Deep Malware Analysis of 3ba1d62b27d60491904422bbec123493 | md5: 3ba1d62b27d60491904422bbec123493 | RAT | AsyncRAT | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | Win 32 Exe | x86 | .Net | SOS: 0.83

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Very high

MD5	3ba1d62b27d60491904422bbec123493
Sha1	b709e74cbe335b95a06782441bcdc7755ef98c17
Sha256	fd50b29196735ec9680a0f9c8b1c6c49e9bfaf6a98614705751620852ab75d8d
Sha384	d94efbd050aeafa1866ad1e98e469184a2db60d59acaf32705435661ba65d8645fcfebe6ce8799975e7d25d19f623c4c
Sha512	8f69d9dc50fbd38e56f8ef0d12e50715ec5a37543689c9a00ed4667f8ee5b43c0ee9f8267d0c30757e108375ebd94fb7557188ac7be09959274336da7c259f4c
SSDeep	768:eqdpXbXX0fIiNBUFs0ICNQ+0bja58fgvx+3ljWLb6qHK8gZCMnYI6OC12tYcFmVY:etIY1ENQxbja5omTb5er6OYKmVcl
TLSH	A9233D003BE98126E2FE4FB89DF1214686BBF5273502D65E3CC841D65B137C6CA52AF6

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Config. Field	Value
Key (AES_256)	eVlKUXhuhuhuhuhuhuhuhuhuhuhu
Pastebin	-huhuhuhu
Certificate	MIIE8jhuhuhuhuhuhuhuhuhuhuhu
ServerSignature	DidAJqhuhuhuhuhuhuhuhuhuhuhu
Install	thuhuhuhu
BDOS	fhuhuhuhu
Anti-VM	fhuhuhuhu
Install File	svchuhuhuhu
Install-Folder	%Aphuhuhuhu
Version	0.huhuhuhu
Hosts	r2bhuhuhuhu
Ports	4huhuhuhu
Mutex	mkhuhuhuhu
Delay	5huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	tfZbKMzYlSuBUp
Full Name	tfZbKMzYlSuBUp
EntryPoint	System.Void WIgTGtleflkg.xcCXmfJxLJZI::Main()
Scope Name	tfZbKMzYlSuBUp
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Stub
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	130
Main Method	System.Void WIgTGtleflkg.xcCXmfJxLJZI::Main()
Main IL Instruction Count	53
Main IL	ldc.i4.0 <null> stloc.0 <null> br.s IL_0012: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String WIgTGtleflkg.bXTFYqeUmBX::cpkxaPzxwInEyh call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0004: ldc.i4 1000 call System.Boolean WIgTGtleflkg.bXTFYqeUmBX::uYaCRQTXfsMPn() brtrue.s IL_002C: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean kakDoRcGIhz.zrMplhlawPHR::UUFjUvlCkcT() brtrue.s IL_003A: ldsfld System.String WIgTGtleflkg.bXTFYqeUmBX::SwtuxpThpsUL ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String WIgTGtleflkg.bXTFYqeUmBX::SwtuxpThpsUL call System.Boolean System.Convert::ToBoolean(System.String) brfalse.s IL_004B: ldsfld System.String WIgTGtleflkg.bXTFYqeUmBX::PsGwgPRJlwgFX call System.Void kakDoRcGIhz.LoNHUIteJhUoGlda::zGHRNehurIGCP() ldsfld System.String WIgTGtleflkg.bXTFYqeUmBX::PsGwgPRJlwgFX call System.Boolean System.Convert::ToBoolean(System.String) brfalse.s IL_005C: ldsfld System.String WIgTGtleflkg.bXTFYqeUmBX::xjjOrOtgVJBThd call System.Void LUoDPjHSFoIh.ObxmjFLTxGMwSEc::rTyoaSGjUCxxeX() ldsfld System.String WIgTGtleflkg.bXTFYqeUmBX::xjjOrOtgVJBThd call System.Boolean System.Convert::ToBoolean(System.String) brfalse.s IL_0074: call System.Void kakDoRcGIhz.cZpJFcILYecpr::cgsspFXRbsyG() call System.Boolean kakDoRcGIhz.cZpJFcILYecpr::TzuMwJRjyu() brfalse.s IL_0074: call System.Void kakDoRcGIhz.cZpJFcILYecpr::cgsspFXRbsyG() call System.Void kakDoRcGIhz.iUfhNHBlKeBhzd::XQbvwMyzjWbDgtV() call System.Void kakDoRcGIhz.cZpJFcILYecpr::cgsspFXRbsyG() newobj System.Void kakDoRcGIhz.zTonZyNwLU::.ctor() call System.String kakDoRcGIhz.zTonZyNwLU::nTuVwstCbUbwI() pop <null> leave.s IL_0089: call System.Boolean LZMpkjWKmTOqj.TPOZulVLRadC::get_IsConnected() pop <null> leave.s IL_0089: call System.Boolean LZMpkjWKmTOqj.TPOZulVLRadC::get_IsConnected() call System.Boolean LZMpkjWKmTOqj.TPOZulVLRadC::get_IsConnected() brtrue.s IL_009A: newobj System.Void System.Random::.ctor() call System.Void LZMpkjWKmTOqj.TPOZulVLRadC::WFIxMELSfDVug() call System.Void LZMpkjWKmTOqj.TPOZulVLRadC::rRAMUYHBSPmZye() newobj System.Void System.Random::.ctor() ldc.i4 1000 ldc.i4 5000 callvirt System.Int32 System.Random::Next(System.Int32,System.Int32) call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0089: call System.Boolean LZMpkjWKmTOqj.TPOZulVLRadC::get_IsConnected()
Module Name	tfZbKMzYlSuBUp
Full Name	tfZbKMzYlSuBUp
EntryPoint	System.Void WIgTGtleflkg.xcCXmfJxLJZI::Main()
Scope Name	tfZbKMzYlSuBUp
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Stub
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	130
Main Method	System.Void WIgTGtleflkg.xcCXmfJxLJZI::Main()
Main IL Instruction Count	53
Main IL	ldc.i4.0 <null> stloc.0 <null> br.s IL_0012: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String WIgTGtleflkg.bXTFYqeUmBX::cpkxaPzxwInEyh call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0004: ldc.i4 1000 call System.Boolean WIgTGtleflkg.bXTFYqeUmBX::uYaCRQTXfsMPn() brtrue.s IL_002C: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean kakDoRcGIhz.zrMplhlawPHR::UUFjUvlCkcT() brtrue.s IL_003A: ldsfld System.String WIgTGtleflkg.bXTFYqeUmBX::SwtuxpThpsUL ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String WIgTGtleflkg.bXTFYqeUmBX::SwtuxpThpsUL call System.Boolean System.Convert::ToBoolean(System.String) brfalse.s IL_004B: ldsfld System.String WIgTGtleflkg.bXTFYqeUmBX::PsGwgPRJlwgFX call System.Void kakDoRcGIhz.LoNHUIteJhUoGlda::zGHRNehurIGCP() ldsfld System.String WIgTGtleflkg.bXTFYqeUmBX::PsGwgPRJlwgFX call System.Boolean System.Convert::ToBoolean(System.String) brfalse.s IL_005C: ldsfld System.String WIgTGtleflkg.bXTFYqeUmBX::xjjOrOtgVJBThd call System.Void LUoDPjHSFoIh.ObxmjFLTxGMwSEc::rTyoaSGjUCxxeX() ldsfld System.String WIgTGtleflkg.bXTFYqeUmBX::xjjOrOtgVJBThd call System.Boolean System.Convert::ToBoolean(System.String) brfalse.s IL_0074: call System.Void kakDoRcGIhz.cZpJFcILYecpr::cgsspFXRbsyG() call System.Boolean kakDoRcGIhz.cZpJFcILYecpr::TzuMwJRjyu() brfalse.s IL_0074: call System.Void kakDoRcGIhz.cZpJFcILYecpr::cgsspFXRbsyG() call System.Void kakDoRcGIhz.iUfhNHBlKeBhzd::XQbvwMyzjWbDgtV() call System.Void kakDoRcGIhz.cZpJFcILYecpr::cgsspFXRbsyG() newobj System.Void kakDoRcGIhz.zTonZyNwLU::.ctor() call System.String kakDoRcGIhz.zTonZyNwLU::nTuVwstCbUbwI() pop <null> leave.s IL_0089: call System.Boolean LZMpkjWKmTOqj.TPOZulVLRadC::get_IsConnected() pop <null> leave.s IL_0089: call System.Boolean LZMpkjWKmTOqj.TPOZulVLRadC::get_IsConnected() call System.Boolean LZMpkjWKmTOqj.TPOZulVLRadC::get_IsConnected() brtrue.s IL_009A: newobj System.Void System.Random::.ctor() call System.Void LZMpkjWKmTOqj.TPOZulVLRadC::WFIxMELSfDVug() call System.Void LZMpkjWKmTOqj.TPOZulVLRadC::rRAMUYHBSPmZye() newobj System.Void System.Random::.ctor() ldc.i4 1000 ldc.i4 5000 callvirt System.Int32 System.Random::Next(System.Int32,System.Int32) call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0089: call System.Boolean LZMpkjWKmTOqj.TPOZulVLRadC::get_IsConnected()

Key (AES_256) MUTEXmalicious

eVlKUXhuhuhuhuhuhuhuhuhuhuhu

CnC CNCmalicious

r2bhuhuhuhu

Ports PORTmalicious

4huhuhuhu

Mutex MUTEXmalicious

mkhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential