Deep Malware Analysis of 1ff95900cce08694505425ff7dd51ad4 | md5: 1ff95900cce08694505425ff7dd51ad4 | .Net | PE (Portable Executable) | Executable | Managed .NET | PE File Layout | Win 32 Exe | x86 | SOS: 0.81 | RAT | AsyncRAT

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Very high

MD5	1ff95900cce08694505425ff7dd51ad4
Sha1	bd21398e2d5db25b17b61eefbddef1efe81329c7
Sha256	5854b1c0839d6388d6d006338303337dd1de5001dcdff10dd13080a17b71fb87
Sha384	7fbb73728213da0cedda52e052a60264154c36b1a18aa9748da940491eed85342d178e4c0eadd5c8e9650d9d8f88835c
Sha512	7784be22cb3d7465d6b0bc3cc8155a8b156ed56270161284ce2cf7ac9c03468e9c43a8fe3d0399c75b0cde55f6e005675eb0d39a7ac5fbc9f2df133baad57c5c
SSDeep	768:AuYHKTsufqG9vSLjWUvlPRmo2qbMthx4sNzizZ/DPIPfQkMz0bt+M9Fa7aKlkNWc:AuYHKTsjMvSX2VddNw/MPfLRbt+MPa96
TLSH	27233C043BE9C166F2BE4F7858F32245867AF2673603D54E2CC4429B5A23FC59A426FD

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Config. Field	Value
Key (AES_256)	N0Ftemhuhuhuhuhuhuhuhuhuhuhu
Pastebin	-huhuhuhu
Certificate	MIIE8jhuhuhuhuhuhuhuhuhuhuhu
ServerSignature	WvG3uwhuhuhuhuhuhuhuhuhuhuhu
Install	thuhuhuhu
BDOS	thuhuhuhu
Anti-VM	thuhuhuhu
Install File	Chromhuhuhuhuhuhuhu
Install-Folder	%Aphuhuhuhu
Hosts	forshuhuhuhu
Ports	4huhuhuhu
Mutex	SlSChuhuhuhu
Version	0huhuhuhu
Delay	3huhuhuhu
Group	forshuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	cXfyhZquZLR
Full Name	cXfyhZquZLR
EntryPoint	System.Void oNJMTCUshwqcigG.boZDaLmGCINY::Main()
Scope Name	cXfyhZquZLR
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	svchost
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	120
Info	PE Detect: PeReader OK (file layout)
Main Method	System.Void oNJMTCUshwqcigG.boZDaLmGCINY::Main()
Main IL Instruction Count	51
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String oNJMTCUshwqcigG.KAqgDmkdBjJF::ugFFGtSwYMyaW call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean oNJMTCUshwqcigG.KAqgDmkdBjJF::TZsaegnhyINst() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean iDuMqCsoLlgok.yGdIhOElCdKn::ytyeexaBUSGv() brtrue IL_0043: ldsfld System.String oNJMTCUshwqcigG.KAqgDmkdBjJF::ftklXWxEYKHit ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String oNJMTCUshwqcigG.KAqgDmkdBjJF::ftklXWxEYKHit call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String oNJMTCUshwqcigG.KAqgDmkdBjJF::IfVGXyqdNhJBkkfyI call System.Void iDuMqCsoLlgok.hTYePTPfUAm::gDOBDvVNIYgTs() ldsfld System.String oNJMTCUshwqcigG.KAqgDmkdBjJF::IfVGXyqdNhJBkkfyI call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String oNJMTCUshwqcigG.KAqgDmkdBjJF::iyLlApqNyLPmoS call System.Void zwjhiOMvHefEwV.otjovTswaSpMK::jnSySuvvjXw() ldsfld System.String oNJMTCUshwqcigG.KAqgDmkdBjJF::iyLlApqNyLPmoS call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void iDuMqCsoLlgok.FOWMKrltjdaAfi::CdrskamjTMU() call System.Boolean iDuMqCsoLlgok.FOWMKrltjdaAfi::fhvoAhLqTamIIhs() brfalse IL_0089: call System.Void iDuMqCsoLlgok.FOWMKrltjdaAfi::CdrskamjTMU() call System.Void iDuMqCsoLlgok.AFvvcHaHZFF::PhWQdGhuhjYVyIu() call System.Void iDuMqCsoLlgok.FOWMKrltjdaAfi::CdrskamjTMU() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean MqCqOfZvvEDO.AuKCuKLXmHosMh::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void MqCqOfZvvEDO.AuKCuKLXmHosMh::ZPelrEajcdCpkI() call System.Void MqCqOfZvvEDO.AuKCuKLXmHosMh::MWQauvuNlc() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Module Name	cXfyhZquZLR
Full Name	cXfyhZquZLR
EntryPoint	System.Void oNJMTCUshwqcigG.boZDaLmGCINY::Main()
Scope Name	cXfyhZquZLR
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	svchost
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	120
Main Method	System.Void oNJMTCUshwqcigG.boZDaLmGCINY::Main()
Main IL Instruction Count	51
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String oNJMTCUshwqcigG.KAqgDmkdBjJF::ugFFGtSwYMyaW call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean oNJMTCUshwqcigG.KAqgDmkdBjJF::TZsaegnhyINst() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean iDuMqCsoLlgok.yGdIhOElCdKn::ytyeexaBUSGv() brtrue IL_0043: ldsfld System.String oNJMTCUshwqcigG.KAqgDmkdBjJF::ftklXWxEYKHit ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String oNJMTCUshwqcigG.KAqgDmkdBjJF::ftklXWxEYKHit call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String oNJMTCUshwqcigG.KAqgDmkdBjJF::IfVGXyqdNhJBkkfyI call System.Void iDuMqCsoLlgok.hTYePTPfUAm::gDOBDvVNIYgTs() ldsfld System.String oNJMTCUshwqcigG.KAqgDmkdBjJF::IfVGXyqdNhJBkkfyI call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String oNJMTCUshwqcigG.KAqgDmkdBjJF::iyLlApqNyLPmoS call System.Void zwjhiOMvHefEwV.otjovTswaSpMK::jnSySuvvjXw() ldsfld System.String oNJMTCUshwqcigG.KAqgDmkdBjJF::iyLlApqNyLPmoS call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void iDuMqCsoLlgok.FOWMKrltjdaAfi::CdrskamjTMU() call System.Boolean iDuMqCsoLlgok.FOWMKrltjdaAfi::fhvoAhLqTamIIhs() brfalse IL_0089: call System.Void iDuMqCsoLlgok.FOWMKrltjdaAfi::CdrskamjTMU() call System.Void iDuMqCsoLlgok.AFvvcHaHZFF::PhWQdGhuhjYVyIu() call System.Void iDuMqCsoLlgok.FOWMKrltjdaAfi::CdrskamjTMU() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean MqCqOfZvvEDO.AuKCuKLXmHosMh::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void MqCqOfZvvEDO.AuKCuKLXmHosMh::ZPelrEajcdCpkI() call System.Void MqCqOfZvvEDO.AuKCuKLXmHosMh::MWQauvuNlc() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop

Key (AES_256) MUTEXmalicious

N0Ftemhuhuhuhuhuhuhuhuhuhuhu

CnC CNCmalicious

forshuhuhuhu

Ports PORTmalicious

4huhuhuhu

Mutex MUTEXmalicious

SlSChuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential