Malicious
Malicious

5fbeea9f24c9314ef0fdc36245f22054

PE Executable
MD5: 5fbeea9f24c9314ef0fdc36245f22054
Size: 28.16 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 27.5 KB PE Executable identified by Malva.RE as AsyncRAT (rat). Static analysis extracted 2 embedded or derived files, a malware configuration (AsyncRAT config.) and 1 command-and-control endpoint. It matches 5 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
9cfd1645a9ce589649c7821e75f72723a5e13d6dd3aab8a6bada7aa8d8651233
MD5
5fbeea9f24c9314ef0fdc36245f22054
Verdict
Malicious
File type
PE Executable · 27.5 KB
Family
AsyncRAT
Category
RAT
C2 (defanged)
wholesaleshoes[.]sa[.]com

Cite this report: https://app.malva.re/sha256/9cfd1645a9ce589649c7821e75f72723a5e13d6dd3aab8a6bada7aa8d8651233

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Size
28.16 KB · 28,160 B
First seen
2026-08-22 17:15 · 2 months ago
Last seen
2026-08-22 17:15 · 2 months ago
Last analysis
2026-08-22 17:15 · 2 months ago
Hashes
MD5 5fbeea9f24c9314ef0fdc36245f22054 Sha1 7ea8329364111610c7f029a4640c3de87afa6d14 Sha256 9cfd1645a9ce589649c7821e75f72723a5e13d6dd3aab8a6bada7aa8d8651233 Sha384 bcad9daec2ef9adb567e364c705745af5b24ffd3aca822d44be7a7ce7175c35c71e6c4f12667b80db40d175ae2c1bf09 Sha512 5f7d21329be61d73bbf6123bb23e15b8826004b82b8c98c6ba21abcfb46170060b9bc2a70b4c7f639b2bdc2ae296b949ed064024a3f2c43af2dc69e2f936045d SSDeep 384:sAZguIKgpDW8LLHtZARPn9jXH9qbuUshybQxnCJfJBndnjJrKr++:sAZgHdt+bIbIBiBnSr++ TLSH 1AC23B0833E4C571E2FD4ABA9833E5008B75E55B9913D76A6FC890AD2E237CD8A14FD4
Detection
Symbol obfuscation
Low

1 malicious · 3 files
EXE5fbeea9f24c9314ef0fdc36245f22054AsyncRAT
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes

Config. Field Value
Key (AES_256) Byhuhuhuhu
Pastebin -huhuhuhu
Install fhuhuhuhu
Install File Tehuhuhuhu
Install-Folder %huhuhuhu
Version 0.huhuhuhu
Hosts wholeshuhuhuhuhuhuhu
Ports 4huhuhuhu
Mutex Aphuhuhuhu
Delay 0huhuhuhu
Group NYhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Name Value
Info
PDB Path: C:\new\Client\obj\Debug\VIN88APP.pdb
Module Name
VIN88APP.exe
Full Name
VIN88APP.exe
EntryPoint
System.Void Client.Program::Main()
Scope Name
VIN88APP.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
VIN88APP
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
122
Main Method
System.Void Client.Program::Main()
Main IL Instruction Count
101
Main IL 
nop <null>
ldc.i4.0 <null>
stloc.0 <null>
br.s IL_0016: ldloc.0
nop <null>
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
nop <null>
ldloc.0 <null>
ldc.i4.1 <null>
add <null>
stloc.0 <null>
ldloc.0 <null>
ldsfld System.String Client.Settings::Delay
call System.Int32 System.Convert::ToInt32(System.String)
clt <null>
stloc.1 <null>
ldloc.1 <null>
brtrue.s IL_0005: nop
call System.Boolean Client.Settings::InitializeSettings()
ldc.i4.0 <null>
ceq <null>
stloc.2 <null>
ldloc.2 <null>
brfalse.s IL_003A: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
nop <null>
nop <null>
call System.Boolean Client.Helper.MutexControl::CreateMutex()
ldc.i4.0 <null>
ceq <null>
stloc.3 <null>
ldloc.3 <null>
brfalse.s IL_004F: ldsfld System.String Client.Settings::Anti
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
ldsfld System.String Client.Settings::Anti
call System.Boolean System.Convert::ToBoolean(System.String)
stloc.s V_4
ldloc.s V_4
brfalse.s IL_0065: ldsfld System.String Client.Settings::Install
call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis()
nop <null>
ldsfld System.String Client.Settings::Install
call System.Boolean System.Convert::ToBoolean(System.String)
stloc.s V_5
ldloc.s V_5
brfalse.s IL_007B: ldsfld System.String Client.Settings::BDOS
call System.Void Client.Install.NormalStartup::Install()
nop <null>
ldsfld System.String Client.Settings::BDOS
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_008E: ldc.i4.0
call System.Boolean Client.Helper.Methods::IsAdmin()
br.s IL_008F: stloc.s V_6
ldc.i4.0 <null>
stloc.s V_6
ldloc.s V_6
brfalse.s IL_009B: call System.Void Client.Helper.Methods::PreventSleep()
call System.Void Client.Helper.ProcessCritical::Set()
nop <null>
call System.Void Client.Helper.Methods::PreventSleep()
nop <null>
nop <null>
leave.s IL_00A9: br.s IL_00DD
pop <null>
nop <null>
nop <null>
leave.s IL_00A9: br.s IL_00DD
br.s IL_00DD: ldc.i4.1
nop <null>
nop <null>
call System.Boolean Client.Connection.ClientSocket::get_IsConnected()
ldc.i4.0 <null>
ceq <null>
stloc.s V_7
ldloc.s V_7
brfalse.s IL_00C9: nop
nop <null>
call System.Void Client.Connection.ClientSocket::Reconnect()
nop <null>
call System.Void Client.Connection.ClientSocket::InitializeClient()
nop <null>
nop <null>
nop <null>
leave.s IL_00D1: ldc.i4 5000
pop <null>
nop <null>
nop <null>
leave.s IL_00D1: ldc.i4 5000
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
nop <null>
ldc.i4.1 <null>
stloc.s V_8
br.s IL_00AB: nop

Key (AES_256) MUTEXmalicious
Byhuhuhuhu
CnC CNCmalicious
wholeshuhuhuhuhuhuhu
Ports PORTmalicious
4huhuhuhu
Mutex MUTEXmalicious
Aphuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

1 malicious · 3 files
EXE5fbeea9f24c9314ef0fdc36245f22054AsyncRAT
Structure

Config. Field Value
Key (AES_256) Byhuhuhuhu
Pastebin -huhuhuhu
Install fhuhuhuhu
Install File Tehuhuhuhu
Install-Folder %huhuhuhu
Version 0.huhuhuhu
Hosts wholeshuhuhuhuhuhuhu
Ports 4huhuhuhu
Mutex Aphuhuhuhu
Delay 0huhuhuhu
Group NYhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Key (AES_256) MUTEXmalicious
Byhuhuhuhu
5fbeea9f24c9314ef0fdc36245f22054
CnC CNCmalicious
wholeshuhuhuhuhuhuhu
5fbeea9f24c9314ef0fdc36245f22054
Ports PORTmalicious
4huhuhuhu
5fbeea9f24c9314ef0fdc36245f22054
Mutex MUTEXmalicious
Aphuhuhuhu
5fbeea9f24c9314ef0fdc36245f22054
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙