Malicious
Malicious

b28942080b8a748312a3fe374916ad79

PE Executable
MD5: b28942080b8a748312a3fe374916ad79
Size: 328.7 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
328.7 KB · 328,704 B
First seen
2026-10-19 08:16 · 6 days ago
Last seen
2026-10-19 08:16 · 6 days ago
Last analysis
2026-10-19 16:18 · 6 days ago
Hashes
MD5 b28942080b8a748312a3fe374916ad79 Sha1 fbd0bd60739a79944400feba0693747c908a4540 Sha256 f87d5715903295e50a1c3d370d4fdc30be5128907dd660a3c3d96cde95fec7cd Sha384 5dea265a57c0b26f59ba941c960707300bb481f8755b89eb9c5c43d6174b1acc4905361255593d3cac8acb7239c8b87f Sha512 8dbd6f90edd978431c5eb609d34f8817c2277bba912eedbdc39e92c2282bb958ca1441d0a9917fc1cf4099b7e58dc9bf52ef96e842461c5c50ac1d05781fa051 SSDeep 6144:CcDFqBUKlfP/vVUuQjrWMGNrcOzQGXFL:CcEBUKZNzQTGRcY31 TLSH 04649D1877EC9A01C27A4379E9B1C37057B4EC562A52D31B1BC4ECDB3E36B815E80A76
Detection
PeID
Microsoft Visual C++ DLLMicrosoft Visual C++ v6.0
Symbol obfuscation
Low
1 malicious · 12 files
EXEb28942080b8a748312a3fe374916ad79RECORDSTEALER
Structure
BIN.Net Resources
TXTdll_b64.txt
BINResources
BINRT_ICON
BINID:0001
IMGID:0
IMGID:0-preview.png
BINID:0002
BINID:0
BINID:0003
BINID:0
BINID:0004
BINID:0
BINID:0005
BINID:0
BINID:0006
BINID:0
BINRT_GROUP_CURSOR4
BINID:7F00
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
3 / 3
Path pe:exe>pe:rsrc>img
Shape pe:exe>pe:rsrc>img
malicious 3 nodes
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Config. Field Value
[Configuration Module Name] Arghuhuhuhu
[Configuration Module Full Name] Arghuhuhuhu
IP 127.huhuhuhuhuhuhu
ID dehuhuhuhu
Message
Key
PublicKeyXml
Version 0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
[Configuration Module Name] Arghuhuhuhu
[Configuration Module Full Name] Arghuhuhuhu
Key
PublicKeyXml
Version 0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
RuntimeHost.exe
Full Name
RuntimeHost.exe
EntryPoint
System.Void Program::Main()
Scope Name
RuntimeHost.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
RuntimeHost
Assembly Version
10.0.22432.373
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6.2
Total Strings
380
Main Method
System.Void Program::Main()
Main IL Instruction Count
11
Main IL 
nop <null>
nop <null>
call System.Void Program2::WriteLine()
nop <null>
nop <null>
leave.s IL_0010: ret
pop <null>
nop <null>
nop <null>
leave.s IL_0010: ret
ret <null>
1 malicious · 12 files
EXEb28942080b8a748312a3fe374916ad79RECORDSTEALER
Structure
Config. Field Value
[Configuration Module Name] Arghuhuhuhu
[Configuration Module Full Name] Arghuhuhuhu
IP 127.huhuhuhuhuhuhu
ID dehuhuhuhu
Message
Key
PublicKeyXml
Version 0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
[Configuration Module Name] Arghuhuhuhu
[Configuration Module Full Name] Arghuhuhuhu
Key
PublicKeyXml
Version 0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙