Malicious
Malicious

8e443090226ff1c96097f8f7d3244a16

PE Executable
MD5: 8e443090226ff1c96097f8f7d3244a16
Size: 56.83 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
56.83 KB · 56,832 B
First seen
2026-09-06 14:45 · one month ago
Last seen
2026-09-06 14:45 · one month ago
Last analysis
2026-09-06 14:45 · one month ago
Hashes
MD5 8e443090226ff1c96097f8f7d3244a16 Sha1 d28c82edea3da8e598f8955950ea8bf46e6aaa8b Sha256 bf4971bdab54fabdda136b5f03b93476256bbd6d35fe6e7947961b3d6a20aa48 Sha384 e62ec016fa436932e76d676e3af6d2bb58cbf17738fccbc80af78c67f3531f7df4ad54d40e6ef2c3654fb4c4e8df3c09 Sha512 c8412de8534c4c9dc3d4811a9e631fc04eae3251cedea17ad3be70031b0b29dd92d81f393a997b6fab354b3eff6f1f10d7e559e87906f54e16ec79de96b00ea7 SSDeep 1536:pDjzbxoVZi8rvDoOqwldtsQUbcHdeKvckr7pPx:pz+7oOltZUbc9eKv/7hx TLSH BC431B1037E88127F1BE5F7999F26141877AF6236913DA8E2C8411CB1623BC59D427EF
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Low
1 malicious · 3 files
EXE8e443090226ff1c96097f8f7d3244a16AsyncRAT
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Config. Field Value
Key (AES_256) SkRiUkhuhuhuhuhuhuhuhuhuhuhu
Pastebin -huhuhuhu
Certificate MIIE8jhuhuhuhuhuhuhuhuhuhuhu
ServerSignature nmqg/hhuhuhuhuhuhuhuhuhuhuhu
Install thuhuhuhu
BDOS fhuhuhuhu
Anti-VM fhuhuhuhu
Install File tele@ehuhuhuhuhuhuhu
Install-Folder %Aphuhuhuhu
Hosts 688vbehuhuhuhuhuhuhu
Ports 44huhuhuhu
Mutex yXejhuhuhuhu
Version 0huhuhuhu
Delay 3huhuhuhu
Group Dehuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Telegram.exe
Full Name
Telegram.exe
EntryPoint
System.Void Client.Program::Main()
Scope Name
Telegram.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Telegram
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
227
Main Method
System.Void Client.Program::Main()
Main IL Instruction Count
64
Main IL 
ldc.i4.0 <null>
stloc.0 <null>
ldsfld System.String Client.Settings::Delay
ldloca.s V_0
call System.Boolean System.Int32::TryParse(System.String,System.Int32&)
brtrue IL_0015: ldc.i4.0
ldc.i4.0 <null>
stloc.0 <null>
ldc.i4.0 <null>
stloc.1 <null>
br IL_002A: ldloc.1
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.1 <null>
ldc.i4.1 <null>
add <null>
stloc.1 <null>
ldloc.1 <null>
ldloc.0 <null>
blt.s IL_001C: ldc.i4 1000
leave IL_0039: call System.Boolean Client.Settings::InitializeSettings()
pop <null>
leave IL_0039: call System.Boolean Client.Settings::InitializeSettings()
call System.Boolean Client.Settings::InitializeSettings()
brtrue IL_0053: call System.Threading.Tasks.Task Client.Program::SendRequests()
ldstr Settings initialization failed. Exiting.
call System.Void System.Console::WriteLine(System.String)
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Threading.Tasks.Task Client.Program::SendRequests()
pop <null>
call System.Boolean Client.Helper.MutexControl::CreateMutex()
brtrue IL_0069: ldsfld System.String Client.Settings::Anti
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String Client.Settings::Anti
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_007D: ldsfld System.String Client.Settings::Install
call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis()
ldsfld System.String Client.Settings::Install
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_0091: ldsfld System.String Client.Settings::BDOS
call System.Void Client.Install.NormalStartup::Install()
ldsfld System.String Client.Settings::BDOS
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_00AF: call System.Void Client.Helper.Methods::PreventSleep()
call System.Boolean Client.Helper.Methods::IsAdmin()
brfalse IL_00AF: call System.Void Client.Helper.Methods::PreventSleep()
call System.Void Client.Helper.ProcessCritical::Set()
call System.Void Client.Helper.Methods::PreventSleep()
leave IL_00BF: nop
pop <null>
leave IL_00BF: nop
nop <null>
call System.Boolean Client.Connection.ClientSocket::get_IsConnected()
brtrue IL_00D4: leave IL_00DF
call System.Void Client.Connection.ClientSocket::Reconnect()
call System.Void Client.Connection.ClientSocket::InitializeClient()
leave IL_00DF: ldc.i4 5000
pop <null>
leave IL_00DF: ldc.i4 5000
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_00BF: nop
Module Name
Telegram.exe
Full Name
Telegram.exe
EntryPoint
System.Void Client.Program::Main()
Scope Name
Telegram.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Telegram
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
227
Main Method
System.Void Client.Program::Main()
Main IL Instruction Count
64
Main IL 
ldc.i4.0 <null>
stloc.0 <null>
ldsfld System.String Client.Settings::Delay
ldloca.s V_0
call System.Boolean System.Int32::TryParse(System.String,System.Int32&)
brtrue IL_0015: ldc.i4.0
ldc.i4.0 <null>
stloc.0 <null>
ldc.i4.0 <null>
stloc.1 <null>
br IL_002A: ldloc.1
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.1 <null>
ldc.i4.1 <null>
add <null>
stloc.1 <null>
ldloc.1 <null>
ldloc.0 <null>
blt.s IL_001C: ldc.i4 1000
leave IL_0039: call System.Boolean Client.Settings::InitializeSettings()
pop <null>
leave IL_0039: call System.Boolean Client.Settings::InitializeSettings()
call System.Boolean Client.Settings::InitializeSettings()
brtrue IL_0053: call System.Threading.Tasks.Task Client.Program::SendRequests()
ldstr Settings initialization failed. Exiting.
call System.Void System.Console::WriteLine(System.String)
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Threading.Tasks.Task Client.Program::SendRequests()
pop <null>
call System.Boolean Client.Helper.MutexControl::CreateMutex()
brtrue IL_0069: ldsfld System.String Client.Settings::Anti
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String Client.Settings::Anti
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_007D: ldsfld System.String Client.Settings::Install
call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis()
ldsfld System.String Client.Settings::Install
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_0091: ldsfld System.String Client.Settings::BDOS
call System.Void Client.Install.NormalStartup::Install()
ldsfld System.String Client.Settings::BDOS
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_00AF: call System.Void Client.Helper.Methods::PreventSleep()
call System.Boolean Client.Helper.Methods::IsAdmin()
brfalse IL_00AF: call System.Void Client.Helper.Methods::PreventSleep()
call System.Void Client.Helper.ProcessCritical::Set()
call System.Void Client.Helper.Methods::PreventSleep()
leave IL_00BF: nop
pop <null>
leave IL_00BF: nop
nop <null>
call System.Boolean Client.Connection.ClientSocket::get_IsConnected()
brtrue IL_00D4: leave IL_00DF
call System.Void Client.Connection.ClientSocket::Reconnect()
call System.Void Client.Connection.ClientSocket::InitializeClient()
leave IL_00DF: ldc.i4 5000
pop <null>
leave IL_00DF: ldc.i4 5000
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_00BF: nop
Key (AES_256) MUTEXmalicious
SkRiUkhuhuhuhuhuhuhuhuhuhuhu
CnC CNCmalicious
688huhuhuhu
CnC CNCmalicious
c2.6huhuhuhuhuhuhu
Ports PORTmalicious
4huhuhuhu
Ports PORTmalicious
8huhuhuhu
Mutex MUTEXmalicious
yXejhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
1 malicious · 3 files
EXE8e443090226ff1c96097f8f7d3244a16AsyncRAT
Structure
Config. Field Value
Key (AES_256) SkRiUkhuhuhuhuhuhuhuhuhuhuhu
Pastebin -huhuhuhu
Certificate MIIE8jhuhuhuhuhuhuhuhuhuhuhu
ServerSignature nmqg/hhuhuhuhuhuhuhuhuhuhuhu
Install thuhuhuhu
BDOS fhuhuhuhu
Anti-VM fhuhuhuhu
Install File tele@ehuhuhuhuhuhuhu
Install-Folder %Aphuhuhuhu
Hosts 688vbehuhuhuhuhuhuhu
Ports 44huhuhuhu
Mutex yXejhuhuhuhu
Version 0huhuhuhu
Delay 3huhuhuhu
Group Dehuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Key (AES_256) MUTEXmalicious
SkRiUkhuhuhuhuhuhuhuhuhuhuhu
8e443090226ff1c96097f8f7d3244a16
CnC CNCmalicious
688huhuhuhu
8e443090226ff1c96097f8f7d3244a16
CnC CNCmalicious
c2.6huhuhuhuhuhuhu
8e443090226ff1c96097f8f7d3244a16
Ports PORTmalicious
4huhuhuhu
8e443090226ff1c96097f8f7d3244a16
Ports PORTmalicious
8huhuhuhu
8e443090226ff1c96097f8f7d3244a16
Mutex MUTEXmalicious
yXejhuhuhuhu
8e443090226ff1c96097f8f7d3244a16
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙