Malicious
dc16ed5b1c1cbbaf35179701b1f4035e
PE Executable
MD5: dc16ed5b1c1cbbaf35179701b1f4035e
Size: 3.3 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Encoded VBScript file
Size
3.3 MB · 3,301,888 B
First seen
2025-08-23 08:01 · one year ago
Last seen
2025-08-23 08:01 · one year ago
Last analysis
2025-08-23 08:03 · one year ago
Hashes
MD5
dc16ed5b1c1cbbaf35179701b1f4035e
Sha1
ec8e01c61fcea9d0560b31786e7eef37a0409fe3
Sha256
dd71110a6b7fb79b2949280611957646f76503f1bda866b06e74b9a74e54dc89
Sha384
ec742d6943746c549882a13d0e808c0122389b21a0559686fe4b8eefcd6c21c188568864274b03e69c0bb8aeeca0f9f2
Sha512
a4e3307131ebd98673f78aaba161a1de32fd835130cfe31cb73b39d67989c82b8c3a0f95d91e53d9e0e2705df2e5ba15d3904fa6471aa3f8ea94b63a84244a52
SSDeep
49152:QbA3j+MlTnnoIVuE8RjdEOR4IE0ZrmQrpbOx+jSHcZuHanlFeub8WqW:Qb32noKQfZrHVbfub6nloi8D
TLSH
90E5BF017F458D01E5191B37C2AB4500BBBB9C411AA2FF1BB9A977AD192D3D36C18ECB
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ 7.0 - 8.0Microsoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET
Symbol obfuscation
Very low
7 malicious · 53 files
EXEdc16ed5b1c1cbbaf35179701b1f4035enjRat
Structure
BINResources
BINRT_ICON
BINID:0002
BINID:0
BINID:0003
BINID:0
BINID:0004
BINID:0
BINID:0005
BINID:0
BINID:0006
BINID:0
BINID:0007
BINID:0
BINID:0008
BINID:0
BINID:0009
BINID:0
BINID:000A
IMGID:0
IMGID:0-preview.png
BINRT_GROUP_CURSOR4
BINID:7F00
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
VBSdc16ed5b1c1cbbaf35179701b1f4035e.decoded.vbs
BIN.Net Resources
VBSpayload.Resources.resourcesXWorm
EXE_1
Structure
VBSOverlay_470db1ab.bin
BATbvElR9l3e6M3DQU5UdF6aCm2nAId.bat
EXEmsblockinto.exe
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
BIN.Net Resources
BINmBW3kdM0SlgTNfrti4.7qrEQ39HaUTCJTB8nS
BINybZv9vuBxOQ1YcVX6H.g5pmcghBmAo2PWEKlF
VBS9uzsvDMU6rzTiSa2KoESj40IXyhi3x.vbe
BINResources
BINPNG
BINID:0065
IMGID:1033
IMGID:1033-preview.png
BINID:0066
IMGID:1033
IMGID:1033-preview.png
BINRT_ICON
BINID:0001
BINID:1033
BINID:0002
BINID:1033
BINID:0003
BINID:1033
BINID:0004
BINID:1033
BINID:0005
BINID:1033
BINID:0006
BINID:1033
BINID:0007
IMGID:1033
IMGID:1033-preview.png
BINRT_DIALOG
BINID:0000
BINID:1033
BINRT_STRING
BINID:0007
BINID:1033
BINID:0008
BINID:1033
BINID:0009
BINID:1033
BINID:000A
BINID:1033
BINID:000B
BINID:1033
BINID:000C
BINID:1033
BINID:000D
BINID:1033
BINID:000E
BINID:1033
BINID:000F
BINID:1033
BINID:0010
BINID:1033
BINRT_GROUP_CURSOR4
BINID:0064
BINID:1033
BINRT_MANIFEST
BINID:0001
BINID:1033
EXE_2XWorm
Structure
BINResources
BINRT_GROUP_CURSOR4
BINID:0001
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
| Config. Field | Value |
|---|---|
| Mutex | Rx6I6huhuhuhuhuhuhu |
| Hosts | tcp.chuhuhuhuhuhuhu |
| Port | 5huhuhuhu |
| KEY | <wahuhuhuhu |
| USBNM | <Xwhuhuhuhu |
| LoggerPath | %Phuhuhuhu |
| family | xhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| Info | PDB Path: C:\Users\Professor\Desktop\BitJoiner\payload\obj\Debug\payload.pdb |
| Module Name | payload.exe |
| Full Name | payload.exe |
| EntryPoint | System.Void payload.Main::Main() |
| Scope Name | payload.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v4.0.30319 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | payload |
| Assembly Version | 0.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | .NETFramework,Version=v4.7.2 |
| Total Strings | 6 |
| Main Method | System.Void payload.Main::Main() |
| Main IL Instruction Count | 189 |
| Main IL | |
| Module Name | payload.exe |
| Full Name | payload.exe |
| EntryPoint | System.Void payload.Main::Main() |
| Scope Name | payload.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v4.0.30319 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | payload |
| Assembly Version | 0.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | .NETFramework,Version=v4.7.2 |
| Total Strings | 6 |
| Main Method | System.Void payload.Main::Main() |
| Main IL Instruction Count | 189 |
| Main IL | |
Mutex
MUTEXmalicious
Rx6I6huhuhuhuhuhuhu
CnC
CNCmalicious
tcp.chuhuhuhuhuhuhu
Port
PORTmalicious
5huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential7 malicious · 53 files
EXEdc16ed5b1c1cbbaf35179701b1f4035enjRat
Structure
BINResources
VBSdc16ed5b1c1cbbaf35179701b1f4035e.decoded.vbs
BIN.Net Resources
VBSpayload.Resources.resourcesXWorm
EXE_1
Structure
VBSOverlay_470db1ab.bin
BATbvElR9l3e6M3DQU5UdF6aCm2nAId.bat
EXEmsblockinto.exe
Structure
BINResources
BIN.Net Resources
VBS9uzsvDMU6rzTiSa2KoESj40IXyhi3x.vbe
BINResources
EXE_2XWorm
Structure
BINResources
| Config. Field | Value |
|---|---|
| Mutex | Rx6I6huhuhuhuhuhuhu |
| Hosts | tcp.chuhuhuhuhuhuhu |
| Port | 5huhuhuhu |
| KEY | <wahuhuhuhu |
| USBNM | <Xwhuhuhuhu |
| LoggerPath | %Phuhuhuhu |
| family | xhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialMutex
MUTEXmalicious
Rx6I6huhuhuhuhuhuhu
dc16ed5b1c1cbbaf35179701b1f4035e › .Net Resources › payload.Resources.resources › _2
CnC
CNCmalicious
tcp.chuhuhuhuhuhuhu
dc16ed5b1c1cbbaf35179701b1f4035e › .Net Resources › payload.Resources.resources › _2
Port
PORTmalicious
5huhuhuhu
dc16ed5b1c1cbbaf35179701b1f4035e › .Net Resources › payload.Resources.resources › _2
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account