ac1ec8def049ccbcbe9bb3dca158f7653c8ba85d158f63e544b21c5a0247625e.exe

BENIGN

Mal-ecule

Size 755.0 KB download unavailable

First seen 77 days ago

Analyzed 60 days ago

Objectives

anti-static/obfuscation/binary-metrics Binary has normal code entropy (>5.5)

anti-static/obfuscation/payload PE version resource text

anti-static/pack Near-maximum entropy in .text section

command-and-control/backdoor/rat Go RAT module command handler

command-and-control/dropper/execution .NET assembly with bootstrap-only imports

command-and-control/infrastructure Binary has 4 or fewer sections

evasion/indicator-removal Regex component marker

evasion/masquerade/file Filename has EXE extension

evasion/masquerade/identity Two dotted-quad version strings

evasion/process/injection Regex component marker

communications/http/server Access to ASP.NET HttpContext

binary/section Large high-entropy random executable section

binary .NET Metadata Root (BSJB)

binary/metrics Binary has 1000 or more strings

dotnet .NET assembly detected via BSJB CLR metadata signature

dylib::mscoree links mscoree (CorExeMain)

hardening DEP / NX enabled (NX_COMPAT)

lang/compiler mscorlib reference

package Large binary with few DLL dependencies

binary/anomaly PE version info numeric fields present

20 of 38 traits shown

SHA-256	ac1ec8def049ccbcbe9bb3dca158f7653c8ba85d158f63e544b21c5a0247625e
Filename	ac1ec8def049ccbcbe9bb3dca158f7653c8ba85d158f63e544b21c5a0247625e.exe

Source	harvest

Not seeing what you expected? Let us know