7656295a11fb1016e9eddb71cfb4f24e

PE Executable

MD5: 7656295a11fb1016e9eddb71cfb4f24e

Size: 28.16 KB

application/x-dosexec

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Low

MD5	7656295a11fb1016e9eddb71cfb4f24e
Sha1	a2001f8ccc298375a90f468b650fd6cbd788b2cb
Sha256	cdaf86deee5042744424ed5990b91db92e964ff3d139ec6bf4c07b42ca659952
Sha384	13689aa238a279183ca87362449da5e5b9f6050fb251b62587d26f38615d75f223845d2e95ba553a9a2468ba9b14f5f4
Sha512	9651e9e1c7caf52791ab747bc7bc977b0d52c873c88a4b88ded311448ac23e5bb01f07d72d901f3288dd8821519b5a47db8b287e0fb8176605bef5c681e297b9
SSDeep	384:/N3SaTSXW9bVWw7HtZARPn9jeH9qbuUszbQxnCJfJBndnjJ2Kh/+:/N3SaT5Lt+QIb3BiBn3h/+
TLSH	A1C23B0833F4C571E2FD4ABA9833D6008B75E55B9913D76A6FC890AD2E2378D8A14FD4

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Config. Field	Value
Key (AES_256)	Byhuhuhuhu
Pastebin	-huhuhuhu
Install	fhuhuhuhu
Install File	Tehuhuhuhu
Install-Folder	%huhuhuhu
Version	0.huhuhuhu
Hosts	shbehuhuhuhu
Ports	4huhuhuhu
Mutex	Aphuhuhuhu
Delay	0huhuhuhu
Group	NYhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	SHBETAPP.exe
Full Name	SHBETAPP.exe
EntryPoint	System.Void Client.Program::Main()
Scope Name	SHBETAPP.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	SHBETAPP
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.8
Info	PE Detect: PeReader OK (file layout)
Info	`PDB Path: C:\visualstudio\AsyncRAT-C-Sharp-master\AsyncRAT-C#\Client\obj\Debug\SHBETAPP.pdb`
Total Strings	122
Main Method	System.Void Client.Program::Main()
Main IL Instruction Count	101
Main IL	nop <null> ldc.i4.0 <null> stloc.0 <null> br.s IL_0016: ldloc.0 nop <null> ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) nop <null> nop <null> ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) clt <null> stloc.1 <null> ldloc.1 <null> brtrue.s IL_0005: nop call System.Boolean Client.Settings::InitializeSettings() ldc.i4.0 <null> ceq <null> stloc.2 <null> ldloc.2 <null> brfalse.s IL_003A: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> nop <null> nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() ldc.i4.0 <null> ceq <null> stloc.3 <null> ldloc.3 <null> brfalse.s IL_004F: ldsfld System.String Client.Settings::Anti ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> ldsfld System.String Client.Settings::Anti call System.Boolean System.Convert::ToBoolean(System.String) stloc.s V_4 ldloc.s V_4 brfalse.s IL_0065: ldsfld System.String Client.Settings::Install call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() nop <null> ldsfld System.String Client.Settings::Install call System.Boolean System.Convert::ToBoolean(System.String) stloc.s V_5 ldloc.s V_5 brfalse.s IL_007B: ldsfld System.String Client.Settings::BDOS call System.Void Client.Install.NormalStartup::Install() nop <null> ldsfld System.String Client.Settings::BDOS call System.Boolean System.Convert::ToBoolean(System.String) brfalse.s IL_008E: ldc.i4.0 call System.Boolean Client.Helper.Methods::IsAdmin() br.s IL_008F: stloc.s V_6 ldc.i4.0 <null> stloc.s V_6 ldloc.s V_6 brfalse.s IL_009B: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.ProcessCritical::Set() nop <null> call System.Void Client.Helper.Methods::PreventSleep() nop <null> nop <null> leave.s IL_00A9: br.s IL_00DD pop <null> nop <null> nop <null> leave.s IL_00A9: br.s IL_00DD br.s IL_00DD: ldc.i4.1 nop <null> nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() ldc.i4.0 <null> ceq <null> stloc.s V_7 ldloc.s V_7 brfalse.s IL_00C9: nop nop <null> call System.Void Client.Connection.ClientSocket::Reconnect() nop <null> call System.Void Client.Connection.ClientSocket::InitializeClient() nop <null> nop <null> nop <null> leave.s IL_00D1: ldc.i4 5000 pop <null> nop <null> nop <null> leave.s IL_00D1: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) nop <null> nop <null> ldc.i4.1 <null> stloc.s V_8 br.s IL_00AB: nop

Key (AES_256) MUTEXmalicious

Byhuhuhuhu

CnC CNCmalicious

shbehuhuhuhu

Ports PORTmalicious

4huhuhuhu

Mutex MUTEXmalicious

Aphuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

Config. Field	Value
Key (AES_256)	Byhuhuhuhu
Pastebin	-huhuhuhu
Install	fhuhuhuhu
Install File	Tehuhuhuhu
Install-Folder	%huhuhuhu
Version	0.huhuhuhu
Hosts	shbehuhuhuhu
Ports	4huhuhuhu
Mutex	Aphuhuhuhu
Delay	0huhuhuhu
Group	NYhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Key (AES_256) MUTEXmalicious

Byhuhuhuhu

7656295a11fb1016e9eddb71cfb4f24e

CnC CNCmalicious

shbehuhuhuhu

7656295a11fb1016e9eddb71cfb4f24e

Ports PORTmalicious

4huhuhuhu

7656295a11fb1016e9eddb71cfb4f24e

Mutex MUTEXmalicious

Aphuhuhuhu

7656295a11fb1016e9eddb71cfb4f24e

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

You must be signed in to view YARA rules.