Malicious
dee3308c48a52fc15394c3e89221226d
PE Executable
MD5: dee3308c48a52fc15394c3e89221226d
Size: 24.06 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Size
24.06 KB · 24,064 B
First seen
2026-08-25 18:15 · 2 months ago
Last seen
2026-08-25 18:15 · 2 months ago
Last analysis
2026-08-25 18:15 · 2 months ago
Hashes
MD5
dee3308c48a52fc15394c3e89221226d
Sha1
b5a9f5007839560266d831d25d1db4429d07c9fc
Sha256
3e08292340a925412039c40af6eefec9a30fca1e60246baca93caf9f4bd3e53c
Sha384
d617831ef57fa1aa41c1e03e7bc871169f4a1af820642aac41e17f4ba100267b791839469c120ac20a576bd5f6843e0a
Sha512
e064f5694af65b7e34f13658d59cfcb901eb81b4f74834cc85a7fecc9c079f9506b485cb8df309609cd172e29ed78779b5c8fa646883ba0bdf43a5510bc604ad
SSDeep
384:78aSyS9gB3Y1KIay2X8cLZI6XgxsGJVPpmRvR6JZlbw8hqIusZzZ5O:w589tXvRpcnuX
TLSH
4BB22A4E3FA98856C5BC17748AA5965003B591470413EE3FCCC960CBAFB3ADA1D4CAF9
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Low
1 malicious · 2 files
EXEdee3308c48a52fc15394c3e89221226dnjRat
Structure
BINResources
BINRT_MANIFEST
BINID:0001
BINID:0
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe>pe:rsrc>bin
Shape
pe:exe>pe:rsrc>bin
malicious
3 nodes
| Config. Field | Value |
|---|---|
| victim_name [VN] | Hahuhuhuhu |
| version [VR] | 0huhuhuhu |
| executable_name [EXE] | serhuhuhuhu |
| directory [DR] | Thuhuhuhu |
| reg_key [RG] | 652fabhuhuhuhuhuhuhuhuhuhuhu |
| cnc_host [H] | subhanhuhuhuhuhuhuhu |
| cnc_port [P] | 1huhuhuhu |
| splitter [Y] | |huhuhuhu |
| BD [BD] | Thuhuhuhu |
| is_dir_defined [Idr] | Thuhuhuhu |
| is_startup_folder [IsF] | Fhuhuhuhu |
| is_user_reg [Isu] | Thuhuhuhu |
| reg_path [sf] | Softwahuhuhuhuhuhuhuhuhuhuhu |
| packet_size [b] | 5huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| Module Name | j.exe |
| Full Name | j.exe |
| EntryPoint | System.Void j.A::main() |
| Scope Name | j.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v2.0.50727 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | j |
| Assembly Version | 0.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | <null> |
| Total Strings | 214 |
| Main Method | System.Void j.A::main() |
| Main IL Instruction Count | 2 |
| Main IL | |
| Module Name | j.exe |
| Full Name | j.exe |
| EntryPoint | System.Void j.A::main() |
| Scope Name | j.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v2.0.50727 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | j |
| Assembly Version | 0.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | <null> |
| Total Strings | 214 |
| Main Method | System.Void j.A::main() |
| Main IL Instruction Count | 2 |
| Main IL | |
CnC
CNCmalicious
subhanhuhuhuhuhuhuhu
Port
PORTmalicious
1huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential1 malicious · 2 files
EXEdee3308c48a52fc15394c3e89221226dnjRat
Structure
BINResources
| Config. Field | Value |
|---|---|
| victim_name [VN] | Hahuhuhuhu |
| version [VR] | 0huhuhuhu |
| executable_name [EXE] | serhuhuhuhu |
| directory [DR] | Thuhuhuhu |
| reg_key [RG] | 652fabhuhuhuhuhuhuhuhuhuhuhu |
| cnc_host [H] | subhanhuhuhuhuhuhuhu |
| cnc_port [P] | 1huhuhuhu |
| splitter [Y] | |huhuhuhu |
| BD [BD] | Thuhuhuhu |
| is_dir_defined [Idr] | Thuhuhuhu |
| is_startup_folder [IsF] | Fhuhuhuhu |
| is_user_reg [Isu] | Thuhuhuhu |
| reg_path [sf] | Softwahuhuhuhuhuhuhuhuhuhuhu |
| packet_size [b] | 5huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialCnC
CNCmalicious
subhanhuhuhuhuhuhuhu
dee3308c48a52fc15394c3e89221226d
Port
PORTmalicious
1huhuhuhu
dee3308c48a52fc15394c3e89221226d
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account