Malicious
8cb63ec528985e59a1f67c5527d5adad
PE Executable
MD5: 8cb63ec528985e59a1f67c5527d5adad
Size: 329.22 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Size
329.22 KB · 329,216 B
First seen
2026-10-19 08:16 · 6 days ago
Last seen
2026-10-19 08:16 · 6 days ago
Last analysis
2026-10-19 16:18 · 6 days ago
Hashes
MD5
8cb63ec528985e59a1f67c5527d5adad
Sha1
35849158ce2e24dbd14ce444b30fd4507bcd2fd9
Sha256
f7856dc0d9a74e8bccfc47b55b24fe170f568b87feb7a8cb9c54fd81eee0f68d
Sha384
861daee44b2bf3807a94b74e80a29f4aabd34c028c31c08dafa060cd3643c9797ab915b559a8dc2cc5310e7684157e61
Sha512
2e590ceb1f0d3740c03c0002dd01be6954b4710892ef9accf4ea083a28ac1a43e80044da3ce4458940d3fe33629a83614275ea109f32d68ede8d5d748672cefc
SSDeep
3072:oXMDFq93bh3Injd7mWOCAlfPdNvVU1m2iQeY/A1YWMcoqwYCEw+nrKOzQGcu7MTL:ocDFqTdlfP/vVUuQjrWMGNrKOzQGc9L
TLSH
11649D1877E89A01C27A4379E9B1C37057B4EC562A53D31B1BC4ECDB3E76B814E80A76
Detection
PeID
Microsoft Visual C++ DLLMicrosoft Visual C++ v6.0
Symbol obfuscation
Low
1 malicious · 12 files
EXE8cb63ec528985e59a1f67c5527d5adadRECORDSTEALER
Structure
BINResources
BINRT_ICON
BINID:0001
IMGID:0
IMGID:0-preview.png
BINID:0002
BINID:0
BINID:0003
BINID:0
BINID:0004
BINID:0
BINID:0005
BINID:0
BINID:0006
BINID:0
BINRT_GROUP_CURSOR4
BINID:7F00
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN.Net Resources
TXTdll_b64.txt
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
3 / 3
Path
pe:exe>pe:rsrc>img
Shape
pe:exe>pe:rsrc>img
malicious
3 nodes
Path
pe:exe>pe:rsrc>bin
Shape
pe:exe>pe:rsrc>bin
malicious
3 nodes
| Config. Field | Value |
|---|---|
| [Configuration Module Name] | Arghuhuhuhu |
| [Configuration Module Full Name] | Arghuhuhuhu |
| IP | 127.huhuhuhuhuhuhu |
| ID | thuhuhuhu |
| Message | |
| Key | |
| PublicKeyXml | <RSAKehuhuhuhuhuhuhuhuhuhuhu |
| Version | 0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| [Configuration Module Name] | Arghuhuhuhu |
| [Configuration Module Full Name] | Arghuhuhuhu |
| Key | |
| PublicKeyXml | <RSAKehuhuhuhuhuhuhuhuhuhuhu |
| Version | 0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| Module Name | RuntimeHost.exe |
| Full Name | RuntimeHost.exe |
| EntryPoint | System.Void Program::Main() |
| Scope Name | RuntimeHost.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v4.0.30319 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | RuntimeHost |
| Assembly Version | 10.0.24801.456 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | .NETFramework,Version=v4.6.2 |
| Total Strings | 380 |
| Main Method | System.Void Program::Main() |
| Main IL Instruction Count | 11 |
| Main IL | |
1 malicious · 12 files
EXE8cb63ec528985e59a1f67c5527d5adadRECORDSTEALER
Structure
BINResources
BIN.Net Resources
| Config. Field | Value |
|---|---|
| [Configuration Module Name] | Arghuhuhuhu |
| [Configuration Module Full Name] | Arghuhuhuhu |
| IP | 127.huhuhuhuhuhuhu |
| ID | thuhuhuhu |
| Message | |
| Key | |
| PublicKeyXml | <RSAKehuhuhuhuhuhuhuhuhuhuhu |
| Version | 0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| [Configuration Module Name] | Arghuhuhuhu |
| [Configuration Module Full Name] | Arghuhuhuhu |
| Key | |
| PublicKeyXml | <RSAKehuhuhuhuhuhuhuhuhuhuhu |
| Version | 0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account