.NET Reflective Loader malware analysis – 2423704f0110

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Size

1.93 MB · 1,928,704 B

First seen

2026-09-10 11:16 · one month ago

Last seen

2026-09-10 11:16 · one month ago

Last analysis

2026-09-10 11:16 · one month ago

Hashes

MD5 f6cbdbd16d7723f9598b910f03ba8fc5 Sha1 86f541df56a8086da2e17b1790819e4137a698c9 Sha256 2423704f01108fc081ac5257cc60ed6ca266c3958c721cf091f98a6c103813df Sha384 0ae2393a1946f45f7f9ee58e0795d08896ce0b1bedfffb6314840a015d60cab0fa4f78aac1c614a079681ffa334a1f76 Sha512 304dbf47d9ec222640cd81818bdc1c63c5787c7590decfad322f8671f1be7dc8a3b6a2895c1835473b20f07ae375aca3314dcbe83c67029c3cf29c30f21c37b2 SSDeep 24576:/iIzB09Pzy4024DjyKNUlwPHL+e4+IgM88JqKoH7tx4GVMW3M2QZUYZ4dczA:/ioBCe40tjy0UCS3LZo7D4GxzQhZwuA TLSH EC9501F2AB808864C82B4A794436D9A36173A60E9D6CCB0E3DD6BF1F7D323474517897

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Very high

2 malicious · 146 files

EXEf6cbdbd16d7723f9598b910f03ba8fc5.NET Reflective Loader

Structure

BIN.Net Resources

BINResources

BIN.Net Reflective Loader

EXEGontoba.kelaixja.aab [AES Decrypted]

Structure

BINOverlay_7940c33a.bin

BINResources

BIN.Net Resources

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

4 / 4

Path pe:exe>pe:dll~T1059.007>pe:rsrc>bin

Shape pe:exe>pe:dll>pe:rsrc>bin

malicious 4 nodes

Path pe:exe>pe:dll~T1059.007>bin

Shape pe:exe>pe:dll>bin

malicious 3 nodes

Name	Value
Module Name	eg9Qx1HsMna8nT
Full Name	eg9Qx1HsMna8nT
EntryPoint	System.Void yYg1b2WtDjn83.4Pjigb6FDsy2::bo4F7oGq()
Scope Name	eg9Qx1HsMna8nT
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	eg9Qx1HsMna8nT
Assembly Version	26.8.10.173
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	0
Main Method	System.Void yYg1b2WtDjn83.4Pjigb6FDsy2::bo4F7oGq()
Main IL Instruction Count	7
Main IL	`nop <null> newobj System.Void cr9MBpy2o3dH5x.8KgjBg1rb6iA::.ctor() stloc.1 <null> ret <null> ldtoken System.Void yYg1b2WtDjn83.4Pjigb6FDsy2::bo4F7oGq() pop <null> ret <null>`
Module Name	eg9Qx1HsMna8nT
Full Name	eg9Qx1HsMna8nT
EntryPoint	System.Void yYg1b2WtDjn83.4Pjigb6FDsy2::bo4F7oGq()
Scope Name	eg9Qx1HsMna8nT
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	eg9Qx1HsMna8nT
Assembly Version	26.8.10.173
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	0
Main Method	System.Void yYg1b2WtDjn83.4Pjigb6FDsy2::bo4F7oGq()
Main IL Instruction Count	7
Main IL	`nop <null> newobj System.Void cr9MBpy2o3dH5x.8KgjBg1rb6iA::.ctor() stloc.1 <null> ret <null> ldtoken System.Void yYg1b2WtDjn83.4Pjigb6FDsy2::bo4F7oGq() pop <null> ret <null>`