Deep Malware Analysis of 5e693abbc38b2d000227d73a05507890 | md5: 5e693abbc38b2d000227d73a05507890 | .Net | PE (Portable Executable) | SOS: 0.81 | Executable | Managed .NET | PE File Layout | Win 32 Exe | x86 | RAT | AsyncRAT

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Very high

MD5	5e693abbc38b2d000227d73a05507890
Sha1	06c4de86ff7940d30320ab4b1e2e0c28138b75e5
Sha256	073daa6a559f6dfba73f388a9c7451c53515c359c2a4b666fc4f46b2f2bad5f3
Sha384	a6fec9fe2578db300fb1065d1f1b5ab7436dbbbe37cc098b658db2f8c1814cfa193d625d471292d143e4dba7843261d3
Sha512	fc04cb326f768d5b5190bbf390beee58f0805a16651ab50a4437fef8cfa3fd98bd1cd753236e3902f93a86c6b5b1268c3bcb150538b808bd779207e340d44ceb
SSDeep	768:8uISdTYEXlTWU/+qhmo2qbCzEHPyQPIdhyLijb3fHctZHqmIJqruWCiYzbBDZkx:8uISdTYUN2MHOdhZb3/CKmIJjWC3dkx
TLSH	E4232A0437E8812BF2BE4FB899F26145867BF2673603D64E1CC441D75623FC29A529FA

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Config. Field	Value
Key (AES_256)	WUw2QVhuhuhuhuhuhuhuhuhuhuhu
Pastebin	-huhuhuhu
Certificate	MIIE8jhuhuhuhuhuhuhuhuhuhuhu
ServerSignature	hd2FYNhuhuhuhuhuhuhuhuhuhuhu
Install	thuhuhuhu
BDOS	thuhuhuhu
Anti-VM	thuhuhuhu
Install File	Chromhuhuhuhuhuhuhu
Install-Folder	%Aphuhuhuhu
Hosts	vsbet-huhuhuhuhuhuhu
Ports	4huhuhuhu
Mutex	6b3vhuhuhuhu
Version	0huhuhuhu
Delay	3huhuhuhu
Group	vsbet-huhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	XPOOXONCmQesw
Full Name	XPOOXONCmQesw
EntryPoint	System.Void AGtREdUfbO.lYHZUDZMYVcMmE::Main()
Scope Name	XPOOXONCmQesw
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Google
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	120
Main Method	System.Void AGtREdUfbO.lYHZUDZMYVcMmE::Main()
Main IL Instruction Count	51
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String AGtREdUfbO.kIljKMgXBN::FHcMRyCviCph call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean AGtREdUfbO.kIljKMgXBN::xmNfKhnPFscmy() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean qNFIkwDBoc.NnUGhQpiITwR::fpUtzLqVsCdKiO() brtrue IL_0043: ldsfld System.String AGtREdUfbO.kIljKMgXBN::DUxHqQtMUpxVMHGi ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String AGtREdUfbO.kIljKMgXBN::DUxHqQtMUpxVMHGi call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String AGtREdUfbO.kIljKMgXBN::bwvKovNjpoEgUOD call System.Void qNFIkwDBoc.sAbwEirIdhN::CwxDasBrcabaL() ldsfld System.String AGtREdUfbO.kIljKMgXBN::bwvKovNjpoEgUOD call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String AGtREdUfbO.kIljKMgXBN::DUbEJXMUhHy call System.Void XHGlRTaAeXN.PZgdxpARtM::rcrnxiVgEVvmGDU() ldsfld System.String AGtREdUfbO.kIljKMgXBN::DUbEJXMUhHy call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void qNFIkwDBoc.wruYxEOShIotzvW::nSXeVkkVmwEyF() call System.Boolean qNFIkwDBoc.wruYxEOShIotzvW::nMGFTwhbqfMP() brfalse IL_0089: call System.Void qNFIkwDBoc.wruYxEOShIotzvW::nSXeVkkVmwEyF() call System.Void qNFIkwDBoc.NdqlkMXZSJhmq::GcHVnJgrsa() call System.Void qNFIkwDBoc.wruYxEOShIotzvW::nSXeVkkVmwEyF() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean fOqUvHYfnCVb.FnlSaCMkkBu::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void fOqUvHYfnCVb.FnlSaCMkkBu::BosMaylVASnoLa() call System.Void fOqUvHYfnCVb.FnlSaCMkkBu::oibYlbtrwYzoe() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Info	PE Detect: PeReader OK (file layout)
Module Name	XPOOXONCmQesw
Full Name	XPOOXONCmQesw
EntryPoint	System.Void AGtREdUfbO.lYHZUDZMYVcMmE::Main()
Scope Name	XPOOXONCmQesw
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Google
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	120
Main Method	System.Void AGtREdUfbO.lYHZUDZMYVcMmE::Main()
Main IL Instruction Count	51
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String AGtREdUfbO.kIljKMgXBN::FHcMRyCviCph call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean AGtREdUfbO.kIljKMgXBN::xmNfKhnPFscmy() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean qNFIkwDBoc.NnUGhQpiITwR::fpUtzLqVsCdKiO() brtrue IL_0043: ldsfld System.String AGtREdUfbO.kIljKMgXBN::DUxHqQtMUpxVMHGi ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String AGtREdUfbO.kIljKMgXBN::DUxHqQtMUpxVMHGi call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String AGtREdUfbO.kIljKMgXBN::bwvKovNjpoEgUOD call System.Void qNFIkwDBoc.sAbwEirIdhN::CwxDasBrcabaL() ldsfld System.String AGtREdUfbO.kIljKMgXBN::bwvKovNjpoEgUOD call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String AGtREdUfbO.kIljKMgXBN::DUbEJXMUhHy call System.Void XHGlRTaAeXN.PZgdxpARtM::rcrnxiVgEVvmGDU() ldsfld System.String AGtREdUfbO.kIljKMgXBN::DUbEJXMUhHy call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void qNFIkwDBoc.wruYxEOShIotzvW::nSXeVkkVmwEyF() call System.Boolean qNFIkwDBoc.wruYxEOShIotzvW::nMGFTwhbqfMP() brfalse IL_0089: call System.Void qNFIkwDBoc.wruYxEOShIotzvW::nSXeVkkVmwEyF() call System.Void qNFIkwDBoc.NdqlkMXZSJhmq::GcHVnJgrsa() call System.Void qNFIkwDBoc.wruYxEOShIotzvW::nSXeVkkVmwEyF() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean fOqUvHYfnCVb.FnlSaCMkkBu::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void fOqUvHYfnCVb.FnlSaCMkkBu::BosMaylVASnoLa() call System.Void fOqUvHYfnCVb.FnlSaCMkkBu::oibYlbtrwYzoe() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop

Key (AES_256) MUTEXmalicious

WUw2QVhuhuhuhuhuhuhuhuhuhuhu

CnC CNCmalicious

vsbet-huhuhuhuhuhuhu

Ports PORTmalicious

4huhuhuhu

Mutex MUTEXmalicious

6b3vhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential