Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
1.93 MB · 1,928,704 B
Hashes
MD5 f6cbdbd16d7723f9598b910f03ba8fc5 Sha1 86f541df56a8086da2e17b1790819e4137a698c9 Sha256 2423704f01108fc081ac5257cc60ed6ca266c3958c721cf091f98a6c103813df Sha384 0ae2393a1946f45f7f9ee58e0795d08896ce0b1bedfffb6314840a015d60cab0fa4f78aac1c614a079681ffa334a1f76 Sha512 304dbf47d9ec222640cd81818bdc1c63c5787c7590decfad322f8671f1be7dc8a3b6a2895c1835473b20f07ae375aca3314dcbe83c67029c3cf29c30f21c37b2 SSDeep 24576:/iIzB09Pzy4024DjyKNUlwPHL+e4+IgM88JqKoH7tx4GVMW3M2QZUYZ4dczA:/ioBCe40tjy0UCS3LZo7D4GxzQhZwuA TLSH EC9501F2AB808864C82B4A794436D9A36173A60E9D6CCB0E3DD6BF1F7D323474517897
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
2 malicious · 146 files
EXEf6cbdbd16d7723f9598b910f03ba8fc5.NET Reflective Loader
Structure
BIN.Net Resources
AABGontoba.kelaixja.aab
BINeg9Qx1HsMna8nT.Resources.resources
BIN09ea8bcc253c46.Resources.resources
BIN5aff1dd20
DATA[NBF]root.Data
BIN5aff1dd21
DATA[NBF]root.Data
BIN5aff1dd210
DATA[NBF]root.Data
BIN5aff1dd211
DATA[NBF]root.Data
BIN5aff1dd212
DATA[NBF]root.Data
BIN5aff1dd213
DATA[NBF]root.Data
BIN5aff1dd214
DATA[NBF]root.Data
BIN5aff1dd215
DATA[NBF]root.Data
BIN5aff1dd216
DATA[NBF]root.Data
BIN5aff1dd217
DATA[NBF]root.Data
BIN5aff1dd218
DATA[NBF]root.Data
BIN5aff1dd219
DATA[NBF]root.Data
BIN5aff1dd22
DATA[NBF]root.Data
BIN5aff1dd220
DATA[NBF]root.Data
BIN5aff1dd221
DATA[NBF]root.Data
BIN5aff1dd222
DATA[NBF]root.Data
BIN5aff1dd223
DATA[NBF]root.Data
BIN5aff1dd224
DATA[NBF]root.Data
BIN5aff1dd225
DATA[NBF]root.Data
BIN5aff1dd226
DATA[NBF]root.Data
BIN5aff1dd227
DATA[NBF]root.Data
BIN5aff1dd228
DATA[NBF]root.Data
BIN5aff1dd229
DATA[NBF]root.Data
BIN5aff1dd23
DATA[NBF]root.Data
BIN5aff1dd230
DATA[NBF]root.Data
BIN5aff1dd231
DATA[NBF]root.Data
BIN5aff1dd232
DATA[NBF]root.Data
BIN5aff1dd233
DATA[NBF]root.Data
BIN5aff1dd234
DATA[NBF]root.Data
BIN5aff1dd235
DATA[NBF]root.Data
BIN5aff1dd236
DATA[NBF]root.Data
BIN5aff1dd237
DATA[NBF]root.Data
BIN5aff1dd238
DATA[NBF]root.Data
BIN5aff1dd239
DATA[NBF]root.Data
BIN5aff1dd24
DATA[NBF]root.Data
BIN5aff1dd240
DATA[NBF]root.Data
BIN5aff1dd241
DATA[NBF]root.Data
BIN5aff1dd242
DATA[NBF]root.Data
BIN5aff1dd243
DATA[NBF]root.Data
BIN5aff1dd244
DATA[NBF]root.Data
BIN5aff1dd245
DATA[NBF]root.Data
BIN5aff1dd246
DATA[NBF]root.Data
BIN5aff1dd247
DATA[NBF]root.Data
BIN5aff1dd248
DATA[NBF]root.Data
BIN5aff1dd249
DATA[NBF]root.Data
BIN5aff1dd25
DATA[NBF]root.Data
BIN5aff1dd250
DATA[NBF]root.Data
BIN5aff1dd251
DATA[NBF]root.Data
BIN5aff1dd252
DATA[NBF]root.Data
BIN5aff1dd253
DATA[NBF]root.Data
BIN5aff1dd254
DATA[NBF]root.Data
BIN5aff1dd255
DATA[NBF]root.Data
BIN5aff1dd256
DATA[NBF]root.Data
BIN5aff1dd257
DATA[NBF]root.Data
BIN5aff1dd258
DATA[NBF]root.Data
BIN5aff1dd259
DATA[NBF]root.Data
BIN5aff1dd26
DATA[NBF]root.Data
BIN5aff1dd260
DATA[NBF]root.Data
BIN5aff1dd261
DATA[NBF]root.Data
BIN5aff1dd262
DATA[NBF]root.Data
BIN5aff1dd27
DATA[NBF]root.Data
BIN5aff1dd28
DATA[NBF]root.Data
BIN5aff1dd29
DATA[NBF]root.Data
BINResources
BINRT_ICON
BINID:0001
BINID:0
BINID:0032
BINID:0
BINID:0033
BINID:0
BINID:0034
BINID:0
BINID:0035
BINID:0
BINID:0036
BINID:0
BINRT_GROUP_CURSOR4
BINID:0001
BINID:0
BINID:7F00
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Reflective Loader
EXEGontoba.kelaixja.aab [AES Decrypted]
Structure
BINOverlay_7940c33a.bin
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
BINCollectorTracer.AttributeTask
BINDistributorTask.VisitorTask
BINSimpleTask.TaskFormatter
BINTaskConfiguration.AuthenticatorTask
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
4 / 4
Path pe:exe>pe:dll~T1059.007>pe:rsrc>bin
Shape pe:exe>pe:dll>pe:rsrc>bin
malicious 4 nodes
Path pe:exe>pe:dll~T1059.007>bin
Shape pe:exe>pe:dll>bin
malicious 3 nodes
Name Value
Module Name
eg9Qx1HsMna8nT
Full Name
eg9Qx1HsMna8nT
EntryPoint
System.Void yYg1b2WtDjn83.4Pjigb6FDsy2::bo4F7oGq()
Scope Name
eg9Qx1HsMna8nT
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
eg9Qx1HsMna8nT
Assembly Version
26.8.10.173
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void yYg1b2WtDjn83.4Pjigb6FDsy2::bo4F7oGq()
Main IL Instruction Count
7
Main IL 
nop <null>
newobj System.Void cr9MBpy2o3dH5x.8KgjBg1rb6iA::.ctor()
stloc.1 <null>
ret <null>
ldtoken System.Void yYg1b2WtDjn83.4Pjigb6FDsy2::bo4F7oGq()
pop <null>
ret <null>
Module Name
eg9Qx1HsMna8nT
Full Name
eg9Qx1HsMna8nT
EntryPoint
System.Void yYg1b2WtDjn83.4Pjigb6FDsy2::bo4F7oGq()
Scope Name
eg9Qx1HsMna8nT
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
eg9Qx1HsMna8nT
Assembly Version
26.8.10.173
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void yYg1b2WtDjn83.4Pjigb6FDsy2::bo4F7oGq()
Main IL Instruction Count
7
Main IL 
nop <null>
newobj System.Void cr9MBpy2o3dH5x.8KgjBg1rb6iA::.ctor()
stloc.1 <null>
ret <null>
ldtoken System.Void yYg1b2WtDjn83.4Pjigb6FDsy2::bo4F7oGq()
pop <null>
ret <null>
2 malicious · 146 files
EXEf6cbdbd16d7723f9598b910f03ba8fc5.NET Reflective Loader
Structure
BIN.Net Reflective Loader
EXEGontoba.kelaixja.aab [AES Decrypted]
Structure
BINOverlay_7940c33a.bin
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙