo.svg
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINOri_and_the_Blind_Forest_Logo_185x270
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINOrigin-logo_128x129
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINPicsArt_05-02-10
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINPoPWW_Boxart_185x270
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINPowerISO_128x129
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINProcessHacker
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINRPCS3_LOGO_183x168
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINRPCS3_LOGO_190x168
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINRed_Dead_Redemption_II_185x270
IMG[NBF]root.Data
EXIF[NBF]root.Data.exif
IMG[NBF]root.Data-preview.png
BINResident_Evil_7_cover_art_185x270
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINRoblox_logo
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINSands_of_time_cover_185x270
IMG[NBF]root.Data
EXIF[NBF]root.Data.exif
IMG[NBF]root.Data-preview.png
BINSatrixTools_Server_Icon_Remake_1_190x168
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINScreenshot_20210717-145955
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINShadow_of_the_Tomb_Raider_cover_185x270
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINShareX_Icon
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINShareX_Logo
IMG[NBF]root.Data
BINTeamViewer_Logo_512x512_128x129
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINUntitled_185x270
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINVBCable_128x129
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINVBRbgdNXc146sWyIztXGEd3B2K38hoKWDj8565uiUKI_350x200_1x-0_185x270
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINVegas_Pro_15.0_128x129
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINXenia_Emulator_Upadted_Logo_190x168
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINXenia_Emulator_Upadted_Logo_190x168_183x168
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINYuviqei
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINZortosUnzipper_32512-1_128x129
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINa_5e6922771d54e8b639ca0d509cabf602
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINa_df92d8ce3fa9dba25b72cfc7fda42b40
IMG[NBF]root.Data
BINal2nu-jkzm7-007
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINanydesk-for-mac_128x129
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINapplication_window_32px
BINapps.13367.13817186670444302.148c432a-9fce-4c7d-bf13-8a2bd3a527b3_185x270
IMG[NBF]root.Data
EXIF[NBF]root.Data.exif
IMG[NBF]root.Data-preview.png
BINapps.23943.13510798883386282.e6f02eb7-a760-453e-8d79-46d4ec74807e_185x270
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINapps.24111.65806558541457305.a0ff0982-eced-4bfd-bb78-5ba7a73376c4_185x270
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINapps.26312.70628478259232551.a0089f3a-b3b5-4c4b-bdaf-0d97810a4816_185x270
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINapps.28990.69531514236615003.8f0d03d6-6311-4c21-a151-834503c2901a_185x270
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINapps.29198.66416288418246547.8db04ed4-6710-424c-b2c7-fc1b8f89e9a2_185x270
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINapps.36093.14339303838396367.725ab8dd-f8b7-4a29-a351-45ebd5d66edd_185x270
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINapps.43582.65690499810545026.aa1d3860-b757-4828-bb9e-87e0858403fe_185x270
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINapps.52808.69748098540497451.a03a4b64-603b-49b8-8644-4924ac7f3076_185x270
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINapps_tab_24px
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINapps_tab_32px
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINb5366f6c592e0d7a7fe6c675b1e63ebf
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINbravelmao my guy u gay
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINbuild-10158_128x129
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINcfp1c3QENHakdjuf424Yt6hVn_mmFbOV-M8rITUoVj8_350x200_1x-0_1_185x270
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINclip-art-dolphin-computer-icons-portable-network-graphics-emulator-png-favpng-QHXbXUa35KLWhd3paHbnqhNHG
IMG[NBF]root.Data
EXIF[NBF]root.Data.exif
IMG[NBF]root.Data-preview.png
BINclock_24px
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINcreed_box_185x270
IMG[NBF]root.Data
EXIF[NBF]root.Data.exif
IMG[NBF]root.Data-preview.png
BINcrysis-remastered-cover_185x270
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINd9qp2p7-1a0f9cc6-26b2-4c73-8636-850ba731d191_128x129
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINdanewlogoResizedV2_183x168
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINdefaultLogo_183x168
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINdefaultLogo_190x168
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINdesktop_52px
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINdiscord-logo
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINdiscord-mascot
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINdownload
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINdownload (11)
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINdownload-instagram-png-logo-20_128x129
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINdownload-removebg-preview
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINdownload-removebg-preview (1)
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINdownload_10_1_128x129
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINdownload_11_128x129
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINdownload_128x129
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINdownload_12_128x129
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINdownload_13_183x168
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINdownload_2_185x270
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINdownload_3_185x270
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINdownload_4_185x270
IMG[NBF]root.Data
VBS[NBF]root.Data-preview.png
BINdownload_5_185x270
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINdownload_6_185x270
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINds3_tool_64px
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINed4ca193fcdf72b005b170f1042c369d_190x168
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINed4ca193fcdf72b005b170f1042c369d_190x168_183x168
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINeed8617c83ce52e9beb552ad8eb468d3_185x270
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINerror_40px
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINezgif-7-0835fc5930eb
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINezgif.com-gif-maker (3)
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINfar_cry_3_pal_box_art_185x270
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINfdsff_183x168
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINfdsff_190x168
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINfile-explorer-folder-libraries-icon-18298
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINfl-studio_128x129
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINgalacticLogo
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINgame_controller_52px
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINgetting-over-it-with-bennet-foddy-font_185x270
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINhome_52px
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINiconfinder_videogame_icons-05_611918_25x25
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINicons8-apps-tab-50_30x25
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINicons8-apps-tab-96_1_30x25
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINicons8-desktop-mac-30
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINicons8-home-26
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINicons8-info-24
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINicons8-less-than-100_29x29
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINicons8-less-than-52
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINicons8-less-than-52_29x29
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINicons8-less-than-96_1_29x29
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINicons8-male-user-96
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINicons8-male-user-96_21x21
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINicons8-menu-48 (1)
BINicons8-menu-480
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINicons8-menu-480_30x25
BINicons8-menu-50_30x25
BINicons8-metamorphose-96
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINicons8-metamorphose-96_21x21
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINicons8-password-96_200x200
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINicons8-password-96_200x200_21x21
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINicons8-right-arrow-96_200x200
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINicons8-save-30
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINicons8-settings
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINicons8-settings-144
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINicons8-settings-96
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINimages (9)
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINimages_128x129
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINimages_1_185x270
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINimages_2_185x270
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINimages_4_185x270
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINimages_5_185x270
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINimages_9_231x270
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINksp_box_art_185x270
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINlaptop_50px
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINlarge
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINlogo-epic-cb4399a7ee205610531057537937045e_128x129
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINmicro_sd_50px
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINminecraft-cover_185x270
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINminecraft_logo_icon_168974
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINmobile-cover_185x270
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINnba2k21_fob_LE_CG_1_185x270
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINnvidia-geforce-claw-logo_30x25
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINnvidia_geforce_64px
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINopera_gx_browser_logo_icon_152976_128x129
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINorigin-2-569446_128x129
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINparsec
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINparsec_128x129
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINpause_26px
BINpause_30px
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINpc-rpcs3
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINpeazip-icon_128x129
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINplanner_24px
BINpng-clipart-citra-nintendo-3ds-emulator-video-game-pokemon-logo-food-orange_183x168
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINpng-clipart-citra-nintendo-3ds-emulator-video-game-pokemon-logo-food-orange_190x168
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINpng-clipart-citra-nintendo-3ds-emulator-video-game-pokemon-logo-food-orange_190x168_183x168
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINpng-clipart-three-gray-lines-illustration-hamburger-menu-icon-icons-logos-emojis-menu-icons
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINpng-transparent-super-nintendo-entertainment-system-retroarch-playstation-emulator-game-boy-advance-playstation-angle-electronics-text-thumbnail
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINprince-of-persia-the-forgotten-sands-cover_1_185x270
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINprocessor_50px
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINresident-evil-2-biohazard-re2-cover_185x270
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINsave_52px
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINseven-kingdoms-9_128x129
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINspotify-download-logo-30_128x129
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINsteam-logo-transparent (1)
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINsteam-logo-transparent_128x129
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINsteam-logo-transparent_1_128x129
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINsteam-logo-transparent_2_128x129
IMG[NBF]root.Data
BINstepper_motor_52px
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINtask-manager-taskmgr-icon-big_128x129
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINthumb_14446818090regedit-removebg-preview
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINtjPOPhB
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINubisoft-connect_128x129
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINunflag_50px
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINunknown
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINunknown2
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINunknown_190x168
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINunknown_190x168 (1)
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINunknown_190x168_1_183x168
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINunknown_1_183x168
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINunnamed_30x25
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINuser_account_symbol_145x134
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINuser_account_symbol_171x165
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINuser_account_symbol_2_183x182
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINversions_24px
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINvideo_24px
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINvideo_card_32px
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINvisual-studio-code-logo-png-transparent_128x129
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINwatch-dogs-legion-cover_185x270
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINworkstation_30px
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINwp4387717
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINzoom-fondo-blanco-vertical-logo-F819E1C283-seeklogo_128x129
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINzortosunzipperlogo
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINcostura.aforge.dll.compressed
DLLcostura.aforge.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.costura.dll.compressed
DLLcostura.costura.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.costura.pdb.compressed
PDBcostura.costura.pdb
BINcostura.discordrpc.dll.compressed
DLLcostura.discordrpc.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
XMLDiscordRPC.xml
BINcostura.discordrpc.pdb.compressed
PDBcostura.discordrpc.pdb
BINcostura.guna.ui2.dll.compressed
DLLcostura.guna.ui2.dllAgentTesla
Structure
P7B[Authenticode]_431ae5a3.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
BING290502091B37000C0234063908189.resources
BINicon.Image
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINGuna.UI2.Properties.Resources.resources
BINCheckedCheckbox_20px
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINCheckedRadioButton_20px
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINFullImage_64px
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINImageCalendar
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINUncheckedCheckbox_20px
BINUncheckedRadioButton_20px
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINce_48px
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINcurv3
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINcurv3_w
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINerror
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINinfo
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINlogo
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINlogo_w
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINmiring
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINquestion
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINwarning
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BING210D150D32360006331B0C3C36190C08041A2507250D012C78.resources
BINbtDown.Image
BINbtUp.Image
BINimageList1.ImageStream
DATA[NBF]root.Data
BINcostura.microsoft.bcl.asyncinterfaces.dll.compressed
DLLcostura.microsoft.bcl.asyncinterfaces.dll
Structure
P7B[Authenticode]_396abc93.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.microsoft.directx.audiovideoplayback.dll.compressed
DLLcostura.microsoft.directx.audiovideoplayback.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
BINcostura.microsoft.identitymodel.abstractions.dll.compressed
DLLcostura.microsoft.identitymodel.abstractions.dll
Structure
P7B[Authenticode]_b9e1f542.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.microsoft.identitymodel.jsonwebtokens.dll.compressed
DLLcostura.microsoft.identitymodel.jsonwebtokens.dll
Structure
P7B[Authenticode]_0aabab34.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.microsoft.identitymodel.logging.dll.compressed
DLLcostura.microsoft.identitymodel.logging.dll
Structure
P7B[Authenticode]_e5d3065e.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.microsoft.identitymodel.tokens.dll.compressed
DLLcostura.microsoft.identitymodel.tokens.dll
Structure
P7B[Authenticode]_81876a93.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.newtonsoft.json.dll.compressed
DLLcostura.newtonsoft.json.dll
Structure
P7B[Authenticode]_220cad77.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.nvapiwrapper.dll.compressed
DLLcostura.nvapiwrapper.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.system.buffers.dll.compressed
DLLcostura.system.buffers.dll
Structure
P7B[Authenticode]_8c38879e.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
BINFxResources.System.Buffers.SR.resources
BINcostura.system.diagnostics.diagnosticsource.dll.compressed
DLLcostura.system.diagnostics.diagnosticsource.dll
Structure
P7B[Authenticode]_ce5713c0.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
BINFxResources.System.Diagnostics.DiagnosticSource.SR.resources
XMLILLink.Substitutions.xml
BINcostura.system.identitymodel.tokens.jwt.dll.compressed
DLLcostura.system.identitymodel.tokens.jwt.dll
Structure
P7B[Authenticode]_304db019.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.system.memory.dll.compressed
DLLcostura.system.memory.dll
Structure
P7B[Authenticode]_15ab3250.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
BINFxResources.System.Memory.SR.resources
BINcostura.system.numerics.vectors.dll.compressed
DLLcostura.system.numerics.vectors.dll
Structure
BIN.Net Resources
BINFxResources.System.Numerics.Vectors.SR.resources
P7B[Authenticode]_ae030d4d.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.system.runtime.compilerservices.unsafe.dll.compressed
DLLcostura.system.runtime.compilerservices.unsafe.dll
Structure
P7B[Authenticode]_81de04f4.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.system.text.encodings.web.dll.compressed
DLLcostura.system.text.encodings.web.dll
Structure
P7B[Authenticode]_366f44a4.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
BINFxResources.System.Text.Encodings.Web.SR.resources
XMLILLink.Substitutions.xml
BINcostura.system.text.json.dll.compressed
DLLcostura.system.text.json.dll
Structure
P7B[Authenticode]_571562e2.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
BINFxResources.System.Text.Json.SR.resources
XMLILLink.Substitutions.xml
BINcostura.system.threading.tasks.extensions.dll.compressed
DLLcostura.system.threading.tasks.extensions.dll
Structure
P7B[Authenticode]_7121b905.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.system.valuetuple.dll.compressed
DLLcostura.system.valuetuple.dll
Structure
BIN.Net Resources
BINFxResources.System.ValueTuple.SR.resources
P7B[Authenticode]_5e4e41f0.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.winformanimation.dll.compressed
DLLcostura.winformanimation.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.xamarin.forms.core.dll.compressed
DLLcostura.xamarin.forms.core.dll
Structure
P7B[Authenticode]_0e370e50.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.xamarin.forms.core.pdb.compressed
PDBcostura.xamarin.forms.core.pdb
BINcostura.xamarin.forms.platform.dll.compressed
DLLcostura.xamarin.forms.platform.dll
Structure
P7B[Authenticode]_60f68040.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.xamarin.forms.xaml.dll.compressed
DLLcostura.xamarin.forms.xaml.dll
Structure
P7B[Authenticode]_dbc6fde8.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.xamarin.forms.xaml.pdb.compressed
PDBcostura.xamarin.forms.xaml.pdb
BINcostura.microsoft.directx.direct3d.dll.compressed
DLLcostura.microsoft.directx.direct3d.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
BINcostura.microsoft.directx.dll.compressed
DLLcostura.microsoft.directx.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
BINcostura.metadata
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 7 STICH kept: 1secondary ignored: 6
bin 4img 2

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:dll>img
Shape pe:exe>pe:dll>img
malicious 3 nodes
Name Value
Info 
PDB Path: C:\Users\umesh\Downloads\GalacticToolsV3-main (1)\GalacticToolsV3-main\GalacticToolsV3\obj\Debug\GalacticToolsV3.pdb
Module Name
GalacticToolsV3.exe
Full Name
GalacticToolsV3.exe
EntryPoint
System.Void GalacticToolsV3.Program::Main()
Scope Name
GalacticToolsV3.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
GalacticToolsV3
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
1710
Main Method
System.Void GalacticToolsV3.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void GalacticToolsV3.Startup::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Module Name
GalacticToolsV3.exe
Full Name
GalacticToolsV3.exe
EntryPoint
System.Void GalacticToolsV3.Program::Main()
Scope Name
GalacticToolsV3.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
GalacticToolsV3
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
1710
Main Method
System.Void GalacticToolsV3.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void GalacticToolsV3.Startup::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
2 malicious · 919 files
EXE5dbe32faa16cec73b47dd659ee91f902AgentTesla
Structure
BIN.Net Resources
BINGalacticToolsV3.Coming_Soon.resources
BINcostura.aforge.dll.compressed
BINcostura.costura.dll.compressed
BINcostura.costura.pdb.compressed
PDBcostura.costura.pdb
BINcostura.discordrpc.dll.compressed
BINcostura.discordrpc.pdb.compressed
PDBcostura.discordrpc.pdb
BINcostura.guna.ui2.dll.compressed
DLLcostura.guna.ui2.dllAgentTesla
Structure
P7B[Authenticode]_431ae5a3.p7b
BINcostura.microsoft.bcl.asyncinterfaces.dll.compressed
BINcostura.microsoft.directx.audiovideoplayback.dll.compressed
BINcostura.microsoft.identitymodel.abstractions.dll.compressed
BINcostura.microsoft.identitymodel.jsonwebtokens.dll.compressed
BINcostura.microsoft.identitymodel.logging.dll.compressed
BINcostura.microsoft.identitymodel.tokens.dll.compressed
BINcostura.newtonsoft.json.dll.compressed
BINcostura.nvapiwrapper.dll.compressed
BINcostura.system.buffers.dll.compressed
BINcostura.system.diagnostics.diagnosticsource.dll.compressed
BINcostura.system.identitymodel.tokens.jwt.dll.compressed
BINcostura.system.memory.dll.compressed
BINcostura.system.numerics.vectors.dll.compressed
BINcostura.system.runtime.compilerservices.unsafe.dll.compressed
BINcostura.system.text.encodings.web.dll.compressed
BINcostura.system.text.json.dll.compressed
BINcostura.system.threading.tasks.extensions.dll.compressed
BINcostura.system.valuetuple.dll.compressed
BINcostura.winformanimation.dll.compressed
BINcostura.xamarin.forms.core.dll.compressed
BINcostura.xamarin.forms.core.pdb.compressed
PDBcostura.xamarin.forms.core.pdb
BINcostura.xamarin.forms.platform.dll.compressed
BINcostura.xamarin.forms.xaml.dll.compressed
BINcostura.xamarin.forms.xaml.pdb.compressed
PDBcostura.xamarin.forms.xaml.pdb
BINcostura.microsoft.directx.direct3d.dll.compressed
BINcostura.microsoft.directx.dll.compressed
BINcostura.metadata
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙