Malicious
Malicious

385dcaaba75b0953a5108277521cd830

PE Executable
MD5: 385dcaaba75b0953a5108277521cd830
Size: 48.64 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 385dcaaba75b0953a5108277521cd830
Sha1 abe5d93566b6604a0ece61414fda0613dd6b6bed
Sha256 5f12438f708cb1b78262307a5357870c3915a9397872e7fb8166c60ab58ea3ea
Sha384 1e457655763fcee7daa40bd63a7dbab91de03a59c8867b83cf3de2ff8b10eef04ef567f8bed4b49baae0b762b97253d9
Sha512 f1d8733cb1a040913fc37cef29244f984fa0e03c0d638d9fd3eba57a3a24d835e8fefa36a98e63319e30b2b66011e7c23d9f56f90f62ec27965565fa1d8df458
SSDeep 768:guwpFTAY3IQWUe9jqmo2qLu2uVkHT9PIKblANB0bexiuQNiIl1ucBDZQx:guwpFTA4/2f2zHT68l0WbeIZiG1u6dQx
TLSH DB234D0037E9C12BF2BE5F7899F27245867AF6673602D64E1CC401DB5623BC29A425FE
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
385dcaaba75b0953a5108277521cd830
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Config. Field Value
Key (AES_256) cGJFOHhuhuhuhuhuhuhuhuhuhuhu
Pastebin -huhuhuhu
Certificate MIIE8jhuhuhuhuhuhuhuhuhuhuhu
ServerSignature WF1ysQhuhuhuhuhuhuhuhuhuhuhu
Install thuhuhuhu
BDOS thuhuhuhu
Anti-VM thuhuhuhu
Install File svchuhuhuhu
Install-Folder %Aphuhuhuhu
Hosts casinhuhuhuhuhuhuhu
Ports 4huhuhuhu
Mutex 58lRhuhuhuhu
Version 0huhuhuhu
Delay 3huhuhuhu
Group casinhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
bYOALDRPRqBVH
Full Name
bYOALDRPRqBVH
EntryPoint
System.Void YfTcbPUipGcW.DMPugozWJUXAzt::Main()
Scope Name
bYOALDRPRqBVH
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
sirusrat
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
120
Main Method
System.Void YfTcbPUipGcW.DMPugozWJUXAzt::Main()
Main IL Instruction Count
51
Main IL 
ldc.i4.0 <null>
stloc.0 <null>
br IL_0015: ldloc.0
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
ldc.i4.1 <null>
add <null>
stloc.0 <null>
ldloc.0 <null>
ldsfld System.String YfTcbPUipGcW.EJZJjGHAKakw::kptdWFTxkWUr
call System.Int32 System.Convert::ToInt32(System.String)
blt.s IL_0007: ldc.i4 1000
call System.Boolean YfTcbPUipGcW.EJZJjGHAKakw::vcQZwffEDmO()
brtrue IL_0032: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Boolean kImsWDHRWCIC.VwxphbbAVXja::XKAWQJHbDgfg()
brtrue IL_0043: ldsfld System.String YfTcbPUipGcW.EJZJjGHAKakw::KWrveVQaibxoj
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String YfTcbPUipGcW.EJZJjGHAKakw::KWrveVQaibxoj
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_0057: ldsfld System.String YfTcbPUipGcW.EJZJjGHAKakw::axIrxTZEIxjWBbJ
call System.Void kImsWDHRWCIC.DJYqIolQYxzbTGoA::mUkfYBWeuWcQ()
ldsfld System.String YfTcbPUipGcW.EJZJjGHAKakw::axIrxTZEIxjWBbJ
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_006B: ldsfld System.String YfTcbPUipGcW.EJZJjGHAKakw::UBHXBcbryaWKJe
call System.Void mQcHcTHBdmgQhH.eGcOyPFPtXDQ::fBsYkqywmNLnyp()
ldsfld System.String YfTcbPUipGcW.EJZJjGHAKakw::UBHXBcbryaWKJe
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_0089: call System.Void kImsWDHRWCIC.QySMWbnbqNn::ApdzfrghorTV()
call System.Boolean kImsWDHRWCIC.QySMWbnbqNn::lhxYUSzGDLMTHn()
brfalse IL_0089: call System.Void kImsWDHRWCIC.QySMWbnbqNn::ApdzfrghorTV()
call System.Void kImsWDHRWCIC.bTCqqEbwqlyOEOI::IJkapTrmTFwg()
call System.Void kImsWDHRWCIC.QySMWbnbqNn::ApdzfrghorTV()
leave IL_0099: nop
pop <null>
leave IL_0099: nop
nop <null>
call System.Boolean prGhoMlrOZgSIO.HybyPKIrgABlWNd::get_IsConnected()
brtrue IL_00AE: leave IL_00B9
call System.Void prGhoMlrOZgSIO.HybyPKIrgABlWNd::JQBYUoXrSpD()
call System.Void prGhoMlrOZgSIO.HybyPKIrgABlWNd::RfCGJuavFgX()
leave IL_00B9: ldc.i4 5000
pop <null>
leave IL_00B9: ldc.i4 5000
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_0099: nop
Info
PE Detect: PeReader OK (file layout)
Module Name
bYOALDRPRqBVH
Full Name
bYOALDRPRqBVH
EntryPoint
System.Void YfTcbPUipGcW.DMPugozWJUXAzt::Main()
Scope Name
bYOALDRPRqBVH
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
sirusrat
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
120
Main Method
System.Void YfTcbPUipGcW.DMPugozWJUXAzt::Main()
Main IL Instruction Count
51
Main IL 
ldc.i4.0 <null>
stloc.0 <null>
br IL_0015: ldloc.0
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
ldc.i4.1 <null>
add <null>
stloc.0 <null>
ldloc.0 <null>
ldsfld System.String YfTcbPUipGcW.EJZJjGHAKakw::kptdWFTxkWUr
call System.Int32 System.Convert::ToInt32(System.String)
blt.s IL_0007: ldc.i4 1000
call System.Boolean YfTcbPUipGcW.EJZJjGHAKakw::vcQZwffEDmO()
brtrue IL_0032: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Boolean kImsWDHRWCIC.VwxphbbAVXja::XKAWQJHbDgfg()
brtrue IL_0043: ldsfld System.String YfTcbPUipGcW.EJZJjGHAKakw::KWrveVQaibxoj
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String YfTcbPUipGcW.EJZJjGHAKakw::KWrveVQaibxoj
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_0057: ldsfld System.String YfTcbPUipGcW.EJZJjGHAKakw::axIrxTZEIxjWBbJ
call System.Void kImsWDHRWCIC.DJYqIolQYxzbTGoA::mUkfYBWeuWcQ()
ldsfld System.String YfTcbPUipGcW.EJZJjGHAKakw::axIrxTZEIxjWBbJ
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_006B: ldsfld System.String YfTcbPUipGcW.EJZJjGHAKakw::UBHXBcbryaWKJe
call System.Void mQcHcTHBdmgQhH.eGcOyPFPtXDQ::fBsYkqywmNLnyp()
ldsfld System.String YfTcbPUipGcW.EJZJjGHAKakw::UBHXBcbryaWKJe
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_0089: call System.Void kImsWDHRWCIC.QySMWbnbqNn::ApdzfrghorTV()
call System.Boolean kImsWDHRWCIC.QySMWbnbqNn::lhxYUSzGDLMTHn()
brfalse IL_0089: call System.Void kImsWDHRWCIC.QySMWbnbqNn::ApdzfrghorTV()
call System.Void kImsWDHRWCIC.bTCqqEbwqlyOEOI::IJkapTrmTFwg()
call System.Void kImsWDHRWCIC.QySMWbnbqNn::ApdzfrghorTV()
leave IL_0099: nop
pop <null>
leave IL_0099: nop
nop <null>
call System.Boolean prGhoMlrOZgSIO.HybyPKIrgABlWNd::get_IsConnected()
brtrue IL_00AE: leave IL_00B9
call System.Void prGhoMlrOZgSIO.HybyPKIrgABlWNd::JQBYUoXrSpD()
call System.Void prGhoMlrOZgSIO.HybyPKIrgABlWNd::RfCGJuavFgX()
leave IL_00B9: ldc.i4 5000
pop <null>
leave IL_00B9: ldc.i4 5000
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_0099: nop
Key (AES_256) MUTEXmalicious
cGJFOHhuhuhuhuhuhuhuhuhuhuhu
CnC CNCmalicious
casinhuhuhuhuhuhuhu
Ports PORTmalicious
4huhuhuhu
Mutex MUTEXmalicious
58lRhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
385dcaaba75b0953a5108277521cd830
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Config. Field Value
Key (AES_256) cGJFOHhuhuhuhuhuhuhuhuhuhuhu
Pastebin -huhuhuhu
Certificate MIIE8jhuhuhuhuhuhuhuhuhuhuhu
ServerSignature WF1ysQhuhuhuhuhuhuhuhuhuhuhu
Install thuhuhuhu
BDOS thuhuhuhu
Anti-VM thuhuhuhu
Install File svchuhuhuhu
Install-Folder %Aphuhuhuhu
Hosts casinhuhuhuhuhuhuhu
Ports 4huhuhuhu
Mutex 58lRhuhuhuhu
Version 0huhuhuhu
Delay 3huhuhuhu
Group casinhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Key (AES_256) MUTEXmalicious
cGJFOHhuhuhuhuhuhuhuhuhuhuhu
385dcaaba75b0953a5108277521cd830
CnC CNCmalicious
casinhuhuhuhuhuhuhu
385dcaaba75b0953a5108277521cd830
Ports PORTmalicious
4huhuhuhu
385dcaaba75b0953a5108277521cd830
Mutex MUTEXmalicious
58lRhuhuhuhu
385dcaaba75b0953a5108277521cd830
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙