Malicious
Malicious

f657bbd97cd06f1f89b87262d1b8ed2f

PE Executable
MD5: f657bbd97cd06f1f89b87262d1b8ed2f
Size: 25.4 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 f657bbd97cd06f1f89b87262d1b8ed2f
Sha1 f995b7d44a605ae1a8755ab1839a064a25e8611b
Sha256 994e3908823894f612b5081094f2e398f9855bc91297c06182f8a2cee0803484
Sha384 359421ee678e3a8e97c0c67ad343b9f6ff7a07779fe82e54cc041c64a4b1557c4c5429eac2f7a73a9a9494a6fa64374a
Sha512 a7928a0194b8c4c5102c0a8191d8955be16478dcd03d7ae1554c19932a8680d0a98e0e28ec85df1cf0e67006bc25d296bc1833d979e345fb9da3a21b34773118
SSDeep 98304:kMOod9oe/2cX45fmwJ/+fWF4BtpJBv6Aort9BvDCiWfCnOYIRmNEd7ur5TdUD9To:BOrnF4Btq2GOYVBcqy
TLSH 3D4728D2B666A070C9064D7208F7E35613B1AD07DE207561B1CCB72CBFB2697872BD4A
PeID
MASM/TASM - sig4 (h)Microsoft (R) Full-text index fileMicrosoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ v6.0 DLLPeStubOEP v1.xPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!
f657bbd97cd06f1f89b87262d1b8ed2f
Malicious
[Base64-Block @0x0056CBDF]
[Base64-Block@0x00CC0DDF]
Malicious
[Base64-Block-Decoded]
Malicious
[PowerShell Command]
Malicious
[Base64-Block]
Malicious
file_0.bin
Malicious
[Base64-Block]
[PowerShell Command]
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
UPX0
UPX1
UPX2
.CAPE
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>scr:ps1~T1027~T1059.001>arc:gz>scr:ps1~T1027~T1059.001
Shape pe:exe>scr:ps1>arc:gz>scr:ps1
malicious 4 nodes
Path pe:exe>enc:b64
Shape pe:exe>enc:b64
2 nodes
Config. Field Value
C2 https:huhuhuhuhuhuhuhuhuhuhu
Botnet ?Q?xfhuhuhuhuhuhuhuhuhuhuhu
UserAgent 1 0 huhuhuhuhuhuhuhuhuhuhu
[Configuration Offset] 0x0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
C2 https:huhuhuhuhuhuhuhuhuhuhu
Botnet J ???huhuhuhuhuhuhuhuhuhuhu
UserAgent Uhuhuhuhuhuhuhuhuhuhuhu
[Configuration Offset] 0x0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
C2 https:huhuhuhuhuhuhuhuhuhuhu
Botnet ??@??huhuhuhuhuhuhuhuhuhuhu
UserAgent Uhuhuhuhuhuhuhuhuhuhuhu
[Configuration Offset] 0x0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Info
PE Detect: PeReader OK (file layout)
f657bbd97cd06f1f89b87262d1b8ed2f
Malicious
[Base64-Block @0x0056CBDF]
[Base64-Block@0x00CC0DDF]
Malicious
[Base64-Block-Decoded]
Malicious
[PowerShell Command]
Malicious
[Base64-Block]
Malicious
file_0.bin
Malicious
[Base64-Block]
[PowerShell Command]
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
UPX0
UPX1
UPX2
.CAPE
Config. Field Value
C2 https:huhuhuhuhuhuhuhuhuhuhu
Botnet ?Q?xfhuhuhuhuhuhuhuhuhuhuhu
UserAgent 1 0 huhuhuhuhuhuhuhuhuhuhu
[Configuration Offset] 0x0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
C2 https:huhuhuhuhuhuhuhuhuhuhu
Botnet J ???huhuhuhuhuhuhuhuhuhuhu
UserAgent Uhuhuhuhuhuhuhuhuhuhuhu
[Configuration Offset] 0x0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
C2 https:huhuhuhuhuhuhuhuhuhuhu
Botnet ??@??huhuhuhuhuhuhuhuhuhuhu
UserAgent Uhuhuhuhuhuhuhuhuhuhuhu
[Configuration Offset] 0x0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙