Deep Malware Analysis of 846e2b555e7c16d538c1e84b38bcb26a | md5: 846e2b555e7c16d538c1e84b38bcb26a | .Net | PE (Portable Executable) | SOS: 0.81 | Executable | Managed .NET | PE File Layout | Win 32 Exe | x86 | RAT | AsyncRAT

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Very high

MD5	846e2b555e7c16d538c1e84b38bcb26a
Sha1	961466f8dc90b322c4e108432b6d7bf4e4f1545e
Sha256	7d4a07190ba8677db6da293201874a923a8072a8fe3e1d2eaaede710f3fc04c6
Sha384	5e6085c65a0a3f10170474bd535382ecc8792acca88c3a41257039e552dfa75acd7651956b983c0b78caae632f95788a
Sha512	a542617b0f65d92da113819c59e843abd57cf21b318ecf32cff3b4d42c6495bc2bf5588fdc22062a56d5cae633f9647b5d070af559023a124512c2af0f842237
SSDeep	768:kozqM7wdcb64GBklNAckeKECP4uXy0bNpDC7uEsDPKA8gqoTClZM2tYcFmVc6K:kozqME+EL9bNp27uEslqoWrMKmVcl
TLSH	D9333C0437E9812AF2BD4F7868F21251827BF2677603D95A3CC851D76B13BC29642AFD

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Config. Field	Value
Key (AES_256)	NUF2bWhuhuhuhuhuhuhuhuhuhuhu
Pastebin	-huhuhuhu
Certificate	MIIE8jhuhuhuhuhuhuhuhuhuhuhu
ServerSignature	gDBO5bhuhuhuhuhuhuhuhuhuhuhu
Install	thuhuhuhu
BDOS	thuhuhuhu
Anti-VM	thuhuhuhu
Install File	mkhuhuhuhu
Install-Folder	%Aphuhuhuhu
Version	0.huhuhuhu
Hosts	knhuhuhuhu
Ports	4huhuhuhu
Mutex	fgygzhuhuhuhuhuhuhu
Delay	1huhuhuhu
Group	knhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	VfXzEvKUnZt
Full Name	VfXzEvKUnZt
EntryPoint	System.Void ViEdMbLuTl.KDAETMApNKYn::Main()
Scope Name	VfXzEvKUnZt
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	wanna
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	121
Main Method	System.Void ViEdMbLuTl.KDAETMApNKYn::Main()
Main IL Instruction Count	50
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String ViEdMbLuTl.WKqFdVSlkPEBD::zxAnIGyjoCvxQFy call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean ViEdMbLuTl.WKqFdVSlkPEBD::sYCcCArvUaEF() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean bGaKtCeCbxwo.YaqvvcSBUTZDOf::HhqibDMzROzmSP() brtrue IL_0043: ldsfld System.String ViEdMbLuTl.WKqFdVSlkPEBD::muEwEOGDuot ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String ViEdMbLuTl.WKqFdVSlkPEBD::muEwEOGDuot call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String ViEdMbLuTl.WKqFdVSlkPEBD::ccgcrbsFiNjy call System.Void bGaKtCeCbxwo.LBGWdHDguVXcGSKw::wKpiRopTQnizI() ldsfld System.String ViEdMbLuTl.WKqFdVSlkPEBD::ccgcrbsFiNjy call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String ViEdMbLuTl.WKqFdVSlkPEBD::WlDgLyfHTQG call System.Void hSnGtgXaSZNiG.wJVvXtQHMNkU::VwYkrJQOFweS() ldsfld System.String ViEdMbLuTl.WKqFdVSlkPEBD::WlDgLyfHTQG call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void bGaKtCeCbxwo.jaGXFdkYAJFK::KVaSHtUyds() call System.Boolean bGaKtCeCbxwo.jaGXFdkYAJFK::MoNqprlVSrxfm() brfalse IL_0089: call System.Void bGaKtCeCbxwo.jaGXFdkYAJFK::KVaSHtUyds() call System.Void bGaKtCeCbxwo.nUsPtZeINxt::YgCLSwkHDegMywk() call System.Void bGaKtCeCbxwo.jaGXFdkYAJFK::KVaSHtUyds() leave IL_0099: call System.Boolean OhpjYdRoDEzDJo.jEmlHlhQGS::get_IsConnected() pop <null> leave IL_0099: call System.Boolean OhpjYdRoDEzDJo.jEmlHlhQGS::get_IsConnected() call System.Boolean OhpjYdRoDEzDJo.jEmlHlhQGS::get_IsConnected() brtrue IL_00AD: newobj System.Void System.Random::.ctor() call System.Void OhpjYdRoDEzDJo.jEmlHlhQGS::fGggmFppjoFbiFv() call System.Void OhpjYdRoDEzDJo.jEmlHlhQGS::qJaNxqCLjCV() newobj System.Void System.Random::.ctor() ldc.i4 2000 ldc.i4 5000 callvirt System.Int32 System.Random::Next(System.Int32,System.Int32) call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: call System.Boolean OhpjYdRoDEzDJo.jEmlHlhQGS::get_IsConnected()
Info	PE Detect: PeReader OK (file layout)
Module Name	VfXzEvKUnZt
Full Name	VfXzEvKUnZt
EntryPoint	System.Void ViEdMbLuTl.KDAETMApNKYn::Main()
Scope Name	VfXzEvKUnZt
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	wanna
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	121
Main Method	System.Void ViEdMbLuTl.KDAETMApNKYn::Main()
Main IL Instruction Count	50
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String ViEdMbLuTl.WKqFdVSlkPEBD::zxAnIGyjoCvxQFy call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean ViEdMbLuTl.WKqFdVSlkPEBD::sYCcCArvUaEF() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean bGaKtCeCbxwo.YaqvvcSBUTZDOf::HhqibDMzROzmSP() brtrue IL_0043: ldsfld System.String ViEdMbLuTl.WKqFdVSlkPEBD::muEwEOGDuot ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String ViEdMbLuTl.WKqFdVSlkPEBD::muEwEOGDuot call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String ViEdMbLuTl.WKqFdVSlkPEBD::ccgcrbsFiNjy call System.Void bGaKtCeCbxwo.LBGWdHDguVXcGSKw::wKpiRopTQnizI() ldsfld System.String ViEdMbLuTl.WKqFdVSlkPEBD::ccgcrbsFiNjy call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String ViEdMbLuTl.WKqFdVSlkPEBD::WlDgLyfHTQG call System.Void hSnGtgXaSZNiG.wJVvXtQHMNkU::VwYkrJQOFweS() ldsfld System.String ViEdMbLuTl.WKqFdVSlkPEBD::WlDgLyfHTQG call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void bGaKtCeCbxwo.jaGXFdkYAJFK::KVaSHtUyds() call System.Boolean bGaKtCeCbxwo.jaGXFdkYAJFK::MoNqprlVSrxfm() brfalse IL_0089: call System.Void bGaKtCeCbxwo.jaGXFdkYAJFK::KVaSHtUyds() call System.Void bGaKtCeCbxwo.nUsPtZeINxt::YgCLSwkHDegMywk() call System.Void bGaKtCeCbxwo.jaGXFdkYAJFK::KVaSHtUyds() leave IL_0099: call System.Boolean OhpjYdRoDEzDJo.jEmlHlhQGS::get_IsConnected() pop <null> leave IL_0099: call System.Boolean OhpjYdRoDEzDJo.jEmlHlhQGS::get_IsConnected() call System.Boolean OhpjYdRoDEzDJo.jEmlHlhQGS::get_IsConnected() brtrue IL_00AD: newobj System.Void System.Random::.ctor() call System.Void OhpjYdRoDEzDJo.jEmlHlhQGS::fGggmFppjoFbiFv() call System.Void OhpjYdRoDEzDJo.jEmlHlhQGS::qJaNxqCLjCV() newobj System.Void System.Random::.ctor() ldc.i4 2000 ldc.i4 5000 callvirt System.Int32 System.Random::Next(System.Int32,System.Int32) call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: call System.Boolean OhpjYdRoDEzDJo.jEmlHlhQGS::get_IsConnected()

Key (AES_256) MUTEXmalicious

NUF2bWhuhuhuhuhuhuhuhuhuhuhu

CnC CNCmalicious

knhuhuhuhu

Ports PORTmalicious

4huhuhuhu

Mutex MUTEXmalicious

fgygzhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential