Deep Malware Analysis of 164548d73e249f6e27631923170abec2 | md5: 164548d73e249f6e27631923170abec2 | .Net | PE (Portable Executable) | SOS: 0.81 | Executable | Managed .NET | PE File Layout | Win 32 Exe | x86 | RAT | AsyncRAT

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Very high

MD5	164548d73e249f6e27631923170abec2
Sha1	117247cf69d4b2aac633b314d3530b24f03a59fa
Sha256	43d465e80dc34e3aa79c228e61404c83bab19afa63545f47d49435a8ff208fd5
Sha384	be450797065685a4768d4b125ec61bbaa230bad665b247d3f9bdacba45a59cdb1e11e079b84827f0ef9f2128c638b105
Sha512	5663cf7222f63c2094217c2fc6e55ccc50545b06572a8cd229dd57883781f8aad5224ade3e1698ae5a10ed713237a5635288ddafe6af6be9f13c9478bc9c0b02
SSDeep	768:guYHKTsufqG9vSLjWUvlPRmo2qb7b8Cl4GXIPIPwgT3CJ0bWGp4SCPZ75KmldA+z:guYHKTsjMvSX204GXtPwgLbWYpa57ldN
TLSH	9F234C0037E98137F2BE0F786DF26245857AB6677603D54E2CC441D75A23FC29A42AFA

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Config. Field	Value
Key (AES_256)	MWlwMGhuhuhuhuhuhuhuhuhuhuhu
Pastebin	-huhuhuhu
Certificate	MIIE8jhuhuhuhuhuhuhuhuhuhuhu
ServerSignature	VLh9mOhuhuhuhuhuhuhuhuhuhuhu
Install	thuhuhuhu
BDOS	thuhuhuhu
Anti-VM	thuhuhuhu
Install File	Chromhuhuhuhuhuhuhu
Install-Folder	%Aphuhuhuhu
Hosts	main-huhuhuhuhuhuhu
Ports	4huhuhuhu
Mutex	FFBphuhuhuhu
Version	0huhuhuhu
Delay	3huhuhuhu
Group	main-huhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	PdLqvtCKoIWKj
Full Name	PdLqvtCKoIWKj
EntryPoint	System.Void AGtREdUfbO.icaDtPTzahksm::Main()
Scope Name	PdLqvtCKoIWKj
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	saitama
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	120
Main Method	System.Void AGtREdUfbO.icaDtPTzahksm::Main()
Main IL Instruction Count	51
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String AGtREdUfbO.TcWGDetbHL::FHcMRyCviCph call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean AGtREdUfbO.TcWGDetbHL::iUqEVaPvBkHs() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean qNFIkwDBoc.WpiIxCwwdvRx::JLUIesWAFeKzr() brtrue IL_0043: ldsfld System.String AGtREdUfbO.TcWGDetbHL::DUxHqQtMUpxVMHGi ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String AGtREdUfbO.TcWGDetbHL::DUxHqQtMUpxVMHGi call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String AGtREdUfbO.TcWGDetbHL::bwvKovNjpoEgUOD call System.Void qNFIkwDBoc.vWTKzvHVsShANS::xKrbinuXSETEC() ldsfld System.String AGtREdUfbO.TcWGDetbHL::bwvKovNjpoEgUOD call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String AGtREdUfbO.TcWGDetbHL::DUbEJXMUhHy call System.Void XHGlRTaAeXN.HUEBTIocLz::HTiaVbXeNmtoh() ldsfld System.String AGtREdUfbO.TcWGDetbHL::DUbEJXMUhHy call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void qNFIkwDBoc.dlqDVyjxREbpjQR::cTiPVvxyeavFCVrO() call System.Boolean qNFIkwDBoc.dlqDVyjxREbpjQR::oVsWBujpZnxL() brfalse IL_0089: call System.Void qNFIkwDBoc.dlqDVyjxREbpjQR::cTiPVvxyeavFCVrO() call System.Void qNFIkwDBoc.pkuDSuKKlyrP::nNozBepPjAEF() call System.Void qNFIkwDBoc.dlqDVyjxREbpjQR::cTiPVvxyeavFCVrO() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean fOqUvHYfnCVb.KQcBbTkiqSZUR::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void fOqUvHYfnCVb.KQcBbTkiqSZUR::pKaFlRFbXxt() call System.Void fOqUvHYfnCVb.KQcBbTkiqSZUR::lLqGaIhoCenrM() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Info	PE Detect: PeReader OK (file layout)
Module Name	PdLqvtCKoIWKj
Full Name	PdLqvtCKoIWKj
EntryPoint	System.Void AGtREdUfbO.icaDtPTzahksm::Main()
Scope Name	PdLqvtCKoIWKj
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	saitama
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	120
Main Method	System.Void AGtREdUfbO.icaDtPTzahksm::Main()
Main IL Instruction Count	51
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String AGtREdUfbO.TcWGDetbHL::FHcMRyCviCph call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean AGtREdUfbO.TcWGDetbHL::iUqEVaPvBkHs() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean qNFIkwDBoc.WpiIxCwwdvRx::JLUIesWAFeKzr() brtrue IL_0043: ldsfld System.String AGtREdUfbO.TcWGDetbHL::DUxHqQtMUpxVMHGi ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String AGtREdUfbO.TcWGDetbHL::DUxHqQtMUpxVMHGi call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String AGtREdUfbO.TcWGDetbHL::bwvKovNjpoEgUOD call System.Void qNFIkwDBoc.vWTKzvHVsShANS::xKrbinuXSETEC() ldsfld System.String AGtREdUfbO.TcWGDetbHL::bwvKovNjpoEgUOD call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String AGtREdUfbO.TcWGDetbHL::DUbEJXMUhHy call System.Void XHGlRTaAeXN.HUEBTIocLz::HTiaVbXeNmtoh() ldsfld System.String AGtREdUfbO.TcWGDetbHL::DUbEJXMUhHy call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void qNFIkwDBoc.dlqDVyjxREbpjQR::cTiPVvxyeavFCVrO() call System.Boolean qNFIkwDBoc.dlqDVyjxREbpjQR::oVsWBujpZnxL() brfalse IL_0089: call System.Void qNFIkwDBoc.dlqDVyjxREbpjQR::cTiPVvxyeavFCVrO() call System.Void qNFIkwDBoc.pkuDSuKKlyrP::nNozBepPjAEF() call System.Void qNFIkwDBoc.dlqDVyjxREbpjQR::cTiPVvxyeavFCVrO() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean fOqUvHYfnCVb.KQcBbTkiqSZUR::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void fOqUvHYfnCVb.KQcBbTkiqSZUR::pKaFlRFbXxt() call System.Void fOqUvHYfnCVb.KQcBbTkiqSZUR::lLqGaIhoCenrM() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop

Key (AES_256) MUTEXmalicious

MWlwMGhuhuhuhuhuhuhuhuhuhuhu

CnC CNCmalicious

main-huhuhuhuhuhuhu

Ports PORTmalicious

4huhuhuhu

Mutex MUTEXmalicious

FFBphuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential