Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
1.21 MB · 1,211,392 B
First seen
2026-07-14 03:16 · 3 months ago
Last seen
2026-07-14 03:16 · 3 months ago
Last analysis
2026-07-14 03:16 · 3 months ago
Hashes
MD5 df8e26f66145f175ecff2cef4ee76b01 Sha1 18d4c8b9aa9034fa358fb580713a5a7534176110 Sha256 7f1c566eee880bce9a3f80880badee548b53ab3aded225c654faeff9cf0349df Sha384 a7d41c0ce06afce86298dbf8c252575755f29f20dc459d58fa91b1edeeb558a04e7e84dd04eafb37e26ee8989bdd3a50 Sha512 54590e41d6a807c127c27a8818a208fd61b9adcfc95f97b31fe98d1345212b492e220c1dc674025e1017f85d6981e7e8c97c79d1f18f7d12620293078df0b57d SSDeep 12288:yF6htfT2CPpHAP/iGc1ZOM+FhWF2hekxpp4yy8G1R12Vg5CaCThajRlbrjV:f2UxAPqGcv/+Duyx4N0aYa95 TLSH 3D45F12549461635CA3D0A75C1D974A813F0FEF39266E71A2EE830FDCBB3794A9D7082
Detection
PeID
.NET executableHQR data fileMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
2 malicious · 66 files
EXEdf8e26f66145f175ecff2cef4ee76b01.NET Reflective Loader
Structure
BINResources
BINRT_ICON
BINID:0032
IMGID:0
IMGID:0-preview.png
BINID:0033
BINID:0
BINID:0034
BINID:0
BINID:0035
BINID:0
BINID:0036
BINID:0
BINID:0037
BINID:0
BINRT_GROUP_CURSOR4
BINID:0001
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
TIFFGenitalk.klaoxao.tiff
BIN8qqKQi.Resources.resources
BINc6564518ea51a1.Resources.resources
BINc0ba2a0f0
DATA[NBF]root.Data
BINc0ba2a0f1
DATA[NBF]root.Data
BINc0ba2a0f10
DATA[NBF]root.Data
BINc0ba2a0f11
DATA[NBF]root.Data
BINc0ba2a0f12
DATA[NBF]root.Data
BINc0ba2a0f13
DATA[NBF]root.Data
BINc0ba2a0f14
DATA[NBF]root.Data
BINc0ba2a0f15
DATA[NBF]root.Data
BINc0ba2a0f16
DATA[NBF]root.Data
BINc0ba2a0f17
DATA[NBF]root.Data
BINc0ba2a0f18
DATA[NBF]root.Data
BINc0ba2a0f19
DATA[NBF]root.Data
BINc0ba2a0f2
DATA[NBF]root.Data
BINc0ba2a0f20
DATA[NBF]root.Data
BINc0ba2a0f21
DATA[NBF]root.Data
BINc0ba2a0f22
DATA[NBF]root.Data
BINc0ba2a0f3
DATA[NBF]root.Data
BINc0ba2a0f4
DATA[NBF]root.Data
BINc0ba2a0f5
DATA[NBF]root.Data
BINc0ba2a0f6
DATA[NBF]root.Data
BINc0ba2a0f7
DATA[NBF]root.Data
BINc0ba2a0f8
DATA[NBF]root.Data
BINc0ba2a0f9
DATA[NBF]root.Data
BIN.Net Reflective Loader
EXEGenitalk.klaoxao.tiff [AES Decrypted]
Structure
BINOverlay_ddd3db78.bin
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
BINObjectRequester.ScopeObject
BINScheduledObject.ObjectParser
BINDecryptorCompressor.ControllableObject
BINAuditorMap.LocalObject
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
5 / 5
Path pe:exe>pe:dll>pe:rsrc>bin
Shape pe:exe>pe:dll>pe:rsrc>bin
malicious 4 nodes
Path pe:exe>pe:dll>bin
Shape pe:exe>pe:dll>bin
malicious 3 nodes
Name Value
Module Name
8qqKQi
Full Name
8qqKQi
EntryPoint
System.Void wc3BYfz17.Mn1an8T::Jra02TegXr8q()
Scope Name
8qqKQi
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
8qqKQi
Assembly Version
22.4.3.131
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void wc3BYfz17.Mn1an8T::Jra02TegXr8q()
Main IL Instruction Count
73
Main IL 
ldsfld System.Int32[] y_6E0Prnq2jKLq.iXf86okJicH0bQ::aJf4N1rgdq3Hy7
stloc.s V_5
ldc.i4.3 <null>
stloc.s V_4
ldloc.s V_4
switch dnlib.DotNet.Emit.Instruction[]
nop <null>
ldc.i4.s 25
ldc.i4.6 <null>
ldc.i4 2026
call System.DateTime Microsoft.VisualBasic.DateAndTime::DateSerial(System.Int32,System.Int32,System.Int32)
stloc.0 <null>
ldloca.s V_1
initobj Microsoft.VisualBasic.FirstDayOfWeek
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldloc.s V_5
ldc.i4.s 62
ldelem.i4 <null>
ldc.i4 52067
sub <null>
stloc.s V_4
br.s IL_000A: ldloc.s V_4
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
call System.Boolean wc3BYfz17.Mn1an8T::Nj5q0Bpc_6mM()
ldc.i4.0 <null>
ceq <null>
stloc.2 <null>
ldloc.2 <null>
brfalse.s IL_0075: ldc.i4.6
ldc.i4.0 <null>
stloc.s V_4
br.s IL_000A: ldloc.s V_4
ldc.i4.6 <null>
br.s IL_0071: stloc.s V_4
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
nop <null>
ldc.i4.6 <null>
stloc.s V_4
br.s IL_000A: ldloc.s V_4
nop <null>
call System.Void wc3BYfz17.Mn1an8T::kQe8Zq3()
nop <null>
nop <null>
ldc.i4 1501028818
ldc.i4.8 <null>
ldtoken Xay15iS.Kn2oz1S/oi7P8Wdcw.2opPx
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
call System.String Eis08Dqcj5T.Ls7py1xZ2Kwct9::4Xtzk9wA3eSy(System.Int32,System.Int32,System.Type)
nop <null>
ldc.i4.0 <null>
ldnull <null>
ldc.i4 1960383218
call System.String Emt91rPceg8.Kk7fbEm::2PmsQeb7fr1XNb(System.Int32,Emt91rPceg8.Kk7fbEm,System.Int32)
call System.Void wc3BYfz17.Mn1an8T::6kkCK2pq5(System.String,System.String)
ldc.i4.4 <null>
stloc.s V_4
br IL_000A: ldloc.s V_4
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
newobj System.Void wc3BYfz17.Mn1an8T::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
ldtoken System.Void wc3BYfz17.Mn1an8T::Jra02TegXr8q()
pop <null>
ret <null>
Module Name
8qqKQi
Full Name
8qqKQi
EntryPoint
System.Void wc3BYfz17.Mn1an8T::Jra02TegXr8q()
Scope Name
8qqKQi
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
8qqKQi
Assembly Version
22.4.3.131
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void wc3BYfz17.Mn1an8T::Jra02TegXr8q()
Main IL Instruction Count
73
Main IL 
ldsfld System.Int32[] y_6E0Prnq2jKLq.iXf86okJicH0bQ::aJf4N1rgdq3Hy7
stloc.s V_5
ldc.i4.3 <null>
stloc.s V_4
ldloc.s V_4
switch dnlib.DotNet.Emit.Instruction[]
nop <null>
ldc.i4.s 25
ldc.i4.6 <null>
ldc.i4 2026
call System.DateTime Microsoft.VisualBasic.DateAndTime::DateSerial(System.Int32,System.Int32,System.Int32)
stloc.0 <null>
ldloca.s V_1
initobj Microsoft.VisualBasic.FirstDayOfWeek
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldloc.s V_5
ldc.i4.s 62
ldelem.i4 <null>
ldc.i4 52067
sub <null>
stloc.s V_4
br.s IL_000A: ldloc.s V_4
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
call System.Boolean wc3BYfz17.Mn1an8T::Nj5q0Bpc_6mM()
ldc.i4.0 <null>
ceq <null>
stloc.2 <null>
ldloc.2 <null>
brfalse.s IL_0075: ldc.i4.6
ldc.i4.0 <null>
stloc.s V_4
br.s IL_000A: ldloc.s V_4
ldc.i4.6 <null>
br.s IL_0071: stloc.s V_4
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
nop <null>
ldc.i4.6 <null>
stloc.s V_4
br.s IL_000A: ldloc.s V_4
nop <null>
call System.Void wc3BYfz17.Mn1an8T::kQe8Zq3()
nop <null>
nop <null>
ldc.i4 1501028818
ldc.i4.8 <null>
ldtoken Xay15iS.Kn2oz1S/oi7P8Wdcw.2opPx
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
call System.String Eis08Dqcj5T.Ls7py1xZ2Kwct9::4Xtzk9wA3eSy(System.Int32,System.Int32,System.Type)
nop <null>
ldc.i4.0 <null>
ldnull <null>
ldc.i4 1960383218
call System.String Emt91rPceg8.Kk7fbEm::2PmsQeb7fr1XNb(System.Int32,Emt91rPceg8.Kk7fbEm,System.Int32)
call System.Void wc3BYfz17.Mn1an8T::6kkCK2pq5(System.String,System.String)
ldc.i4.4 <null>
stloc.s V_4
br IL_000A: ldloc.s V_4
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
newobj System.Void wc3BYfz17.Mn1an8T::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
ldtoken System.Void wc3BYfz17.Mn1an8T::Jra02TegXr8q()
pop <null>
ret <null>
2 malicious · 66 files
EXEdf8e26f66145f175ecff2cef4ee76b01.NET Reflective Loader
Structure
BIN.Net Reflective Loader
EXEGenitalk.klaoxao.tiff [AES Decrypted]
Structure
BINOverlay_ddd3db78.bin
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙