Deep Malware Analysis of 385dcaaba75b0953a5108277521cd830 | md5: 385dcaaba75b0953a5108277521cd830 | .Net | PE (Portable Executable) | SOS: 0.80 | Executable | Managed .NET | PE File Layout | Win 32 Exe | x86 | RAT | AsyncRAT

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Very high

MD5	385dcaaba75b0953a5108277521cd830
Sha1	abe5d93566b6604a0ece61414fda0613dd6b6bed
Sha256	5f12438f708cb1b78262307a5357870c3915a9397872e7fb8166c60ab58ea3ea
Sha384	1e457655763fcee7daa40bd63a7dbab91de03a59c8867b83cf3de2ff8b10eef04ef567f8bed4b49baae0b762b97253d9
Sha512	f1d8733cb1a040913fc37cef29244f984fa0e03c0d638d9fd3eba57a3a24d835e8fefa36a98e63319e30b2b66011e7c23d9f56f90f62ec27965565fa1d8df458
SSDeep	768:guwpFTAY3IQWUe9jqmo2qLu2uVkHT9PIKblANB0bexiuQNiIl1ucBDZQx:guwpFTA4/2f2zHT68l0WbeIZiG1u6dQx
TLSH	DB234D0037E9C12BF2BE5F7899F27245867AF6673602D64E1CC401DB5623BC29A425FE

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Config. Field	Value
Key (AES_256)	cGJFOHhuhuhuhuhuhuhuhuhuhuhu
Pastebin	-huhuhuhu
Certificate	MIIE8jhuhuhuhuhuhuhuhuhuhuhu
ServerSignature	WF1ysQhuhuhuhuhuhuhuhuhuhuhu
Install	thuhuhuhu
BDOS	thuhuhuhu
Anti-VM	thuhuhuhu
Install File	svchuhuhuhu
Install-Folder	%Aphuhuhuhu
Hosts	casinhuhuhuhuhuhuhu
Ports	4huhuhuhu
Mutex	58lRhuhuhuhu
Version	0huhuhuhu
Delay	3huhuhuhu
Group	casinhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	bYOALDRPRqBVH
Full Name	bYOALDRPRqBVH
EntryPoint	System.Void YfTcbPUipGcW.DMPugozWJUXAzt::Main()
Scope Name	bYOALDRPRqBVH
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	sirusrat
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	120
Main Method	System.Void YfTcbPUipGcW.DMPugozWJUXAzt::Main()
Main IL Instruction Count	51
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String YfTcbPUipGcW.EJZJjGHAKakw::kptdWFTxkWUr call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean YfTcbPUipGcW.EJZJjGHAKakw::vcQZwffEDmO() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean kImsWDHRWCIC.VwxphbbAVXja::XKAWQJHbDgfg() brtrue IL_0043: ldsfld System.String YfTcbPUipGcW.EJZJjGHAKakw::KWrveVQaibxoj ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String YfTcbPUipGcW.EJZJjGHAKakw::KWrveVQaibxoj call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String YfTcbPUipGcW.EJZJjGHAKakw::axIrxTZEIxjWBbJ call System.Void kImsWDHRWCIC.DJYqIolQYxzbTGoA::mUkfYBWeuWcQ() ldsfld System.String YfTcbPUipGcW.EJZJjGHAKakw::axIrxTZEIxjWBbJ call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String YfTcbPUipGcW.EJZJjGHAKakw::UBHXBcbryaWKJe call System.Void mQcHcTHBdmgQhH.eGcOyPFPtXDQ::fBsYkqywmNLnyp() ldsfld System.String YfTcbPUipGcW.EJZJjGHAKakw::UBHXBcbryaWKJe call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void kImsWDHRWCIC.QySMWbnbqNn::ApdzfrghorTV() call System.Boolean kImsWDHRWCIC.QySMWbnbqNn::lhxYUSzGDLMTHn() brfalse IL_0089: call System.Void kImsWDHRWCIC.QySMWbnbqNn::ApdzfrghorTV() call System.Void kImsWDHRWCIC.bTCqqEbwqlyOEOI::IJkapTrmTFwg() call System.Void kImsWDHRWCIC.QySMWbnbqNn::ApdzfrghorTV() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean prGhoMlrOZgSIO.HybyPKIrgABlWNd::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void prGhoMlrOZgSIO.HybyPKIrgABlWNd::JQBYUoXrSpD() call System.Void prGhoMlrOZgSIO.HybyPKIrgABlWNd::RfCGJuavFgX() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Info	PE Detect: PeReader OK (file layout)
Module Name	bYOALDRPRqBVH
Full Name	bYOALDRPRqBVH
EntryPoint	System.Void YfTcbPUipGcW.DMPugozWJUXAzt::Main()
Scope Name	bYOALDRPRqBVH
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	sirusrat
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	120
Main Method	System.Void YfTcbPUipGcW.DMPugozWJUXAzt::Main()
Main IL Instruction Count	51
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String YfTcbPUipGcW.EJZJjGHAKakw::kptdWFTxkWUr call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean YfTcbPUipGcW.EJZJjGHAKakw::vcQZwffEDmO() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean kImsWDHRWCIC.VwxphbbAVXja::XKAWQJHbDgfg() brtrue IL_0043: ldsfld System.String YfTcbPUipGcW.EJZJjGHAKakw::KWrveVQaibxoj ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String YfTcbPUipGcW.EJZJjGHAKakw::KWrveVQaibxoj call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String YfTcbPUipGcW.EJZJjGHAKakw::axIrxTZEIxjWBbJ call System.Void kImsWDHRWCIC.DJYqIolQYxzbTGoA::mUkfYBWeuWcQ() ldsfld System.String YfTcbPUipGcW.EJZJjGHAKakw::axIrxTZEIxjWBbJ call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String YfTcbPUipGcW.EJZJjGHAKakw::UBHXBcbryaWKJe call System.Void mQcHcTHBdmgQhH.eGcOyPFPtXDQ::fBsYkqywmNLnyp() ldsfld System.String YfTcbPUipGcW.EJZJjGHAKakw::UBHXBcbryaWKJe call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void kImsWDHRWCIC.QySMWbnbqNn::ApdzfrghorTV() call System.Boolean kImsWDHRWCIC.QySMWbnbqNn::lhxYUSzGDLMTHn() brfalse IL_0089: call System.Void kImsWDHRWCIC.QySMWbnbqNn::ApdzfrghorTV() call System.Void kImsWDHRWCIC.bTCqqEbwqlyOEOI::IJkapTrmTFwg() call System.Void kImsWDHRWCIC.QySMWbnbqNn::ApdzfrghorTV() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean prGhoMlrOZgSIO.HybyPKIrgABlWNd::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void prGhoMlrOZgSIO.HybyPKIrgABlWNd::JQBYUoXrSpD() call System.Void prGhoMlrOZgSIO.HybyPKIrgABlWNd::RfCGJuavFgX() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop

Key (AES_256) MUTEXmalicious

cGJFOHhuhuhuhuhuhuhuhuhuhuhu

CnC CNCmalicious

casinhuhuhuhuhuhuhu

Ports PORTmalicious

4huhuhuhu

Mutex MUTEXmalicious

58lRhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential