Malicious
a1ddfd2f904651fa9ba5dc86e1609383
PE Executable
MD5: a1ddfd2f904651fa9ba5dc86e1609383
Size: 37.89 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Size
37.89 KB · 37,888 B
First seen
2026-06-30 04:46 · 3 months ago
Last seen
2026-06-30 04:46 · 3 months ago
Last analysis
2026-06-30 19:01 · 3 months ago
Hashes
MD5
a1ddfd2f904651fa9ba5dc86e1609383
Sha1
a082d9a52424f4e7411b7d3abf025de06f0a9121
Sha256
905904c9eba8a60eb560d1d48c62be917ce9c64072a2727cbd6340e438db1cb0
Sha384
ae3bec190087273a59a42e2b65e78e14b0b1dd35d71da1833fd985abe15dea2b4af3ee63a16e2251c3b9875f612935c7
Sha512
eb2a0ef90bce4c6eda854eb2623d19d3364e503887e114d8f81efa4d79fb5ec56a18afc7d26361e4cd31f3d9d24e2706c967b8ff63a2902146c26f7385d7e66d
SSDeep
384:taDvkit2Zf5W9cTYXyc/lPM20zHFmnPushrAF+rMRTyN/0L+EcoinblneHQM3epM:8DqjjTYic/lkEPusrM+rMRa8NuSpt
TLSH
BC032A4D7FE18168C5FD0A7B05B2D41207BAE04B6E23D90E8EF5649A37636C58F50AF2
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Low
1 malicious · 2 files
EXEa1ddfd2f904651fa9ba5dc86e1609383njRat
Structure
BINResources
BINRT_MANIFEST
BINID:0001
BINID:0
| Config. Field | Value |
|---|---|
| packet_size [b] | 5huhuhuhu |
| BD [BD] | Fhuhuhuhu |
| directory [DR] | Thuhuhuhu |
| executable_name [EXE] | serhuhuhuhu |
| cnc_host [HH] | 155.1huhuhuhuhuhuhu |
| is_dir_defined [Idr] | Fhuhuhuhu |
| is_startup_folder [IsF] | Fhuhuhuhu |
| is_user_reg [Isu] | Fhuhuhuhu |
| NH [NH] | 0huhuhuhu |
| cnc_port [P] | 2huhuhuhu |
| reg_key [RG] | 7f17b6huhuhuhuhuhuhuhuhuhuhu |
| reg_path [sf] | Softwahuhuhuhuhuhuhuhuhuhuhu |
| sizk | 2huhuhuhu |
| victim_name [VN] | Hahuhuhuhu |
| version [VR] | ihuhuhuhu |
| splitter [Y] | |huhuhuhu |
| HD | Fhuhuhuhu |
| anti [anti] | Exsahuhuhuhu |
| anti2 [anti2] | Fhuhuhuhu |
| usb [usb] | Fhuhuhuhu |
| usbx [usbx] | svchuhuhuhu |
| task [task] | Fhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| Module Name | w.exe |
| Full Name | w.exe |
| EntryPoint | System.Void w.A::main() |
| Scope Name | w.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v2.0.50727 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | w |
| Assembly Version | 0.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | <null> |
| Total Strings | 338 |
| Main Method | System.Void w.A::main() |
| Main IL Instruction Count | 5 |
| Main IL | |
| Module Name | w.exe |
| Full Name | w.exe |
| EntryPoint | System.Void w.A::main() |
| Scope Name | w.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v2.0.50727 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | w |
| Assembly Version | 0.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | <null> |
| Total Strings | 338 |
| Main Method | System.Void w.A::main() |
| Main IL Instruction Count | 5 |
| Main IL | |
Port
PORTmalicious
2huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential1 malicious · 2 files
EXEa1ddfd2f904651fa9ba5dc86e1609383njRat
Structure
BINResources
| Config. Field | Value |
|---|---|
| packet_size [b] | 5huhuhuhu |
| BD [BD] | Fhuhuhuhu |
| directory [DR] | Thuhuhuhu |
| executable_name [EXE] | serhuhuhuhu |
| cnc_host [HH] | 155.1huhuhuhuhuhuhu |
| is_dir_defined [Idr] | Fhuhuhuhu |
| is_startup_folder [IsF] | Fhuhuhuhu |
| is_user_reg [Isu] | Fhuhuhuhu |
| NH [NH] | 0huhuhuhu |
| cnc_port [P] | 2huhuhuhu |
| reg_key [RG] | 7f17b6huhuhuhuhuhuhuhuhuhuhu |
| reg_path [sf] | Softwahuhuhuhuhuhuhuhuhuhuhu |
| sizk | 2huhuhuhu |
| victim_name [VN] | Hahuhuhuhu |
| version [VR] | ihuhuhuhu |
| splitter [Y] | |huhuhuhu |
| HD | Fhuhuhuhu |
| anti [anti] | Exsahuhuhuhu |
| anti2 [anti2] | Fhuhuhuhu |
| usb [usb] | Fhuhuhuhu |
| usbx [usbx] | svchuhuhuhu |
| task [task] | Fhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialPort
PORTmalicious
2huhuhuhu
a1ddfd2f904651fa9ba5dc86e1609383
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account