a ton of cumme.zip
- SHA256 747957c357cf6fbb4507831926d64211bcea32f767e4262efe275bba99154089
Overview
overview
10Static
static
10a ton of c...0).exe
windows10-1703-x64
10a ton of c...1).exe
windows10-1703-x64
10a ton of c...2).exe
windows10-1703-x64
10a ton of c...3).exe
windows10-1703-x64
10a ton of c...4).exe
windows10-1703-x64
10a ton of c...5).exe
windows10-1703-x64
10a ton of c...6).exe
windows10-1703-x64
10a ton of c...7).exe
windows10-1703-x64
10a ton of c...8).exe
windows10-1703-x64
10a ton of c...9).exe
windows10-1703-x64
10a ton of c...2).exe
windows10-1703-x64
10a ton of c...0).exe
windows10-1703-x64
10a ton of c...1).exe
windows10-1703-x64
10a ton of c...2).exe
windows10-1703-x64
10a ton of c...3).exe
windows10-1703-x64
10a ton of c...4).exe
windows10-1703-x64
10a ton of c...5).exe
windows10-1703-x64
10a ton of c...6).exe
windows10-1703-x64
10a ton of c...7).exe
windows10-1703-x64
10a ton of c...8).exe
windows10-1703-x64
10a ton of c...9).exe
windows10-1703-x64
10a ton of c...3).exe
windows10-1703-x64
10a ton of c...0).exe
windows10-1703-x64
10a ton of c...1).exe
windows10-1703-x64
10a ton of c...4).exe
windows10-1703-x64
10a ton of c...5).exe
windows10-1703-x64
10a ton of c...6).exe
windows10-1703-x64
10a ton of c...7).exe
windows10-1703-x64
10a ton of c...8).exe
windows10-1703-x64
10a ton of c...9).exe
windows10-1703-x64
10a ton of c...py.exe
windows10-1703-x64
10a ton of c...me.exe
windows10-1703-x64
10Behavioral task
behavioral1
Sample
a ton of cumme/cumme - Copy (10).exe
Resource
win10-20240404-en
windows10-1703-x64
11 signatures
1200 seconds
Behavioral task
behavioral2
Sample
a ton of cumme/cumme - Copy (11).exe
Resource
win10-20240404-en
windows10-1703-x64
11 signatures
1200 seconds
Behavioral task
behavioral3
Sample
a ton of cumme/cumme - Copy (12).exe
Resource
win10-20240404-en
windows10-1703-x64
11 signatures
1200 seconds
Behavioral task
behavioral4
Sample
a ton of cumme/cumme - Copy (13).exe
Resource
win10-20240404-en
windows10-1703-x64
11 signatures
1200 seconds
Behavioral task
behavioral5
Sample
a ton of cumme/cumme - Copy (14).exe
Resource
win10-20240404-en
windows10-1703-x64
10 signatures
1200 seconds
Behavioral task
behavioral6
Sample
a ton of cumme/cumme - Copy (15).exe
Resource
win10-20240404-en
windows10-1703-x64
10 signatures
1200 seconds
Behavioral task
behavioral7
Sample
a ton of cumme/cumme - Copy (16).exe
Resource
win10-20240404-en
windows10-1703-x64
11 signatures
1200 seconds
Behavioral task
behavioral8
Sample
a ton of cumme/cumme - Copy (17).exe
Resource
win10-20240404-en
windows10-1703-x64
10 signatures
1200 seconds
Behavioral task
behavioral9
Sample
a ton of cumme/cumme - Copy (18).exe
Resource
win10-20240404-en
windows10-1703-x64
10 signatures
1200 seconds
Behavioral task
behavioral10
Sample
a ton of cumme/cumme - Copy (19).exe
Resource
win10-20240404-en
windows10-1703-x64
10 signatures
1200 seconds
Behavioral task
behavioral11
Sample
a ton of cumme/cumme - Copy (2).exe
Resource
win10-20240404-en
windows10-1703-x64
10 signatures
1200 seconds
Behavioral task
behavioral12
Sample
a ton of cumme/cumme - Copy (20).exe
Resource
win10-20240404-en
windows10-1703-x64
11 signatures
1200 seconds
Behavioral task
behavioral13
Sample
a ton of cumme/cumme - Copy (21).exe
Resource
win10-20240404-en
windows10-1703-x64
11 signatures
1200 seconds
Behavioral task
behavioral14
Sample
a ton of cumme/cumme - Copy (22).exe
Resource
win10-20240404-en
windows10-1703-x64
10 signatures
1200 seconds
Behavioral task
behavioral15
Sample
a ton of cumme/cumme - Copy (23).exe
Resource
win10-20240404-en
windows10-1703-x64
10 signatures
1200 seconds
Behavioral task
behavioral16
Sample
a ton of cumme/cumme - Copy (24).exe
Resource
win10-20240404-en
windows10-1703-x64
10 signatures
1200 seconds
Behavioral task
behavioral17
Sample
a ton of cumme/cumme - Copy (25).exe
Resource
win10-20240404-en
windows10-1703-x64
11 signatures
1200 seconds
Behavioral task
behavioral18
Sample
a ton of cumme/cumme - Copy (26).exe
Resource
win10-20240404-en
windows10-1703-x64
10 signatures
1200 seconds
Behavioral task
behavioral19
Sample
a ton of cumme/cumme - Copy (27).exe
Resource
win10-20240404-en
windows10-1703-x64
10 signatures
1200 seconds
Behavioral task
behavioral20
Sample
a ton of cumme/cumme - Copy (28).exe
Resource
win10-20240404-en
windows10-1703-x64
10 signatures
1200 seconds
Behavioral task
behavioral21
Sample
a ton of cumme/cumme - Copy (29).exe
Resource
win10-20240404-en
windows10-1703-x64
10 signatures
1200 seconds
Behavioral task
behavioral22
Sample
a ton of cumme/cumme - Copy (3).exe
Resource
win10-20240404-en
windows10-1703-x64
11 signatures
1200 seconds
Behavioral task
behavioral23
Sample
a ton of cumme/cumme - Copy (30).exe
Resource
win10-20240404-en
windows10-1703-x64
10 signatures
1200 seconds
Behavioral task
behavioral24
Sample
a ton of cumme/cumme - Copy (31).exe
Resource
win10-20240404-en
windows10-1703-x64
11 signatures
1200 seconds
Behavioral task
behavioral25
Sample
a ton of cumme/cumme - Copy (4).exe
Resource
win10-20240404-en
windows10-1703-x64
10 signatures
1200 seconds
Behavioral task
behavioral26
Sample
a ton of cumme/cumme - Copy (5).exe
Resource
win10-20240404-en
windows10-1703-x64
10 signatures
1200 seconds
Behavioral task
behavioral27
Sample
a ton of cumme/cumme - Copy (6).exe
Resource
win10-20240404-en
windows10-1703-x64
10 signatures
1200 seconds
Behavioral task
behavioral28
Sample
a ton of cumme/cumme - Copy (7).exe
Resource
win10-20240404-en
windows10-1703-x64
11 signatures
1200 seconds
Behavioral task
behavioral29
Sample
a ton of cumme/cumme - Copy (8).exe
Resource
win10-20240404-en
windows10-1703-x64
10 signatures
1200 seconds
Behavioral task
behavioral30
Sample
a ton of cumme/cumme - Copy (9).exe
Resource
win10-20240404-en
windows10-1703-x64
10 signatures
1200 seconds
Behavioral task
behavioral31
Sample
a ton of cumme/cumme - Copy.exe
Resource
win10-20240404-en
windows10-1703-x64
11 signatures
1200 seconds
General
- Target a ton of cumme.zip
- Size 978KB
- Sample240503-b4lqvaea67
- SHA256 747957c357cf6fbb4507831926d64211bcea32f767e4262efe275bba99154089
- MD5 b520c1e89f26c96bdd965d91990eca64
- SHA1 e61c0cefd7c1109aa50ec9e63aed13020ee6a882
- SHA512 2a8348ccc46137590fdccc8dfe9f05572613b07e9197f1e64682c9249605b566e57b83e85b548a9485188fe11fb0f169c028216905f0cc28e00d7de55a67fdec
- SSDEEP 6144:SnmSnmHnmEnmJnm+nmTnmAnm1nmKnmJnmanmFnmMnmPnmGnmRnmonmbnminmNnmS:6
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
asyncrat
Botnet
-
Default
C2
-
other-fellow.gl.at.ply.gg:42571
Attributes
-
delay
1
-
install
true
-
install_file
cumme.exe
-
install_folder
%AppData%
aes.plain
Signatures
- Async RAT payload 32 IoCs
resource yara_rule static1/unpack001/a ton of cumme/cumme - Copy (10).exe family_asyncrat static1/unpack001/a ton of cumme/cumme - Copy (11).exe family_asyncrat static1/unpack001/a ton of cumme/cumme - Copy (12).exe family_asyncrat static1/unpack001/a ton of cumme/cumme - Copy (13).exe family_asyncrat static1/unpack001/a ton of cumme/cumme - Copy (14).exe family_asyncrat static1/unpack001/a ton of cumme/cumme - Copy (15).exe family_asyncrat static1/unpack001/a ton of cumme/cumme - Copy (16).exe family_asyncrat static1/unpack001/a ton of cumme/cumme - Copy (17).exe family_asyncrat static1/unpack001/a ton of cumme/cumme - Copy (18).exe family_asyncrat static1/unpack001/a ton of cumme/cumme - Copy (19).exe family_asyncrat static1/unpack001/a ton of cumme/cumme - Copy (2).exe family_asyncrat static1/unpack001/a ton of cumme/cumme - Copy (20).exe family_asyncrat static1/unpack001/a ton of cumme/cumme - Copy (21).exe family_asyncrat static1/unpack001/a ton of cumme/cumme - Copy (22).exe family_asyncrat static1/unpack001/a ton of cumme/cumme - Copy (23).exe family_asyncrat static1/unpack001/a ton of cumme/cumme - Copy (24).exe family_asyncrat static1/unpack001/a ton of cumme/cumme - Copy (25).exe family_asyncrat static1/unpack001/a ton of cumme/cumme - Copy (26).exe family_asyncrat static1/unpack001/a ton of cumme/cumme - Copy (27).exe family_asyncrat static1/unpack001/a ton of cumme/cumme - Copy (28).exe family_asyncrat static1/unpack001/a ton of cumme/cumme - Copy (29).exe family_asyncrat static1/unpack001/a ton of cumme/cumme - Copy (3).exe family_asyncrat static1/unpack001/a ton of cumme/cumme - Copy (30).exe family_asyncrat static1/unpack001/a ton of cumme/cumme - Copy (31).exe family_asyncrat static1/unpack001/a ton of cumme/cumme - Copy (4).exe family_asyncrat static1/unpack001/a ton of cumme/cumme - Copy (5).exe family_asyncrat static1/unpack001/a ton of cumme/cumme - Copy (6).exe family_asyncrat static1/unpack001/a ton of cumme/cumme - Copy (7).exe family_asyncrat static1/unpack001/a ton of cumme/cumme - Copy (8).exe family_asyncrat static1/unpack001/a ton of cumme/cumme - Copy (9).exe family_asyncrat static1/unpack001/a ton of cumme/cumme - Copy.exe family_asyncrat static1/unpack001/a ton of cumme/cumme.exe family_asyncrat - Asyncrat family
- Unsigned PE 32 IoCs
Checks for missing Authenticode signature.
resource unpack001/a ton of cumme/cumme - Copy (10).exe unpack001/a ton of cumme/cumme - Copy (11).exe unpack001/a ton of cumme/cumme - Copy (12).exe unpack001/a ton of cumme/cumme - Copy (13).exe unpack001/a ton of cumme/cumme - Copy (14).exe unpack001/a ton of cumme/cumme - Copy (15).exe unpack001/a ton of cumme/cumme - Copy (16).exe unpack001/a ton of cumme/cumme - Copy (17).exe unpack001/a ton of cumme/cumme - Copy (18).exe unpack001/a ton of cumme/cumme - Copy (19).exe unpack001/a ton of cumme/cumme - Copy (2).exe unpack001/a ton of cumme/cumme - Copy (20).exe unpack001/a ton of cumme/cumme - Copy (21).exe unpack001/a ton of cumme/cumme - Copy (22).exe unpack001/a ton of cumme/cumme - Copy (23).exe unpack001/a ton of cumme/cumme - Copy (24).exe unpack001/a ton of cumme/cumme - Copy (25).exe unpack001/a ton of cumme/cumme - Copy (26).exe unpack001/a ton of cumme/cumme - Copy (27).exe unpack001/a ton of cumme/cumme - Copy (28).exe unpack001/a ton of cumme/cumme - Copy (29).exe unpack001/a ton of cumme/cumme - Copy (3).exe unpack001/a ton of cumme/cumme - Copy (30).exe unpack001/a ton of cumme/cumme - Copy (31).exe unpack001/a ton of cumme/cumme - Copy (4).exe unpack001/a ton of cumme/cumme - Copy (5).exe unpack001/a ton of cumme/cumme - Copy (6).exe unpack001/a ton of cumme/cumme - Copy (7).exe unpack001/a ton of cumme/cumme - Copy (8).exe unpack001/a ton of cumme/cumme - Copy (9).exe unpack001/a ton of cumme/cumme - Copy.exe unpack001/a ton of cumme/cumme.exe
File Explorer
-
a ton of cumme.zip.zip 978KB
-
a ton of cumme/cumme - Copy (10).exe.exe 63KB
-
a ton of cumme/cumme - Copy (11).exe.exe 63KB
-
a ton of cumme/cumme - Copy (12).exe.exe 63KB
-
a ton of cumme/cumme - Copy (13).exe.exe 63KB
-
a ton of cumme/cumme - Copy (14).exe.exe 63KB
-
a ton of cumme/cumme - Copy (15).exe.exe 63KB
-
a ton of cumme/cumme - Copy (16).exe.exe 63KB
-
a ton of cumme/cumme - Copy (17).exe.exe 63KB
-
a ton of cumme/cumme - Copy (18).exe.exe 63KB
-
a ton of cumme/cumme - Copy (19).exe.exe 63KB
-
a ton of cumme/cumme - Copy (2).exe.exe 63KB
-
a ton of cumme/cumme - Copy (20).exe.exe 63KB
-
a ton of cumme/cumme - Copy (21).exe.exe 63KB
-
a ton of cumme/cumme - Copy (22).exe.exe 63KB
-
a ton of cumme/cumme - Copy (23).exe.exe 63KB
-
a ton of cumme/cumme - Copy (24).exe.exe 63KB
-
a ton of cumme/cumme - Copy (25).exe.exe 63KB
-
a ton of cumme/cumme - Copy (26).exe.exe 63KB
-
a ton of cumme/cumme - Copy (27).exe.exe 63KB
-
a ton of cumme/cumme - Copy (28).exe.exe 63KB
-
a ton of cumme/cumme - Copy (29).exe.exe 63KB
-
a ton of cumme/cumme - Copy (3).exe.exe 63KB
-
a ton of cumme/cumme - Copy (30).exe.exe 63KB
-
a ton of cumme/cumme - Copy (31).exe.exe 63KB
-
a ton of cumme/cumme - Copy (4).exe.exe 63KB
-
a ton of cumme/cumme - Copy (5).exe.exe 63KB
-
a ton of cumme/cumme - Copy (6).exe.exe 63KB
-
a ton of cumme/cumme - Copy (7).exe.exe 63KB
-
a ton of cumme/cumme - Copy (8).exe.exe 63KB
-
a ton of cumme/cumme - Copy (9).exe.exe 63KB
-
a ton of cumme/cumme - Copy.exe.exe 63KB
-
a ton of cumme/cumme.exe.exe 63KB
a ton of cumme/cumme - Copy (10).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 390f2329d720595861f5bc5bf65cccdd0a76639197f15fb1529e66736a6f6a41
- MD5 76034e5a2c3a49ec8232f011d5572d84
- SHA1 9dae727f33662a0411fb0f49a51c845fddbb5b98
- SHA512 df4a742d9f5da89888a154f4eef3964bf5574f4d679088aa03fc58e8309f06ea942ea291fa2acd87e92c922c59845c1b695d9dd736e3f7b99316c08dd6968a1d
- SSDEEP 1536:AqTQa7NVNPHYUYUbzh97IBfusdpqKmY7:A5ANVHYUbz3kJGz
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
68094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
a ton of cumme/cumme - Copy (11).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 390f2329d720595861f5bc5bf65cccdd0a76639197f15fb1529e66736a6f6a41
- MD5 76034e5a2c3a49ec8232f011d5572d84
- SHA1 9dae727f33662a0411fb0f49a51c845fddbb5b98
- SHA512 df4a742d9f5da89888a154f4eef3964bf5574f4d679088aa03fc58e8309f06ea942ea291fa2acd87e92c922c59845c1b695d9dd736e3f7b99316c08dd6968a1d
- SSDEEP 1536:AqTQa7NVNPHYUYUbzh97IBfusdpqKmY7:A5ANVHYUbz3kJGz
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
68094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
a ton of cumme/cumme - Copy (12).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 390f2329d720595861f5bc5bf65cccdd0a76639197f15fb1529e66736a6f6a41
- MD5 76034e5a2c3a49ec8232f011d5572d84
- SHA1 9dae727f33662a0411fb0f49a51c845fddbb5b98
- SHA512 df4a742d9f5da89888a154f4eef3964bf5574f4d679088aa03fc58e8309f06ea942ea291fa2acd87e92c922c59845c1b695d9dd736e3f7b99316c08dd6968a1d
- SSDEEP 1536:AqTQa7NVNPHYUYUbzh97IBfusdpqKmY7:A5ANVHYUbz3kJGz
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
68094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
a ton of cumme/cumme - Copy (13).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 390f2329d720595861f5bc5bf65cccdd0a76639197f15fb1529e66736a6f6a41
- MD5 76034e5a2c3a49ec8232f011d5572d84
- SHA1 9dae727f33662a0411fb0f49a51c845fddbb5b98
- SHA512 df4a742d9f5da89888a154f4eef3964bf5574f4d679088aa03fc58e8309f06ea942ea291fa2acd87e92c922c59845c1b695d9dd736e3f7b99316c08dd6968a1d
- SSDEEP 1536:AqTQa7NVNPHYUYUbzh97IBfusdpqKmY7:A5ANVHYUbz3kJGz
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
68094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
a ton of cumme/cumme - Copy (14).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 390f2329d720595861f5bc5bf65cccdd0a76639197f15fb1529e66736a6f6a41
- MD5 76034e5a2c3a49ec8232f011d5572d84
- SHA1 9dae727f33662a0411fb0f49a51c845fddbb5b98
- SHA512 df4a742d9f5da89888a154f4eef3964bf5574f4d679088aa03fc58e8309f06ea942ea291fa2acd87e92c922c59845c1b695d9dd736e3f7b99316c08dd6968a1d
- SSDEEP 1536:AqTQa7NVNPHYUYUbzh97IBfusdpqKmY7:A5ANVHYUbz3kJGz
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
68094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
a ton of cumme/cumme - Copy (15).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 390f2329d720595861f5bc5bf65cccdd0a76639197f15fb1529e66736a6f6a41
- MD5 76034e5a2c3a49ec8232f011d5572d84
- SHA1 9dae727f33662a0411fb0f49a51c845fddbb5b98
- SHA512 df4a742d9f5da89888a154f4eef3964bf5574f4d679088aa03fc58e8309f06ea942ea291fa2acd87e92c922c59845c1b695d9dd736e3f7b99316c08dd6968a1d
- SSDEEP 1536:AqTQa7NVNPHYUYUbzh97IBfusdpqKmY7:A5ANVHYUbz3kJGz
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
68094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
a ton of cumme/cumme - Copy (16).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 390f2329d720595861f5bc5bf65cccdd0a76639197f15fb1529e66736a6f6a41
- MD5 76034e5a2c3a49ec8232f011d5572d84
- SHA1 9dae727f33662a0411fb0f49a51c845fddbb5b98
- SHA512 df4a742d9f5da89888a154f4eef3964bf5574f4d679088aa03fc58e8309f06ea942ea291fa2acd87e92c922c59845c1b695d9dd736e3f7b99316c08dd6968a1d
- SSDEEP 1536:AqTQa7NVNPHYUYUbzh97IBfusdpqKmY7:A5ANVHYUbz3kJGz
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
68094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
a ton of cumme/cumme - Copy (17).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 390f2329d720595861f5bc5bf65cccdd0a76639197f15fb1529e66736a6f6a41
- MD5 76034e5a2c3a49ec8232f011d5572d84
- SHA1 9dae727f33662a0411fb0f49a51c845fddbb5b98
- SHA512 df4a742d9f5da89888a154f4eef3964bf5574f4d679088aa03fc58e8309f06ea942ea291fa2acd87e92c922c59845c1b695d9dd736e3f7b99316c08dd6968a1d
- SSDEEP 1536:AqTQa7NVNPHYUYUbzh97IBfusdpqKmY7:A5ANVHYUbz3kJGz
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
68094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
a ton of cumme/cumme - Copy (18).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 390f2329d720595861f5bc5bf65cccdd0a76639197f15fb1529e66736a6f6a41
- MD5 76034e5a2c3a49ec8232f011d5572d84
- SHA1 9dae727f33662a0411fb0f49a51c845fddbb5b98
- SHA512 df4a742d9f5da89888a154f4eef3964bf5574f4d679088aa03fc58e8309f06ea942ea291fa2acd87e92c922c59845c1b695d9dd736e3f7b99316c08dd6968a1d
- SSDEEP 1536:AqTQa7NVNPHYUYUbzh97IBfusdpqKmY7:A5ANVHYUbz3kJGz
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
68094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
a ton of cumme/cumme - Copy (19).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 390f2329d720595861f5bc5bf65cccdd0a76639197f15fb1529e66736a6f6a41
- MD5 76034e5a2c3a49ec8232f011d5572d84
- SHA1 9dae727f33662a0411fb0f49a51c845fddbb5b98
- SHA512 df4a742d9f5da89888a154f4eef3964bf5574f4d679088aa03fc58e8309f06ea942ea291fa2acd87e92c922c59845c1b695d9dd736e3f7b99316c08dd6968a1d
- SSDEEP 1536:AqTQa7NVNPHYUYUbzh97IBfusdpqKmY7:A5ANVHYUbz3kJGz
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
68094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
a ton of cumme/cumme - Copy (2).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 390f2329d720595861f5bc5bf65cccdd0a76639197f15fb1529e66736a6f6a41
- MD5 76034e5a2c3a49ec8232f011d5572d84
- SHA1 9dae727f33662a0411fb0f49a51c845fddbb5b98
- SHA512 df4a742d9f5da89888a154f4eef3964bf5574f4d679088aa03fc58e8309f06ea942ea291fa2acd87e92c922c59845c1b695d9dd736e3f7b99316c08dd6968a1d
- SSDEEP 1536:AqTQa7NVNPHYUYUbzh97IBfusdpqKmY7:A5ANVHYUbz3kJGz
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
68094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
a ton of cumme/cumme - Copy (20).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 390f2329d720595861f5bc5bf65cccdd0a76639197f15fb1529e66736a6f6a41
- MD5 76034e5a2c3a49ec8232f011d5572d84
- SHA1 9dae727f33662a0411fb0f49a51c845fddbb5b98
- SHA512 df4a742d9f5da89888a154f4eef3964bf5574f4d679088aa03fc58e8309f06ea942ea291fa2acd87e92c922c59845c1b695d9dd736e3f7b99316c08dd6968a1d
- SSDEEP 1536:AqTQa7NVNPHYUYUbzh97IBfusdpqKmY7:A5ANVHYUbz3kJGz
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
68094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
a ton of cumme/cumme - Copy (21).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 390f2329d720595861f5bc5bf65cccdd0a76639197f15fb1529e66736a6f6a41
- MD5 76034e5a2c3a49ec8232f011d5572d84
- SHA1 9dae727f33662a0411fb0f49a51c845fddbb5b98
- SHA512 df4a742d9f5da89888a154f4eef3964bf5574f4d679088aa03fc58e8309f06ea942ea291fa2acd87e92c922c59845c1b695d9dd736e3f7b99316c08dd6968a1d
- SSDEEP 1536:AqTQa7NVNPHYUYUbzh97IBfusdpqKmY7:A5ANVHYUbz3kJGz
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
68094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
a ton of cumme/cumme - Copy (22).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 390f2329d720595861f5bc5bf65cccdd0a76639197f15fb1529e66736a6f6a41
- MD5 76034e5a2c3a49ec8232f011d5572d84
- SHA1 9dae727f33662a0411fb0f49a51c845fddbb5b98
- SHA512 df4a742d9f5da89888a154f4eef3964bf5574f4d679088aa03fc58e8309f06ea942ea291fa2acd87e92c922c59845c1b695d9dd736e3f7b99316c08dd6968a1d
- SSDEEP 1536:AqTQa7NVNPHYUYUbzh97IBfusdpqKmY7:A5ANVHYUbz3kJGz
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
68094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
a ton of cumme/cumme - Copy (23).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 390f2329d720595861f5bc5bf65cccdd0a76639197f15fb1529e66736a6f6a41
- MD5 76034e5a2c3a49ec8232f011d5572d84
- SHA1 9dae727f33662a0411fb0f49a51c845fddbb5b98
- SHA512 df4a742d9f5da89888a154f4eef3964bf5574f4d679088aa03fc58e8309f06ea942ea291fa2acd87e92c922c59845c1b695d9dd736e3f7b99316c08dd6968a1d
- SSDEEP 1536:AqTQa7NVNPHYUYUbzh97IBfusdpqKmY7:A5ANVHYUbz3kJGz
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
68094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
a ton of cumme/cumme - Copy (24).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 390f2329d720595861f5bc5bf65cccdd0a76639197f15fb1529e66736a6f6a41
- MD5 76034e5a2c3a49ec8232f011d5572d84
- SHA1 9dae727f33662a0411fb0f49a51c845fddbb5b98
- SHA512 df4a742d9f5da89888a154f4eef3964bf5574f4d679088aa03fc58e8309f06ea942ea291fa2acd87e92c922c59845c1b695d9dd736e3f7b99316c08dd6968a1d
- SSDEEP 1536:AqTQa7NVNPHYUYUbzh97IBfusdpqKmY7:A5ANVHYUbz3kJGz
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
68094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
a ton of cumme/cumme - Copy (25).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 390f2329d720595861f5bc5bf65cccdd0a76639197f15fb1529e66736a6f6a41
- MD5 76034e5a2c3a49ec8232f011d5572d84
- SHA1 9dae727f33662a0411fb0f49a51c845fddbb5b98
- SHA512 df4a742d9f5da89888a154f4eef3964bf5574f4d679088aa03fc58e8309f06ea942ea291fa2acd87e92c922c59845c1b695d9dd736e3f7b99316c08dd6968a1d
- SSDEEP 1536:AqTQa7NVNPHYUYUbzh97IBfusdpqKmY7:A5ANVHYUbz3kJGz
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
68094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
a ton of cumme/cumme - Copy (26).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 390f2329d720595861f5bc5bf65cccdd0a76639197f15fb1529e66736a6f6a41
- MD5 76034e5a2c3a49ec8232f011d5572d84
- SHA1 9dae727f33662a0411fb0f49a51c845fddbb5b98
- SHA512 df4a742d9f5da89888a154f4eef3964bf5574f4d679088aa03fc58e8309f06ea942ea291fa2acd87e92c922c59845c1b695d9dd736e3f7b99316c08dd6968a1d
- SSDEEP 1536:AqTQa7NVNPHYUYUbzh97IBfusdpqKmY7:A5ANVHYUbz3kJGz
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
68094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
a ton of cumme/cumme - Copy (27).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 390f2329d720595861f5bc5bf65cccdd0a76639197f15fb1529e66736a6f6a41
- MD5 76034e5a2c3a49ec8232f011d5572d84
- SHA1 9dae727f33662a0411fb0f49a51c845fddbb5b98
- SHA512 df4a742d9f5da89888a154f4eef3964bf5574f4d679088aa03fc58e8309f06ea942ea291fa2acd87e92c922c59845c1b695d9dd736e3f7b99316c08dd6968a1d
- SSDEEP 1536:AqTQa7NVNPHYUYUbzh97IBfusdpqKmY7:A5ANVHYUbz3kJGz
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
68094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
a ton of cumme/cumme - Copy (28).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 390f2329d720595861f5bc5bf65cccdd0a76639197f15fb1529e66736a6f6a41
- MD5 76034e5a2c3a49ec8232f011d5572d84
- SHA1 9dae727f33662a0411fb0f49a51c845fddbb5b98
- SHA512 df4a742d9f5da89888a154f4eef3964bf5574f4d679088aa03fc58e8309f06ea942ea291fa2acd87e92c922c59845c1b695d9dd736e3f7b99316c08dd6968a1d
- SSDEEP 1536:AqTQa7NVNPHYUYUbzh97IBfusdpqKmY7:A5ANVHYUbz3kJGz
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
68094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
a ton of cumme/cumme - Copy (29).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 390f2329d720595861f5bc5bf65cccdd0a76639197f15fb1529e66736a6f6a41
- MD5 76034e5a2c3a49ec8232f011d5572d84
- SHA1 9dae727f33662a0411fb0f49a51c845fddbb5b98
- SHA512 df4a742d9f5da89888a154f4eef3964bf5574f4d679088aa03fc58e8309f06ea942ea291fa2acd87e92c922c59845c1b695d9dd736e3f7b99316c08dd6968a1d
- SSDEEP 1536:AqTQa7NVNPHYUYUbzh97IBfusdpqKmY7:A5ANVHYUbz3kJGz
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
68094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
a ton of cumme/cumme - Copy (3).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 390f2329d720595861f5bc5bf65cccdd0a76639197f15fb1529e66736a6f6a41
- MD5 76034e5a2c3a49ec8232f011d5572d84
- SHA1 9dae727f33662a0411fb0f49a51c845fddbb5b98
- SHA512 df4a742d9f5da89888a154f4eef3964bf5574f4d679088aa03fc58e8309f06ea942ea291fa2acd87e92c922c59845c1b695d9dd736e3f7b99316c08dd6968a1d
- SSDEEP 1536:AqTQa7NVNPHYUYUbzh97IBfusdpqKmY7:A5ANVHYUbz3kJGz
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
68094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
a ton of cumme/cumme - Copy (30).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 390f2329d720595861f5bc5bf65cccdd0a76639197f15fb1529e66736a6f6a41
- MD5 76034e5a2c3a49ec8232f011d5572d84
- SHA1 9dae727f33662a0411fb0f49a51c845fddbb5b98
- SHA512 df4a742d9f5da89888a154f4eef3964bf5574f4d679088aa03fc58e8309f06ea942ea291fa2acd87e92c922c59845c1b695d9dd736e3f7b99316c08dd6968a1d
- SSDEEP 1536:AqTQa7NVNPHYUYUbzh97IBfusdpqKmY7:A5ANVHYUbz3kJGz
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
68094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
a ton of cumme/cumme - Copy (31).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 390f2329d720595861f5bc5bf65cccdd0a76639197f15fb1529e66736a6f6a41
- MD5 76034e5a2c3a49ec8232f011d5572d84
- SHA1 9dae727f33662a0411fb0f49a51c845fddbb5b98
- SHA512 df4a742d9f5da89888a154f4eef3964bf5574f4d679088aa03fc58e8309f06ea942ea291fa2acd87e92c922c59845c1b695d9dd736e3f7b99316c08dd6968a1d
- SSDEEP 1536:AqTQa7NVNPHYUYUbzh97IBfusdpqKmY7:A5ANVHYUbz3kJGz
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
68094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
a ton of cumme/cumme - Copy (4).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 390f2329d720595861f5bc5bf65cccdd0a76639197f15fb1529e66736a6f6a41
- MD5 76034e5a2c3a49ec8232f011d5572d84
- SHA1 9dae727f33662a0411fb0f49a51c845fddbb5b98
- SHA512 df4a742d9f5da89888a154f4eef3964bf5574f4d679088aa03fc58e8309f06ea942ea291fa2acd87e92c922c59845c1b695d9dd736e3f7b99316c08dd6968a1d
- SSDEEP 1536:AqTQa7NVNPHYUYUbzh97IBfusdpqKmY7:A5ANVHYUbz3kJGz
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
68094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
a ton of cumme/cumme - Copy (5).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 390f2329d720595861f5bc5bf65cccdd0a76639197f15fb1529e66736a6f6a41
- MD5 76034e5a2c3a49ec8232f011d5572d84
- SHA1 9dae727f33662a0411fb0f49a51c845fddbb5b98
- SHA512 df4a742d9f5da89888a154f4eef3964bf5574f4d679088aa03fc58e8309f06ea942ea291fa2acd87e92c922c59845c1b695d9dd736e3f7b99316c08dd6968a1d
- SSDEEP 1536:AqTQa7NVNPHYUYUbzh97IBfusdpqKmY7:A5ANVHYUbz3kJGz
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
68094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
a ton of cumme/cumme - Copy (6).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 390f2329d720595861f5bc5bf65cccdd0a76639197f15fb1529e66736a6f6a41
- MD5 76034e5a2c3a49ec8232f011d5572d84
- SHA1 9dae727f33662a0411fb0f49a51c845fddbb5b98
- SHA512 df4a742d9f5da89888a154f4eef3964bf5574f4d679088aa03fc58e8309f06ea942ea291fa2acd87e92c922c59845c1b695d9dd736e3f7b99316c08dd6968a1d
- SSDEEP 1536:AqTQa7NVNPHYUYUbzh97IBfusdpqKmY7:A5ANVHYUbz3kJGz
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
68094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
a ton of cumme/cumme - Copy (7).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 390f2329d720595861f5bc5bf65cccdd0a76639197f15fb1529e66736a6f6a41
- MD5 76034e5a2c3a49ec8232f011d5572d84
- SHA1 9dae727f33662a0411fb0f49a51c845fddbb5b98
- SHA512 df4a742d9f5da89888a154f4eef3964bf5574f4d679088aa03fc58e8309f06ea942ea291fa2acd87e92c922c59845c1b695d9dd736e3f7b99316c08dd6968a1d
- SSDEEP 1536:AqTQa7NVNPHYUYUbzh97IBfusdpqKmY7:A5ANVHYUbz3kJGz
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
68094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
a ton of cumme/cumme - Copy (8).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 390f2329d720595861f5bc5bf65cccdd0a76639197f15fb1529e66736a6f6a41
- MD5 76034e5a2c3a49ec8232f011d5572d84
- SHA1 9dae727f33662a0411fb0f49a51c845fddbb5b98
- SHA512 df4a742d9f5da89888a154f4eef3964bf5574f4d679088aa03fc58e8309f06ea942ea291fa2acd87e92c922c59845c1b695d9dd736e3f7b99316c08dd6968a1d
- SSDEEP 1536:AqTQa7NVNPHYUYUbzh97IBfusdpqKmY7:A5ANVHYUbz3kJGz
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
68094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
a ton of cumme/cumme - Copy (9).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 390f2329d720595861f5bc5bf65cccdd0a76639197f15fb1529e66736a6f6a41
- MD5 76034e5a2c3a49ec8232f011d5572d84
- SHA1 9dae727f33662a0411fb0f49a51c845fddbb5b98
- SHA512 df4a742d9f5da89888a154f4eef3964bf5574f4d679088aa03fc58e8309f06ea942ea291fa2acd87e92c922c59845c1b695d9dd736e3f7b99316c08dd6968a1d
- SSDEEP 1536:AqTQa7NVNPHYUYUbzh97IBfusdpqKmY7:A5ANVHYUbz3kJGz
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
68094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
a ton of cumme/cumme - Copy.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 390f2329d720595861f5bc5bf65cccdd0a76639197f15fb1529e66736a6f6a41
- MD5 76034e5a2c3a49ec8232f011d5572d84
- SHA1 9dae727f33662a0411fb0f49a51c845fddbb5b98
- SHA512 df4a742d9f5da89888a154f4eef3964bf5574f4d679088aa03fc58e8309f06ea942ea291fa2acd87e92c922c59845c1b695d9dd736e3f7b99316c08dd6968a1d
- SSDEEP 1536:AqTQa7NVNPHYUYUbzh97IBfusdpqKmY7:A5ANVHYUbz3kJGz
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
68094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
a ton of cumme/cumme.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 390f2329d720595861f5bc5bf65cccdd0a76639197f15fb1529e66736a6f6a41
- MD5 76034e5a2c3a49ec8232f011d5572d84
- SHA1 9dae727f33662a0411fb0f49a51c845fddbb5b98
- SHA512 df4a742d9f5da89888a154f4eef3964bf5574f4d679088aa03fc58e8309f06ea942ea291fa2acd87e92c922c59845c1b695d9dd736e3f7b99316c08dd6968a1d
- SSDEEP 1536:AqTQa7NVNPHYUYUbzh97IBfusdpqKmY7:A5ANVHYUbz3kJGz
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
68094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ