Malicious
Malicious

ead152233cb6712f2fb1920d08fe13b9

Share on LinkedIn
Print
PE Executable
MD5: ead152233cb6712f2fb1920d08fe13b9
Size: 53.25 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Size
53.25 KB · 53,248 B
First seen
2026-02-09 19:04 · 8 months ago
Last seen
2026-02-09 19:04 · 8 months ago
Last analysis
2026-02-09 19:04 · 8 months ago
Hashes
MD5 ead152233cb6712f2fb1920d08fe13b9 Sha1 31e179c2e6aaa4f0185f280069c094c1e2f6ef72 Sha256 bc1f349fc4db55e0ce087a043d3f7708994b65982f00599ddc52cfeaff55edba Sha384 acb7c2affe8fd19d623ad8e5612c6e2f801c037bef74e1a2568cfb0bc2b26e072d1d5f15991e07d289af78c630e28437 Sha512 8aa6e923ebd702162205f9158aaff24e2a0574356c9dd383054484f5c1191b2f190fea3dd961751da1888b3774d35d1a77751f5627d1b066dcfcbf778f7a6fa3 SSDeep 768:PfwStm8MpXwNGQYby2AfoacJahMOCiob2gbOvz+K1uprUn/SgzX2/RcXJYWz+:PHR6u2A7MOCvbpbwq2kYn6mG/RcX1z+ TLSH AC334C00F7E9C52AF1BD8B3898F322494679E557BA03DA5D0CC4159B0B13BC69A426FE
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Low
1 malicious · 5 files
EXEead152233cb6712f2fb1920d08fe13b9AsyncRAT
Structure
Config. Field Value
Key (AES_256) a0U5R3huhuhuhuhuhuhuhuhuhuhu
Pastebin -huhuhuhu
Certificate MIIE8Dhuhuhuhuhuhuhuhuhuhuhu
ServerSignature QGh69yhuhuhuhuhuhuhuhuhuhuhu
Install thuhuhuhu
BDOS fhuhuhuhu
Anti-VM fhuhuhuhu
Install File Windowhuhuhuhuhuhuhu
Install-Folder %Aphuhuhuhu
Hosts jawarehuhuhuhuhuhuhuhuhuhuhu
Ports 300huhuhuhu
Mutex QNtNhuhuhuhu
Version 0huhuhuhu
Delay 3huhuhuhu
Group Dehuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
iwn.exe
Full Name
iwn.exe
EntryPoint
System.Void Client.Program::Main()
Scope Name
iwn.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
iwn
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
126
Main Method
System.Void Client.Program::Main()
Main IL Instruction Count
70
Main IL 
ldc.i4.0 <null>
stloc.0 <null>
br IL_0015: ldloc.0
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
ldc.i4.1 <null>
add <null>
stloc.0 <null>
ldloc.0 <null>
ldsfld System.String Client.Settings::Delay
call System.Int32 System.Convert::ToInt32(System.String)
blt.s IL_0007: ldc.i4 1000
call System.Boolean Client.Settings::InitializeSettings()
brtrue IL_0032: ldsfld System.String Client.Settings::RunPEProcess
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String Client.Settings::RunPEProcess
call System.Boolean System.String::IsNullOrEmpty(System.String)
brtrue IL_0081: nop
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
callvirt System.String System.Reflection.Assembly::get_Location()
call System.Byte[] System.IO.File::ReadAllBytes(System.String)
ldsfld System.String Client.Settings::RunPEProcess
ldstr explorer.exe
call System.Boolean System.String::op_Equality(System.String,System.String)
brtrue IL_006E: ldstr "C:\\Windows\\explorer.exe"
ldstr C:\Windows\System32\svchost.exe
br IL_0073: stloc.1
ldstr C:\Windows\explorer.exe
stloc.1 <null>
ldloc.1 <null>
call System.Boolean Client.Helper.RunPE::Execute(System.Byte[],System.String)
pop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Boolean Client.Helper.MutexControl::CreateMutex()
brtrue IL_0092: ldsfld System.String Client.Settings::Anti
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String Client.Settings::Anti
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_00A6: ldsfld System.String Client.Settings::Install
call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis()
ldsfld System.String Client.Settings::Install
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_00BA: ldsfld System.String Client.Settings::BDOS
call System.Void Client.Install.NormalStartup::Install()
ldsfld System.String Client.Settings::BDOS
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_00D8: call System.Void Client.Helper.Methods::PreventSleep()
call System.Boolean Client.Helper.Methods::IsAdmin()
brfalse IL_00D8: call System.Void Client.Helper.Methods::PreventSleep()
call System.Void Client.Helper.ProcessCritical::Set()
call System.Void Client.Helper.Methods::PreventSleep()
leave IL_00E8: nop
pop <null>
leave IL_00E8: nop
nop <null>
call System.Boolean Client.Connection.ClientSocket::get_IsConnected()
brtrue IL_00FD: leave IL_0108
call System.Void Client.Connection.ClientSocket::Reconnect()
call System.Void Client.Connection.ClientSocket::InitializeClient()
leave IL_0108: ldc.i4 5000
pop <null>
leave IL_0108: ldc.i4 5000
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_00E8: nop
Module Name
iwn.exe
Full Name
iwn.exe
EntryPoint
System.Void Client.Program::Main()
Scope Name
iwn.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
iwn
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
126
Main Method
System.Void Client.Program::Main()
Main IL Instruction Count
70
Main IL 
ldc.i4.0 <null>
stloc.0 <null>
br IL_0015: ldloc.0
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
ldc.i4.1 <null>
add <null>
stloc.0 <null>
ldloc.0 <null>
ldsfld System.String Client.Settings::Delay
call System.Int32 System.Convert::ToInt32(System.String)
blt.s IL_0007: ldc.i4 1000
call System.Boolean Client.Settings::InitializeSettings()
brtrue IL_0032: ldsfld System.String Client.Settings::RunPEProcess
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String Client.Settings::RunPEProcess
call System.Boolean System.String::IsNullOrEmpty(System.String)
brtrue IL_0081: nop
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
callvirt System.String System.Reflection.Assembly::get_Location()
call System.Byte[] System.IO.File::ReadAllBytes(System.String)
ldsfld System.String Client.Settings::RunPEProcess
ldstr explorer.exe
call System.Boolean System.String::op_Equality(System.String,System.String)
brtrue IL_006E: ldstr "C:\\Windows\\explorer.exe"
ldstr C:\Windows\System32\svchost.exe
br IL_0073: stloc.1
ldstr C:\Windows\explorer.exe
stloc.1 <null>
ldloc.1 <null>
call System.Boolean Client.Helper.RunPE::Execute(System.Byte[],System.String)
pop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Boolean Client.Helper.MutexControl::CreateMutex()
brtrue IL_0092: ldsfld System.String Client.Settings::Anti
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String Client.Settings::Anti
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_00A6: ldsfld System.String Client.Settings::Install
call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis()
ldsfld System.String Client.Settings::Install
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_00BA: ldsfld System.String Client.Settings::BDOS
call System.Void Client.Install.NormalStartup::Install()
ldsfld System.String Client.Settings::BDOS
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_00D8: call System.Void Client.Helper.Methods::PreventSleep()
call System.Boolean Client.Helper.Methods::IsAdmin()
brfalse IL_00D8: call System.Void Client.Helper.Methods::PreventSleep()
call System.Void Client.Helper.ProcessCritical::Set()
call System.Void Client.Helper.Methods::PreventSleep()
leave IL_00E8: nop
pop <null>
leave IL_00E8: nop
nop <null>
call System.Boolean Client.Connection.ClientSocket::get_IsConnected()
brtrue IL_00FD: leave IL_0108
call System.Void Client.Connection.ClientSocket::Reconnect()
call System.Void Client.Connection.ClientSocket::InitializeClient()
leave IL_0108: ldc.i4 5000
pop <null>
leave IL_0108: ldc.i4 5000
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_00E8: nop
Key (AES_256) MUTEXmalicious
a0U5R3huhuhuhuhuhuhuhuhuhuhu
CnC CNCmalicious
jawarehuhuhuhuhuhuhuhuhuhuhu
Ports PORTmalicious
3huhuhuhu
Ports PORTmalicious
6huhuhuhu
Mutex MUTEXmalicious
QNtNhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙