Malicious
PE Executable
MD5: 85c87718f624d8c3ece9d424d30284a6
Size: 3.67 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
| MD5 | 85c87718f624d8c3ece9d424d30284a6 |
| Sha1 | 206922be385e570eeee0cca7466b8187d5f28966 |
| Sha256 | f5b9822ab2587e51019580a46fd98a6ccf55b0ec4654f5a5481fdbee8edab6d6 |
| Sha384 | d09dbecf5944b0b1c60a2b1ec2600901804ecae912d65035b48280a09f1bdc43c0c5a86941e7759008a4accbd01a46a9 |
| Sha512 | f70ed9b65875cef0dce747ec92b2862d840e581d0dedcd9ff850da0d55ce3a213ca601c4bc00d06b8f63350df62f70c523ee85db7e9d7fc1601038068e6b59c5 |
| SSDeep | 98304:C6ID/+E+evxE+qS1IRvSKoDUA6ujLTow+psHPc:C7d2+qyIRGjjLTow+gc |
| TLSH | 61062209E7F508BDE0B6A1B4CD835912EB727C491771E6DF03A459B75F232A08E39B12 |
PeID
Microsoft Visual C++ 8.0 (DLL)Microsoft Visual C++ v6.0 DLL
Malicious
Malicious
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 6
STICH kept: 2secondary ignored: 4
bin
2img
2Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe>arc:rar>pe:exe>pe:rsrc>bin
Shape
pe:exe>arc:rar>pe:exe>pe:rsrc>bin
malicious
5 nodes
Path
pe:exe>arc:rar>scr:ps1~T1027~T1059.001
Shape
pe:exe>arc:rar>scr:ps1
malicious
3 nodes
| Config. Field | Value |
|---|---|
| Mutex | Nyd9Nhuhuhuhuhuhuhu |
| Hosts | 89.39.huhuhuhuhuhuhuhuhuhuhu |
| Port | 1huhuhuhu |
| KEY | <Xwhuhuhuhu |
| USBNM | thuhuhuhu |
| LoggerPath | %Thuhuhuhu |
| family | xhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Name | Value |
|---|---|
| Info | PE Detect: PeReader OK (file layout) |
| Info | Overlay extracted: Overlay_b383b7f7.bin (3054451 bytes) |
| Info | PDB Path: D:\Projects\WinRAR\SFX\build\sfxrar64\Release\sfxrar.pdb |
Mutex
MUTEXmalicious
Nyd9Nhuhuhuhuhuhuhu
CnC
CNCmalicious
89.3huhuhuhuhuhuhu
CnC
CNCmalicious
127huhuhuhu
CnC
CNCmalicious
13.1huhuhuhu
Port
PORTmalicious
1huhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
"Add-Mhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential