Malicious
fd4805fa7ff642f047d98d738fd129ab
AutoIt Compiled Script
MD5: fd4805fa7ff642f047d98d738fd129ab
Size: 1.46 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
| MD5 | fd4805fa7ff642f047d98d738fd129ab |
| Sha1 | 472eaf55bf5f4b08c01bd8dd6bfcc36d4a0ff009 |
| Sha256 | dc9cf86ceacb019977da48abbf347e054a430a97ab28a96fa30305d2a2f84dfb |
| Sha384 | 82f8ff15cc4f213226b13c1e167df7282c3ad1acbaa33de514d1b3dafe7445a3d70efd40628ccb639944ffd6113b504e |
| Sha512 | 5abe9261730918d967df256c380095c2c96955d436e29e85e4eab0b9eb628f4cf9bdbf61bd835dcf41613223e63962eca2f0f3520128f5af14cdd3390fac856e |
| SSDeep | 24576:nu6J3xO0c+JY5UZ+XCHkGsoEAdx20W4njUprvVcC1f2o5RRfgdWY8:ho0c++OCokGs7Adgrd1f26RNY8 |
| TLSH | 4565BF52E38EC2F0DE165172BA7DF73A1E3B3C254530B9566FC5ED3AAD21021112DAA3 |
PeID
Microsoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ 7.0 - 8.0Microsoft Visual C++ 8Microsoft Visual C++ 8Microsoft Visual C++ v6.0 DLLVC8 -> Microsoft Corporation
| Config. Field | Value |
|---|---|
| Config. Key (RC4) | B3-A7-huhuhuhuhuhuhuhuhuhuhu |
| Domains | Wealthhuhuhuhuhuhuhuhuhuhuhu |
| Domains | wealthhuhuhuhuhuhuhu |
| Password | suhuhuhuhu |
| Host ID | sunshuhuhuhuhuhuhu |
| Mutex | -huhuhuhu |
| Install Path | %AppDahuhuhuhuhuhuhu |
| Startup Name | -huhuhuhu |
| ActiveX Key | -huhuhuhu |
| KeyLog Dir | %AppDahuhuhuhuhuhuhu |
| Copy executable | Thuhuhuhu |
| Delete original | Fhuhuhuhu |
| Lock executable | Fhuhuhuhu |
| Registry autorun | Fhuhuhuhu |
| ActiveX autorun | Fhuhuhuhu |
| Use a mutex | Fhuhuhuhu |
| Offline keylogger | Thuhuhuhu |
| Proxy Option | Direchuhuhuhuhuhuhu |
| other Option | 0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Name | Value |
|---|---|
| Info | PE Detect: PeReader OK (file layout) |
| Info | Overlay extracted: Overlay_e1bbfc0c.bin (3410 bytes) |
| Config. Field | Value |
|---|---|
| Config. Key (RC4) | B3-A7-huhuhuhuhuhuhuhuhuhuhu |
| Domains | Wealthhuhuhuhuhuhuhuhuhuhuhu |
| Domains | wealthhuhuhuhuhuhuhu |
| Password | suhuhuhuhu |
| Host ID | sunshuhuhuhuhuhuhu |
| Mutex | -huhuhuhu |
| Install Path | %AppDahuhuhuhuhuhuhu |
| Startup Name | -huhuhuhu |
| ActiveX Key | -huhuhuhu |
| KeyLog Dir | %AppDahuhuhuhuhuhuhu |
| Copy executable | Thuhuhuhu |
| Delete original | Fhuhuhuhu |
| Lock executable | Fhuhuhuhu |
| Registry autorun | Fhuhuhuhu |
| ActiveX autorun | Fhuhuhuhu |
| Use a mutex | Fhuhuhuhu |
| Offline keylogger | Thuhuhuhu |
| Proxy Option | Direchuhuhuhuhuhuhu |
| other Option | 0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
You must be signed in to view YARA rules.