Malicious
744e1221f6467d0b7e73a10f52e6cd6c
PE Executable
MD5: 744e1221f6467d0b7e73a10f52e6cd6c
Size: 37.89 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Size
37.89 KB · 37,888 B
First seen
2026-06-29 18:46 · 4 months ago
Last seen
2026-06-29 18:46 · 4 months ago
Last analysis
2026-06-30 19:00 · 3 months ago
Hashes
MD5
744e1221f6467d0b7e73a10f52e6cd6c
Sha1
33e85ae9412fa870e5d6de31502e7d48c64ce224
Sha256
31c37ff61aa322192236c9672f09e3d97b6e6e09c5019077df7d0567d4c0b48b
Sha384
149b363a9157d2218222ecb1c12b587ea214fb99252ab1905767a59a7fc8e344b42d4b595d212d617875f443ad4f31c1
Sha512
704389db8c842344a21c4563f1154b57bf208466083b1fded330c4f53b7931fdb216e1e8dada0733729f8ac7aebf1047e77d7c96d2b6950b7bc69872b93a90de
SSDeep
384:6yTMUiDHblmJEpRGyEfBffXuKCYyEAnrAF+rMRTyN/0L+EcoinblneHQM3epzXGd:fTqHpR9EfBfWKClEOrM+rMRa8NuoXt
TLSH
0F03294D7FE18168C5FD057B05B2D41207BBE04B6E23D90E8EF564AA37636C18B94AF2
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Low
1 malicious · 2 files
EXE744e1221f6467d0b7e73a10f52e6cd6cnjRat
Structure
BINResources
BINRT_MANIFEST
BINID:0001
BINID:0
| Config. Field | Value |
|---|---|
| packet_size [b] | 5huhuhuhu |
| BD [BD] | Thuhuhuhu |
| directory [DR] | Aphuhuhuhu |
| executable_name [EXE] | saahuhuhuhu |
| cnc_host [HH] | 5.tcphuhuhuhuhuhuhu |
| is_dir_defined [Idr] | Thuhuhuhu |
| is_startup_folder [IsF] | Thuhuhuhu |
| is_user_reg [Isu] | Thuhuhuhu |
| NH [NH] | 0huhuhuhu |
| cnc_port [P] | 1huhuhuhu |
| reg_key [RG] | d8c514huhuhuhuhuhuhuhuhuhuhu |
| reg_path [sf] | Softwahuhuhuhuhuhuhuhuhuhuhu |
| sizk | 2huhuhuhu |
| victim_name [VN] | Hahuhuhuhu |
| version [VR] | ihuhuhuhu |
| splitter [Y] | |huhuhuhu |
| HD | Thuhuhuhu |
| anti [anti] | Exsahuhuhuhu |
| anti2 [anti2] | Fhuhuhuhu |
| usb [usb] | Thuhuhuhu |
| usbx [usbx] | svchuhuhuhu |
| task [task] | Thuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| Module Name | w.exe |
| Full Name | w.exe |
| EntryPoint | System.Void w.A::main() |
| Scope Name | w.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v2.0.50727 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | w |
| Assembly Version | 0.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | <null> |
| Total Strings | 338 |
| Main Method | System.Void w.A::main() |
| Main IL Instruction Count | 5 |
| Main IL | |
| Module Name | w.exe |
| Full Name | w.exe |
| EntryPoint | System.Void w.A::main() |
| Scope Name | w.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v2.0.50727 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | w |
| Assembly Version | 0.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | <null> |
| Total Strings | 338 |
| Main Method | System.Void w.A::main() |
| Main IL Instruction Count | 5 |
| Main IL | |
Port
PORTmalicious
1huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential1 malicious · 2 files
EXE744e1221f6467d0b7e73a10f52e6cd6cnjRat
Structure
BINResources
| Config. Field | Value |
|---|---|
| packet_size [b] | 5huhuhuhu |
| BD [BD] | Thuhuhuhu |
| directory [DR] | Aphuhuhuhu |
| executable_name [EXE] | saahuhuhuhu |
| cnc_host [HH] | 5.tcphuhuhuhuhuhuhu |
| is_dir_defined [Idr] | Thuhuhuhu |
| is_startup_folder [IsF] | Thuhuhuhu |
| is_user_reg [Isu] | Thuhuhuhu |
| NH [NH] | 0huhuhuhu |
| cnc_port [P] | 1huhuhuhu |
| reg_key [RG] | d8c514huhuhuhuhuhuhuhuhuhuhu |
| reg_path [sf] | Softwahuhuhuhuhuhuhuhuhuhuhu |
| sizk | 2huhuhuhu |
| victim_name [VN] | Hahuhuhuhu |
| version [VR] | ihuhuhuhu |
| splitter [Y] | |huhuhuhu |
| HD | Thuhuhuhu |
| anti [anti] | Exsahuhuhuhu |
| anti2 [anti2] | Fhuhuhuhu |
| usb [usb] | Thuhuhuhu |
| usbx [usbx] | svchuhuhuhu |
| task [task] | Thuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialPort
PORTmalicious
1huhuhuhu
744e1221f6467d0b7e73a10f52e6cd6c
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account