Malicious
Malicious

da7e22da776e4f3f24f670935ca3ef57

Share on LinkedIn
Print
PE Executable
MD5: da7e22da776e4f3f24f670935ca3ef57
Size: 745.48 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Size
745.48 KB · 745,484 B
First seen
2025-11-23 01:08 · 11 months ago
Last seen
2025-11-23 01:08 · 11 months ago
Last analysis
2025-11-23 01:08 · 11 months ago
Hashes
MD5 da7e22da776e4f3f24f670935ca3ef57 Sha1 10f269e20fb8232b3bb017321b4171f84a7cd87c Sha256 f28f734d52f94dff4471834a78b4ad226b35ad1174918be02450a5d64332d5f3 Sha384 57c2674b4ee5c3dd905a5f831f8a3130fa62f6c1eb68ae1cade84965d1bd456b2b4f6fb5e4689412873741303b8635ce Sha512 509a0fb2df5583ec78e196e8254d006afdc5ea3a770d857d9d44eb5a214844742b0cc3d5fb22e98efff86b8796411ad431d5eb538c5b81a4ff916eab52d858dc SSDeep 12288:lzpkDt2h7klIJsRn7uVqqZl1/+LnMYZqoLUsBIw/dnNjgQJL1IW8CP0bw/oIO5w:lzpkDtooduVqqZl1/+LnMYZqoLUsBIwR TLSH 8EF47B5433ECE65BD1BE1776E4B0082907F6F807A666EB5F4A40B1FA2C63B414D817A3
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET
Symbol obfuscation
Medium
2 malicious · 8 files
EXEda7e22da776e4f3f24f670935ca3ef57AsyncRAT
EXE[Rebuild from dump]_a8fa43aa.exeAsyncRAT
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key D7BB24huhuhuhuhuhuhuhuhuhuhu
Version 1huhuhuhu
Port 4huhuhuhu
Host 195.huhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
SubDirectory Suhuhuhuhu
InstallName Clihuhuhuhu
Install 0huhuhuhu
Startup 0huhuhuhu
Mutex 31ae09huhuhuhuhuhuhuhuhuhuhu
StartupKey Quhuhuhuhu
HideFile 0huhuhuhu
EnableLogger 1huhuhuhu
Tag syhuhuhuhu
LogDirectory Lhuhuhuhu
ServerSignature ynQXwThuhuhuhuhuhuhuhuhuhuhu
ServerCertificate MIIFEzhuhuhuhuhuhuhuhuhuhuhu
HideLogDirectory 0huhuhuhu
HideLogSubdirectory 0huhuhuhu
UnattendedMod 1huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Key (AES_256) -huhuhuhu
Pastebin -huhuhuhu
ServerSignature cCs1zXhuhuhuhuhuhuhuhuhuhuhu
Install File Sbihuhuhuhu
Mutex cmdvhuhuhuhu
Group cmdvhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client
Full Name
Client
EntryPoint
System.Void qdjvzbqzocubareimzuv.震솄臘竆药댾䧍䕦�娿苖Ꮚ꿊囤肤窷ྵꫪ::Main(System.String[])
Scope Name
Client
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.4.1.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
1957
Main Method
System.Void qdjvzbqzocubareimzuv.震솄臘竆药댾䧍䕦�娿苖Ꮚ꿊囤肤窷ྵꫪ::Main(System.String[])
Main IL Instruction Count
20
Main IL 
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
ldnull <null>
ldftn System.Void qdjvzbqzocubareimzuv.震솄臘竆药댾䧍䕦�娿苖Ꮚ꿊囤肤窷ྵꫪ::鐀ࢪ꽐槫�Ꭵ쀌踚씹㝎쳚揝ꐎ衆≽ᩔ訝�(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void qdjvzbqzocubareimzuv.震솄臘竆药댾䧍䕦�娿苖Ꮚ꿊囤肤窷ྵꫪ::뼞㠹꺦ऄ⋴渭⚁䃇壟쐍ꎽ㗂뒿�꣞️⌋尅ᨖ(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.Void qdjvzbqzocubareimzuv.震솄臘竆药댾䧍䕦�娿苖Ꮚ꿊囤肤窷ྵꫪ::说랦㙧좶堫寬膏痮厤蔸䫒䂎蜐苼綟緓擖()
newobj System.Void qdjvzbqzocubareimzuv.벨踰坂妎⼢㇨짷笿㙟⏍﬑⚻뗿ꏕ问葈踱⳷䴶::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
Module Name
Client
Full Name
Client
EntryPoint
System.Void qdjvzbqzocubareimzuv.震솄臘竆药댾䧍䕦�娿苖Ꮚ꿊囤肤窷ྵꫪ::Main(System.String[])
Scope Name
Client
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.4.1.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
1957
Main Method
System.Void qdjvzbqzocubareimzuv.震솄臘竆药댾䧍䕦�娿苖Ꮚ꿊囤肤窷ྵꫪ::Main(System.String[])
Main IL Instruction Count
20
Main IL 
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
ldnull <null>
ldftn System.Void qdjvzbqzocubareimzuv.震솄臘竆药댾䧍䕦�娿苖Ꮚ꿊囤肤窷ྵꫪ::鐀ࢪ꽐槫�Ꭵ쀌踚씹㝎쳚揝ꐎ衆≽ᩔ訝�(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void qdjvzbqzocubareimzuv.震솄臘竆药댾䧍䕦�娿苖Ꮚ꿊囤肤窷ྵꫪ::뼞㠹꺦ऄ⋴渭⚁䃇壟쐍ꎽ㗂뒿�꣞️⌋尅ᨖ(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.Void qdjvzbqzocubareimzuv.震솄臘竆药댾䧍䕦�娿苖Ꮚ꿊囤肤窷ྵꫪ::说랦㙧좶堫寬膏痮厤蔸䫒䂎蜐苼綟緓擖()
newobj System.Void qdjvzbqzocubareimzuv.벨踰坂妎⼢㇨짷笿㙟⏍﬑⚻뗿ꏕ问葈踱⳷䴶::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
CnC CNCmalicious
195.huhuhuhuhuhuhu
Port PORTmalicious
4huhuhuhu
Key (AES_256) MUTEXmalicious
-huhuhuhu
Mutex MUTEXmalicious
cmdvhuhuhuhu
PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙