Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
260.1 KB · 260,096 B
First seen
2025-08-30 18:46 · one year ago
Last seen
2025-08-30 18:46 · one year ago
Last analysis
2025-08-30 18:47 · one year ago
Hashes
MD5 ee45df52ef067eb91abff3a18f50ea7f Sha1 d18959acbfe442e4b222923ed59a2eaa2d59d2e5 Sha256 687409cea8ab009f29ff41a6e3b34db88c9a092eaeba007dffe9e29fd5aad207 Sha384 7bf527c48ff826fc0e0ce13c7a1560154cad38fb975c4c34cf9d7a78968a099949102ea9a3729a4b62f630c9c84947a0 Sha512 7b8013ddf542d10d06f24f5816dcd7ad05e80a56af22eed58ec68940f274bc8be8ae77aa382321c2c022823b1a53845a55892303d4b3e593afb32ae3a4c4f315 SSDeep 3072:JcZqf7D34cp/0+mAYkygYdQ0ghnB1fA0PuTVAtkxzk3R8:JcZqf7DIknGapB1fA0GTV8km TLSH D1444B54D3A4C118E6AE57B48C206B4F4DF36817AA03F73A7B8458A91D63733B61DE32
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Low
1 malicious · 8 files
EXEee45df52ef067eb91abff3a18f50ea7fRECORDSTEALER
Structure
BINResources
BINRT_ICON
BINID:0001
BINID:0
BINRT_GROUP_CURSOR4
BINID:7F00
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN.Net Resources
BINForm1.resources
BINPatterns.Properties.Resource1.resources
BINrootCert
Config. Field Value
[Configuration Module Name] Arghuhuhuhu
[Configuration Module Full Name] Arghuhuhuhu
IP 206.18huhuhuhuhuhuhu
ID chuhuhuhu
Message
Key
Version 0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
[Configuration Module Name] Arghuhuhuhu
[Configuration Module Full Name] Arghuhuhuhu
Key
Version 0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Steanings.exe
Full Name
Steanings.exe
EntryPoint
System.Void Program::Main()
Scope Name
Steanings.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Steanings
Assembly Version
1.1.21.1
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
301
Main Method
System.Void Program::Main()
Main IL Instruction Count
17
Main IL 
nop <null>
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void Form1::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
nop <null>
leave.s IL_0022: ret
stloc.0 <null>
nop <null>
nop <null>
leave.s IL_0022: ret
ret <null>
Module Name
Steanings.exe
Full Name
Steanings.exe
EntryPoint
System.Void Program::Main()
Scope Name
Steanings.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Steanings
Assembly Version
1.1.21.1
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
301
Main Method
System.Void Program::Main()
Main IL Instruction Count
17
Main IL 
nop <null>
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void Form1::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
nop <null>
leave.s IL_0022: ret
stloc.0 <null>
nop <null>
nop <null>
leave.s IL_0022: ret
ret <null>
1 malicious · 8 files
EXEee45df52ef067eb91abff3a18f50ea7fRECORDSTEALER
Structure
Config. Field Value
[Configuration Module Name] Arghuhuhuhu
[Configuration Module Full Name] Arghuhuhuhu
IP 206.18huhuhuhuhuhuhu
ID chuhuhuhu
Message
Key
Version 0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
[Configuration Module Name] Arghuhuhuhu
[Configuration Module Full Name] Arghuhuhuhu
Key
Version 0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙