Malicious
Malicious

c61337c8ddc16d4c2d5cbb35bb1211cf

PE Executable
MD5: c61337c8ddc16d4c2d5cbb35bb1211cf
Size: 50.18 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
50.18 KB · 50,176 B
First seen
2026-10-05 07:15 · 20 days ago
Last seen
2026-10-05 07:15 · 20 days ago
Last analysis
2026-10-05 07:15 · 20 days ago
Hashes
MD5 c61337c8ddc16d4c2d5cbb35bb1211cf Sha1 036f1d11d4b3af6c3086ae47560af100e0e34f37 Sha256 47ec550416d5740d5593508bd7088f26f1e7053cecd10851c2f15fb38e3fbd6d Sha384 76fd9a93eb5abfc76c8133e2d2732a141c53280cabcfee8f3f5350e376a4ace5ae893cf36e6e81aee04267f5f66ad1a3 Sha512 f56cd2e5b3ee1bcdaf68adf885cd33c07db2a6cba132b44fe082d72df3e34bd2e6367f985821253fc070afb4909230782135e77561dfd38366da702cedca8f8d SSDeep 768:NozqM7wdcb64GBklNDQ0piTYlCx0ZuTtN0bBTmHL8XrTIh/YFIvClZU2tYcFmVcl:NozqME+08g10JbBi8rTIgrUKmVcl TLSH AF333B103BE9812BE2BE4B786DF21641867BF1673603D94A3CC841D75B13BC696429FE
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
1 malicious · 3 files
EXEc61337c8ddc16d4c2d5cbb35bb1211cfAsyncRAT
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Config. Field Value
Key (AES_256) WFZWUGhuhuhuhuhuhuhuhuhuhuhu
Pastebin -huhuhuhu
Certificate MIIE8jhuhuhuhuhuhuhuhuhuhuhu
ServerSignature kNyXG+huhuhuhuhuhuhuhuhuhuhu
Install thuhuhuhu
BDOS thuhuhuhu
Anti-VM thuhuhuhu
Install File mkhuhuhuhu
Install-Folder %Aphuhuhuhu
Version 0.huhuhuhu
Hosts knhuhuhuhu
Ports 4huhuhuhu
Mutex fgygzhuhuhuhuhuhuhu
Delay 1huhuhuhu
Group knhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
mKdlXCxbzUwgQzO
Full Name
mKdlXCxbzUwgQzO
EntryPoint
System.Void ViEdMbLuTl.rRWehRWSzOKL::Main()
Scope Name
mKdlXCxbzUwgQzO
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
crackexe
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
121
Main Method
System.Void ViEdMbLuTl.rRWehRWSzOKL::Main()
Main IL Instruction Count
50
Main IL 
ldc.i4.0 <null>
stloc.0 <null>
br IL_0015: ldloc.0
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
ldc.i4.1 <null>
add <null>
stloc.0 <null>
ldloc.0 <null>
ldsfld System.String ViEdMbLuTl.fltkJzfDMEfbq::zxAnIGyjoCvxQFy
call System.Int32 System.Convert::ToInt32(System.String)
blt.s IL_0007: ldc.i4 1000
call System.Boolean ViEdMbLuTl.fltkJzfDMEfbq::qcoGvudxEUvgv()
brtrue IL_0032: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Boolean bGaKtCeCbxwo.XwWOUxgFFrfGCfN::nQLHacPysmtmfbL()
brtrue IL_0043: ldsfld System.String ViEdMbLuTl.fltkJzfDMEfbq::muEwEOGDuot
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String ViEdMbLuTl.fltkJzfDMEfbq::muEwEOGDuot
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_0057: ldsfld System.String ViEdMbLuTl.fltkJzfDMEfbq::ccgcrbsFiNjy
call System.Void bGaKtCeCbxwo.qBbUZaLhdSmFPUv::dnTCmDtNEnvj()
ldsfld System.String ViEdMbLuTl.fltkJzfDMEfbq::ccgcrbsFiNjy
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_006B: ldsfld System.String ViEdMbLuTl.fltkJzfDMEfbq::WlDgLyfHTQG
call System.Void hSnGtgXaSZNiG.rAibaxVelIPXgTZv::SNgALWxaCYFbo()
ldsfld System.String ViEdMbLuTl.fltkJzfDMEfbq::WlDgLyfHTQG
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_0089: call System.Void bGaKtCeCbxwo.cfHEkLQgNxx::ZeNqsDBtzc()
call System.Boolean bGaKtCeCbxwo.cfHEkLQgNxx::DlJZdqZMGlPtBTGI()
brfalse IL_0089: call System.Void bGaKtCeCbxwo.cfHEkLQgNxx::ZeNqsDBtzc()
call System.Void bGaKtCeCbxwo.dqdjAlkITS::FDTdPnmPoaAgGaF()
call System.Void bGaKtCeCbxwo.cfHEkLQgNxx::ZeNqsDBtzc()
leave IL_0099: call System.Boolean OhpjYdRoDEzDJo.rpXYFyiCjiIYM::get_IsConnected()
pop <null>
leave IL_0099: call System.Boolean OhpjYdRoDEzDJo.rpXYFyiCjiIYM::get_IsConnected()
call System.Boolean OhpjYdRoDEzDJo.rpXYFyiCjiIYM::get_IsConnected()
brtrue IL_00AD: newobj System.Void System.Random::.ctor()
call System.Void OhpjYdRoDEzDJo.rpXYFyiCjiIYM::hthoQZwDxtxu()
call System.Void OhpjYdRoDEzDJo.rpXYFyiCjiIYM::aeYbSlXJVyxQmPfko()
newobj System.Void System.Random::.ctor()
ldc.i4 2000
ldc.i4 5000
callvirt System.Int32 System.Random::Next(System.Int32,System.Int32)
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_0099: call System.Boolean OhpjYdRoDEzDJo.rpXYFyiCjiIYM::get_IsConnected()
Module Name
mKdlXCxbzUwgQzO
Full Name
mKdlXCxbzUwgQzO
EntryPoint
System.Void ViEdMbLuTl.rRWehRWSzOKL::Main()
Scope Name
mKdlXCxbzUwgQzO
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
crackexe
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
121
Main Method
System.Void ViEdMbLuTl.rRWehRWSzOKL::Main()
Main IL Instruction Count
50
Main IL 
ldc.i4.0 <null>
stloc.0 <null>
br IL_0015: ldloc.0
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
ldc.i4.1 <null>
add <null>
stloc.0 <null>
ldloc.0 <null>
ldsfld System.String ViEdMbLuTl.fltkJzfDMEfbq::zxAnIGyjoCvxQFy
call System.Int32 System.Convert::ToInt32(System.String)
blt.s IL_0007: ldc.i4 1000
call System.Boolean ViEdMbLuTl.fltkJzfDMEfbq::qcoGvudxEUvgv()
brtrue IL_0032: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Boolean bGaKtCeCbxwo.XwWOUxgFFrfGCfN::nQLHacPysmtmfbL()
brtrue IL_0043: ldsfld System.String ViEdMbLuTl.fltkJzfDMEfbq::muEwEOGDuot
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String ViEdMbLuTl.fltkJzfDMEfbq::muEwEOGDuot
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_0057: ldsfld System.String ViEdMbLuTl.fltkJzfDMEfbq::ccgcrbsFiNjy
call System.Void bGaKtCeCbxwo.qBbUZaLhdSmFPUv::dnTCmDtNEnvj()
ldsfld System.String ViEdMbLuTl.fltkJzfDMEfbq::ccgcrbsFiNjy
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_006B: ldsfld System.String ViEdMbLuTl.fltkJzfDMEfbq::WlDgLyfHTQG
call System.Void hSnGtgXaSZNiG.rAibaxVelIPXgTZv::SNgALWxaCYFbo()
ldsfld System.String ViEdMbLuTl.fltkJzfDMEfbq::WlDgLyfHTQG
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_0089: call System.Void bGaKtCeCbxwo.cfHEkLQgNxx::ZeNqsDBtzc()
call System.Boolean bGaKtCeCbxwo.cfHEkLQgNxx::DlJZdqZMGlPtBTGI()
brfalse IL_0089: call System.Void bGaKtCeCbxwo.cfHEkLQgNxx::ZeNqsDBtzc()
call System.Void bGaKtCeCbxwo.dqdjAlkITS::FDTdPnmPoaAgGaF()
call System.Void bGaKtCeCbxwo.cfHEkLQgNxx::ZeNqsDBtzc()
leave IL_0099: call System.Boolean OhpjYdRoDEzDJo.rpXYFyiCjiIYM::get_IsConnected()
pop <null>
leave IL_0099: call System.Boolean OhpjYdRoDEzDJo.rpXYFyiCjiIYM::get_IsConnected()
call System.Boolean OhpjYdRoDEzDJo.rpXYFyiCjiIYM::get_IsConnected()
brtrue IL_00AD: newobj System.Void System.Random::.ctor()
call System.Void OhpjYdRoDEzDJo.rpXYFyiCjiIYM::hthoQZwDxtxu()
call System.Void OhpjYdRoDEzDJo.rpXYFyiCjiIYM::aeYbSlXJVyxQmPfko()
newobj System.Void System.Random::.ctor()
ldc.i4 2000
ldc.i4 5000
callvirt System.Int32 System.Random::Next(System.Int32,System.Int32)
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_0099: call System.Boolean OhpjYdRoDEzDJo.rpXYFyiCjiIYM::get_IsConnected()
Key (AES_256) MUTEXmalicious
WFZWUGhuhuhuhuhuhuhuhuhuhuhu
CnC CNCmalicious
knhuhuhuhu
Ports PORTmalicious
4huhuhuhu
Mutex MUTEXmalicious
fgygzhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
1 malicious · 3 files
EXEc61337c8ddc16d4c2d5cbb35bb1211cfAsyncRAT
Structure
Config. Field Value
Key (AES_256) WFZWUGhuhuhuhuhuhuhuhuhuhuhu
Pastebin -huhuhuhu
Certificate MIIE8jhuhuhuhuhuhuhuhuhuhuhu
ServerSignature kNyXG+huhuhuhuhuhuhuhuhuhuhu
Install thuhuhuhu
BDOS thuhuhuhu
Anti-VM thuhuhuhu
Install File mkhuhuhuhu
Install-Folder %Aphuhuhuhu
Version 0.huhuhuhu
Hosts knhuhuhuhu
Ports 4huhuhuhu
Mutex fgygzhuhuhuhuhuhuhu
Delay 1huhuhuhu
Group knhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Key (AES_256) MUTEXmalicious
WFZWUGhuhuhuhuhuhuhuhuhuhuhu
c61337c8ddc16d4c2d5cbb35bb1211cf
CnC CNCmalicious
knhuhuhuhu
c61337c8ddc16d4c2d5cbb35bb1211cf
Ports PORTmalicious
4huhuhuhu
c61337c8ddc16d4c2d5cbb35bb1211cf
Mutex MUTEXmalicious
fgygzhuhuhuhuhuhuhu
c61337c8ddc16d4c2d5cbb35bb1211cf
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙