Malicious
Malicious

88d5f1fe1f327f66413b70317f38814d

PE Executable
MD5: 88d5f1fe1f327f66413b70317f38814d
Size: 49.66 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 88d5f1fe1f327f66413b70317f38814d
Sha1 73d90a90a0c3ae26d135c9c1021bb651b7637626
Sha256 629a33ac1e45aec4bed75114a4ef2d27f330305a1edcd77afc9301680cadfebb
Sha384 9082f2dfbecc0bea0679be27e5064fc80ddfec559a2e699ee19b8c421de90cd19c0128d7ba80ecb761723947b6869c80
Sha512 a55a8d9e761d4b294dfb483a5b715a7477cb2e11558b7f9742373af1c2989be0f7269d57604c084ffd54d1e16d93ad4b224e93a158ae5c916ec1ff5fac3ed7fb
SSDeep 1536:6tIcj73uxCXCNLAzibTBUHywdTvS6O0KmVcl:6DMCXCNLAWbTOTaIK8Y
TLSH 58233C003BE98139E2BE5F785DF52145867AF6232603D65E3CCC41D64B13BC6CA92AF6
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
88d5f1fe1f327f66413b70317f38814d
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Config. Field Value
Key (AES_256) dXZtMEhuhuhuhuhuhuhuhuhuhuhu
Pastebin -huhuhuhu
Certificate MIIE8jhuhuhuhuhuhuhuhuhuhuhu
ServerSignature Ny26ZChuhuhuhuhuhuhuhuhuhuhu
Install thuhuhuhu
BDOS fhuhuhuhu
Anti-VM fhuhuhuhu
Install File svchuhuhuhu
Install-Folder %Aphuhuhuhu
Version 0.huhuhuhu
Hosts tatohuhuhuhu
Ports 4huhuhuhu
Mutex mkhuhuhuhu
Delay 5huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
qjgAguBDYqiRlU
Full Name
qjgAguBDYqiRlU
EntryPoint
System.Void WIgTGtleflkg.gRZWOYikphYwJhT::Main()
Scope Name
qjgAguBDYqiRlU
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Stub
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
130
Main Method
System.Void WIgTGtleflkg.gRZWOYikphYwJhT::Main()
Main IL Instruction Count
53
Main IL 
ldc.i4.0 <null>
stloc.0 <null>
br.s IL_0012: ldloc.0
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
ldc.i4.1 <null>
add <null>
stloc.0 <null>
ldloc.0 <null>
ldsfld System.String WIgTGtleflkg.TbklHLhtYWsUKIv::cpkxaPzxwInEyh
call System.Int32 System.Convert::ToInt32(System.String)
blt.s IL_0004: ldc.i4 1000
call System.Boolean WIgTGtleflkg.TbklHLhtYWsUKIv::FUBuIzWWQbA()
brtrue.s IL_002C: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Boolean kakDoRcGIhz.UMMkMMZLwFonvZ::jajVIZTWmLRFZ()
brtrue.s IL_003A: ldsfld System.String WIgTGtleflkg.TbklHLhtYWsUKIv::SwtuxpThpsUL
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String WIgTGtleflkg.TbklHLhtYWsUKIv::SwtuxpThpsUL
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_004B: ldsfld System.String WIgTGtleflkg.TbklHLhtYWsUKIv::PsGwgPRJlwgFX
call System.Void kakDoRcGIhz.JEWkVDpTRqANfl::IDfiXVaKzEZ()
ldsfld System.String WIgTGtleflkg.TbklHLhtYWsUKIv::PsGwgPRJlwgFX
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_005C: ldsfld System.String WIgTGtleflkg.TbklHLhtYWsUKIv::xjjOrOtgVJBThd
call System.Void LUoDPjHSFoIh.BlyOsljOLKPd::GFWvZBsBjTU()
ldsfld System.String WIgTGtleflkg.TbklHLhtYWsUKIv::xjjOrOtgVJBThd
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_0074: call System.Void kakDoRcGIhz.zFjjAgYjOrGocqQ::fLmsbHABJl()
call System.Boolean kakDoRcGIhz.zFjjAgYjOrGocqQ::RZkQNwCXziqlMiRY()
brfalse.s IL_0074: call System.Void kakDoRcGIhz.zFjjAgYjOrGocqQ::fLmsbHABJl()
call System.Void kakDoRcGIhz.CPpXHjJGwfpcAD::eqSyYZNPME()
call System.Void kakDoRcGIhz.zFjjAgYjOrGocqQ::fLmsbHABJl()
newobj System.Void kakDoRcGIhz.gkcHSSZUdkiJh::.ctor()
call System.String kakDoRcGIhz.gkcHSSZUdkiJh::TlfLKgRupF()
pop <null>
leave.s IL_0089: call System.Boolean LZMpkjWKmTOqj.huNCfHKmleUe::get_IsConnected()
pop <null>
leave.s IL_0089: call System.Boolean LZMpkjWKmTOqj.huNCfHKmleUe::get_IsConnected()
call System.Boolean LZMpkjWKmTOqj.huNCfHKmleUe::get_IsConnected()
brtrue.s IL_009A: newobj System.Void System.Random::.ctor()
call System.Void LZMpkjWKmTOqj.huNCfHKmleUe::rPtDYdOqZOKB()
call System.Void LZMpkjWKmTOqj.huNCfHKmleUe::BlsnBPqekbr()
newobj System.Void System.Random::.ctor()
ldc.i4 1000
ldc.i4 5000
callvirt System.Int32 System.Random::Next(System.Int32,System.Int32)
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_0089: call System.Boolean LZMpkjWKmTOqj.huNCfHKmleUe::get_IsConnected()
Info
PE Detect: PeReader OK (file layout)
Module Name
qjgAguBDYqiRlU
Full Name
qjgAguBDYqiRlU
EntryPoint
System.Void WIgTGtleflkg.gRZWOYikphYwJhT::Main()
Scope Name
qjgAguBDYqiRlU
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Stub
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
130
Main Method
System.Void WIgTGtleflkg.gRZWOYikphYwJhT::Main()
Main IL Instruction Count
53
Main IL 
ldc.i4.0 <null>
stloc.0 <null>
br.s IL_0012: ldloc.0
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
ldc.i4.1 <null>
add <null>
stloc.0 <null>
ldloc.0 <null>
ldsfld System.String WIgTGtleflkg.TbklHLhtYWsUKIv::cpkxaPzxwInEyh
call System.Int32 System.Convert::ToInt32(System.String)
blt.s IL_0004: ldc.i4 1000
call System.Boolean WIgTGtleflkg.TbklHLhtYWsUKIv::FUBuIzWWQbA()
brtrue.s IL_002C: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Boolean kakDoRcGIhz.UMMkMMZLwFonvZ::jajVIZTWmLRFZ()
brtrue.s IL_003A: ldsfld System.String WIgTGtleflkg.TbklHLhtYWsUKIv::SwtuxpThpsUL
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String WIgTGtleflkg.TbklHLhtYWsUKIv::SwtuxpThpsUL
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_004B: ldsfld System.String WIgTGtleflkg.TbklHLhtYWsUKIv::PsGwgPRJlwgFX
call System.Void kakDoRcGIhz.JEWkVDpTRqANfl::IDfiXVaKzEZ()
ldsfld System.String WIgTGtleflkg.TbklHLhtYWsUKIv::PsGwgPRJlwgFX
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_005C: ldsfld System.String WIgTGtleflkg.TbklHLhtYWsUKIv::xjjOrOtgVJBThd
call System.Void LUoDPjHSFoIh.BlyOsljOLKPd::GFWvZBsBjTU()
ldsfld System.String WIgTGtleflkg.TbklHLhtYWsUKIv::xjjOrOtgVJBThd
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_0074: call System.Void kakDoRcGIhz.zFjjAgYjOrGocqQ::fLmsbHABJl()
call System.Boolean kakDoRcGIhz.zFjjAgYjOrGocqQ::RZkQNwCXziqlMiRY()
brfalse.s IL_0074: call System.Void kakDoRcGIhz.zFjjAgYjOrGocqQ::fLmsbHABJl()
call System.Void kakDoRcGIhz.CPpXHjJGwfpcAD::eqSyYZNPME()
call System.Void kakDoRcGIhz.zFjjAgYjOrGocqQ::fLmsbHABJl()
newobj System.Void kakDoRcGIhz.gkcHSSZUdkiJh::.ctor()
call System.String kakDoRcGIhz.gkcHSSZUdkiJh::TlfLKgRupF()
pop <null>
leave.s IL_0089: call System.Boolean LZMpkjWKmTOqj.huNCfHKmleUe::get_IsConnected()
pop <null>
leave.s IL_0089: call System.Boolean LZMpkjWKmTOqj.huNCfHKmleUe::get_IsConnected()
call System.Boolean LZMpkjWKmTOqj.huNCfHKmleUe::get_IsConnected()
brtrue.s IL_009A: newobj System.Void System.Random::.ctor()
call System.Void LZMpkjWKmTOqj.huNCfHKmleUe::rPtDYdOqZOKB()
call System.Void LZMpkjWKmTOqj.huNCfHKmleUe::BlsnBPqekbr()
newobj System.Void System.Random::.ctor()
ldc.i4 1000
ldc.i4 5000
callvirt System.Int32 System.Random::Next(System.Int32,System.Int32)
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_0089: call System.Boolean LZMpkjWKmTOqj.huNCfHKmleUe::get_IsConnected()
Key (AES_256) MUTEXmalicious
dXZtMEhuhuhuhuhuhuhuhuhuhuhu
CnC CNCmalicious
tatohuhuhuhu
Ports PORTmalicious
4huhuhuhu
Mutex MUTEXmalicious
mkhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
88d5f1fe1f327f66413b70317f38814d
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Config. Field Value
Key (AES_256) dXZtMEhuhuhuhuhuhuhuhuhuhuhu
Pastebin -huhuhuhu
Certificate MIIE8jhuhuhuhuhuhuhuhuhuhuhu
ServerSignature Ny26ZChuhuhuhuhuhuhuhuhuhuhu
Install thuhuhuhu
BDOS fhuhuhuhu
Anti-VM fhuhuhuhu
Install File svchuhuhuhu
Install-Folder %Aphuhuhuhu
Version 0.huhuhuhu
Hosts tatohuhuhuhu
Ports 4huhuhuhu
Mutex mkhuhuhuhu
Delay 5huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Key (AES_256) MUTEXmalicious
dXZtMEhuhuhuhuhuhuhuhuhuhuhu
88d5f1fe1f327f66413b70317f38814d
CnC CNCmalicious
tatohuhuhuhu
88d5f1fe1f327f66413b70317f38814d
Ports PORTmalicious
4huhuhuhu
88d5f1fe1f327f66413b70317f38814d
Mutex MUTEXmalicious
mkhuhuhuhu
88d5f1fe1f327f66413b70317f38814d
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙