Malicious
Malicious

PE Executable
MD5: 3c7fc20755929c8cde6b41da7767214f
Size: 38.91 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 3c7fc20755929c8cde6b41da7767214f
Sha1 9c66b95178c80f888f0e201352f5e03e440eb168
Sha256 61b1bf909875d0ae463f2f5351e2b5f2c969abe95150a805d73a96dcbb651379
Sha384 fcfcdcdb7f6e5b9f615cc08ad653160defe7aa5484dc7674cffa71bd418eef89670f065bd08d997fc3822dacbc3d8189
Sha512 75622f53487343c22f7bb79d04d06b731b1ab5162754766e8b8e2e33c730b0844ee131f7c8e2085725d6ffa90c82d788b7fec02153e8d42956881314298db081
SSDeep 384:X7DC9cMCcE84mr1H2bnTn8QHmp2M7739393bayse6QxnC7O+WRl3uuhGfrNP7UUq:XnCIcE8r1WbTpwFRbJpB+WWP7L/1Xj+
TLSH E7033908B7F84965F2FE5B7D8DB582004335FA579D22C79E1EC4508F5A63B88CA24FA1
3c7fc20755929c8cde6b41da7767214f
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Config. Field Value
Key (AES_256) TXlTdXhuhuhuhuhuhuhuhuhuhuhu
Pastebin -huhuhuhu
Install fhuhuhuhu
Install File Asynhuhuhuhu
Install-Folder %Cerhuhuhuhuhuhuhu
Version 0.huhuhuhu
Hosts atadrehuhuhuhuhuhuhu
Mutex Aphuhuhuhu
Delay 0huhuhuhu
Group Tehuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Info
PE Detect: PeReader OK (file layout)
Info 
PDB Path: D:\Cong Viec\malware\AsyncRAT-C-Sharp\malware chuan 3\AsyncRAT-C-Sharp-master\AsyncRAT-C#\Client\obj\Debug\PhishingRAT.pdb
Module Name
PhishingRAT.exe
Full Name
PhishingRAT.exe
EntryPoint
System.Void Client.Program::Main()
Scope Name
PhishingRAT.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
PhishingRAT
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
245
Main Method
System.Void Client.Program::Main()
Main IL Instruction Count
101
Main IL 
nop <null>
ldc.i4.0 <null>
stloc.0 <null>
br.s IL_0016: ldloc.0
nop <null>
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
nop <null>
ldloc.0 <null>
ldc.i4.1 <null>
add <null>
stloc.0 <null>
ldloc.0 <null>
ldsfld System.String Client.Settings::Delay
call System.Int32 System.Convert::ToInt32(System.String)
clt <null>
stloc.1 <null>
ldloc.1 <null>
brtrue.s IL_0005: nop
call System.Boolean Client.Settings::InitializeSettings()
ldc.i4.0 <null>
ceq <null>
stloc.2 <null>
ldloc.2 <null>
brfalse.s IL_003A: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
nop <null>
nop <null>
call System.Boolean Client.Helper.MutexControl::CreateMutex()
ldc.i4.0 <null>
ceq <null>
stloc.3 <null>
ldloc.3 <null>
brfalse.s IL_004F: ldsfld System.String Client.Settings::Anti
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
ldsfld System.String Client.Settings::Anti
call System.Boolean System.Convert::ToBoolean(System.String)
stloc.s V_4
ldloc.s V_4
brfalse.s IL_0065: ldsfld System.String Client.Settings::Install
call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis()
nop <null>
ldsfld System.String Client.Settings::Install
call System.Boolean System.Convert::ToBoolean(System.String)
stloc.s V_5
ldloc.s V_5
brfalse.s IL_007B: ldsfld System.String Client.Settings::BDOS
call System.Void Client.Install.NormalStartup::Install()
nop <null>
ldsfld System.String Client.Settings::BDOS
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_008E: ldc.i4.0
call System.Boolean Client.Helper.Methods::IsAdmin()
br.s IL_008F: stloc.s V_6
ldc.i4.0 <null>
stloc.s V_6
ldloc.s V_6
brfalse.s IL_009B: call System.Void Client.Helper.Methods::PreventSleep()
call System.Void Client.Helper.ProcessCritical::Set()
nop <null>
call System.Void Client.Helper.Methods::PreventSleep()
nop <null>
nop <null>
leave.s IL_00A9: br.s IL_00DD
pop <null>
nop <null>
nop <null>
leave.s IL_00A9: br.s IL_00DD
br.s IL_00DD: ldc.i4.1
nop <null>
nop <null>
call System.Boolean Client.Connection.ClientSocket::get_IsConnected()
ldc.i4.0 <null>
ceq <null>
stloc.s V_7
ldloc.s V_7
brfalse.s IL_00C9: nop
nop <null>
call System.Void Client.Connection.ClientSocket::Reconnect()
nop <null>
call System.Void Client.Connection.ClientSocket::InitializeClient()
nop <null>
nop <null>
nop <null>
leave.s IL_00D1: ldc.i4 5000
pop <null>
nop <null>
nop <null>
leave.s IL_00D1: ldc.i4 5000
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
nop <null>
ldc.i4.1 <null>
stloc.s V_8
br.s IL_00AB: nop
Key (AES_256) MUTEXmalicious
TXlTdXhuhuhuhuhuhuhuhuhuhuhu
CnC CNCmalicious
atadrehuhuhuhuhuhuhu
Mutex MUTEXmalicious
Aphuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
3c7fc20755929c8cde6b41da7767214f
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Config. Field Value
Key (AES_256) TXlTdXhuhuhuhuhuhuhuhuhuhuhu
Pastebin -huhuhuhu
Install fhuhuhuhu
Install File Asynhuhuhuhu
Install-Folder %Cerhuhuhuhuhuhuhu
Version 0.huhuhuhu
Hosts atadrehuhuhuhuhuhuhu
Mutex Aphuhuhuhu
Delay 0huhuhuhu
Group Tehuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Key (AES_256) MUTEXmalicious
TXlTdXhuhuhuhuhuhuhuhuhuhuhu
3c7fc20755929c8cde6b41da7767214f
CnC CNCmalicious
atadrehuhuhuhuhuhuhu
3c7fc20755929c8cde6b41da7767214f
Mutex MUTEXmalicious
Aphuhuhuhu
3c7fc20755929c8cde6b41da7767214f
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙