Deep Malware Analysis of 88d5f1fe1f327f66413b70317f38814d | md5: 88d5f1fe1f327f66413b70317f38814d | .Net | PE (Portable Executable) | SOS: 0.81 | Executable | Managed .NET | PE File Layout | Win 32 Exe | x86 | RAT | AsyncRAT

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Very high

MD5	88d5f1fe1f327f66413b70317f38814d
Sha1	73d90a90a0c3ae26d135c9c1021bb651b7637626
Sha256	629a33ac1e45aec4bed75114a4ef2d27f330305a1edcd77afc9301680cadfebb
Sha384	9082f2dfbecc0bea0679be27e5064fc80ddfec559a2e699ee19b8c421de90cd19c0128d7ba80ecb761723947b6869c80
Sha512	a55a8d9e761d4b294dfb483a5b715a7477cb2e11558b7f9742373af1c2989be0f7269d57604c084ffd54d1e16d93ad4b224e93a158ae5c916ec1ff5fac3ed7fb
SSDeep	1536:6tIcj73uxCXCNLAzibTBUHywdTvS6O0KmVcl:6DMCXCNLAWbTOTaIK8Y
TLSH	58233C003BE98139E2BE5F785DF52145867AF6232603D65E3CCC41D64B13BC6CA92AF6

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Config. Field	Value
Key (AES_256)	dXZtMEhuhuhuhuhuhuhuhuhuhuhu
Pastebin	-huhuhuhu
Certificate	MIIE8jhuhuhuhuhuhuhuhuhuhuhu
ServerSignature	Ny26ZChuhuhuhuhuhuhuhuhuhuhu
Install	thuhuhuhu
BDOS	fhuhuhuhu
Anti-VM	fhuhuhuhu
Install File	svchuhuhuhu
Install-Folder	%Aphuhuhuhu
Version	0.huhuhuhu
Hosts	tatohuhuhuhu
Ports	4huhuhuhu
Mutex	mkhuhuhuhu
Delay	5huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	qjgAguBDYqiRlU
Full Name	qjgAguBDYqiRlU
EntryPoint	System.Void WIgTGtleflkg.gRZWOYikphYwJhT::Main()
Scope Name	qjgAguBDYqiRlU
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Stub
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	130
Main Method	System.Void WIgTGtleflkg.gRZWOYikphYwJhT::Main()
Main IL Instruction Count	53
Main IL	ldc.i4.0 <null> stloc.0 <null> br.s IL_0012: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String WIgTGtleflkg.TbklHLhtYWsUKIv::cpkxaPzxwInEyh call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0004: ldc.i4 1000 call System.Boolean WIgTGtleflkg.TbklHLhtYWsUKIv::FUBuIzWWQbA() brtrue.s IL_002C: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean kakDoRcGIhz.UMMkMMZLwFonvZ::jajVIZTWmLRFZ() brtrue.s IL_003A: ldsfld System.String WIgTGtleflkg.TbklHLhtYWsUKIv::SwtuxpThpsUL ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String WIgTGtleflkg.TbklHLhtYWsUKIv::SwtuxpThpsUL call System.Boolean System.Convert::ToBoolean(System.String) brfalse.s IL_004B: ldsfld System.String WIgTGtleflkg.TbklHLhtYWsUKIv::PsGwgPRJlwgFX call System.Void kakDoRcGIhz.JEWkVDpTRqANfl::IDfiXVaKzEZ() ldsfld System.String WIgTGtleflkg.TbklHLhtYWsUKIv::PsGwgPRJlwgFX call System.Boolean System.Convert::ToBoolean(System.String) brfalse.s IL_005C: ldsfld System.String WIgTGtleflkg.TbklHLhtYWsUKIv::xjjOrOtgVJBThd call System.Void LUoDPjHSFoIh.BlyOsljOLKPd::GFWvZBsBjTU() ldsfld System.String WIgTGtleflkg.TbklHLhtYWsUKIv::xjjOrOtgVJBThd call System.Boolean System.Convert::ToBoolean(System.String) brfalse.s IL_0074: call System.Void kakDoRcGIhz.zFjjAgYjOrGocqQ::fLmsbHABJl() call System.Boolean kakDoRcGIhz.zFjjAgYjOrGocqQ::RZkQNwCXziqlMiRY() brfalse.s IL_0074: call System.Void kakDoRcGIhz.zFjjAgYjOrGocqQ::fLmsbHABJl() call System.Void kakDoRcGIhz.CPpXHjJGwfpcAD::eqSyYZNPME() call System.Void kakDoRcGIhz.zFjjAgYjOrGocqQ::fLmsbHABJl() newobj System.Void kakDoRcGIhz.gkcHSSZUdkiJh::.ctor() call System.String kakDoRcGIhz.gkcHSSZUdkiJh::TlfLKgRupF() pop <null> leave.s IL_0089: call System.Boolean LZMpkjWKmTOqj.huNCfHKmleUe::get_IsConnected() pop <null> leave.s IL_0089: call System.Boolean LZMpkjWKmTOqj.huNCfHKmleUe::get_IsConnected() call System.Boolean LZMpkjWKmTOqj.huNCfHKmleUe::get_IsConnected() brtrue.s IL_009A: newobj System.Void System.Random::.ctor() call System.Void LZMpkjWKmTOqj.huNCfHKmleUe::rPtDYdOqZOKB() call System.Void LZMpkjWKmTOqj.huNCfHKmleUe::BlsnBPqekbr() newobj System.Void System.Random::.ctor() ldc.i4 1000 ldc.i4 5000 callvirt System.Int32 System.Random::Next(System.Int32,System.Int32) call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0089: call System.Boolean LZMpkjWKmTOqj.huNCfHKmleUe::get_IsConnected()
Info	PE Detect: PeReader OK (file layout)
Module Name	qjgAguBDYqiRlU
Full Name	qjgAguBDYqiRlU
EntryPoint	System.Void WIgTGtleflkg.gRZWOYikphYwJhT::Main()
Scope Name	qjgAguBDYqiRlU
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Stub
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	130
Main Method	System.Void WIgTGtleflkg.gRZWOYikphYwJhT::Main()
Main IL Instruction Count	53
Main IL	ldc.i4.0 <null> stloc.0 <null> br.s IL_0012: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String WIgTGtleflkg.TbklHLhtYWsUKIv::cpkxaPzxwInEyh call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0004: ldc.i4 1000 call System.Boolean WIgTGtleflkg.TbklHLhtYWsUKIv::FUBuIzWWQbA() brtrue.s IL_002C: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean kakDoRcGIhz.UMMkMMZLwFonvZ::jajVIZTWmLRFZ() brtrue.s IL_003A: ldsfld System.String WIgTGtleflkg.TbklHLhtYWsUKIv::SwtuxpThpsUL ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String WIgTGtleflkg.TbklHLhtYWsUKIv::SwtuxpThpsUL call System.Boolean System.Convert::ToBoolean(System.String) brfalse.s IL_004B: ldsfld System.String WIgTGtleflkg.TbklHLhtYWsUKIv::PsGwgPRJlwgFX call System.Void kakDoRcGIhz.JEWkVDpTRqANfl::IDfiXVaKzEZ() ldsfld System.String WIgTGtleflkg.TbklHLhtYWsUKIv::PsGwgPRJlwgFX call System.Boolean System.Convert::ToBoolean(System.String) brfalse.s IL_005C: ldsfld System.String WIgTGtleflkg.TbklHLhtYWsUKIv::xjjOrOtgVJBThd call System.Void LUoDPjHSFoIh.BlyOsljOLKPd::GFWvZBsBjTU() ldsfld System.String WIgTGtleflkg.TbklHLhtYWsUKIv::xjjOrOtgVJBThd call System.Boolean System.Convert::ToBoolean(System.String) brfalse.s IL_0074: call System.Void kakDoRcGIhz.zFjjAgYjOrGocqQ::fLmsbHABJl() call System.Boolean kakDoRcGIhz.zFjjAgYjOrGocqQ::RZkQNwCXziqlMiRY() brfalse.s IL_0074: call System.Void kakDoRcGIhz.zFjjAgYjOrGocqQ::fLmsbHABJl() call System.Void kakDoRcGIhz.CPpXHjJGwfpcAD::eqSyYZNPME() call System.Void kakDoRcGIhz.zFjjAgYjOrGocqQ::fLmsbHABJl() newobj System.Void kakDoRcGIhz.gkcHSSZUdkiJh::.ctor() call System.String kakDoRcGIhz.gkcHSSZUdkiJh::TlfLKgRupF() pop <null> leave.s IL_0089: call System.Boolean LZMpkjWKmTOqj.huNCfHKmleUe::get_IsConnected() pop <null> leave.s IL_0089: call System.Boolean LZMpkjWKmTOqj.huNCfHKmleUe::get_IsConnected() call System.Boolean LZMpkjWKmTOqj.huNCfHKmleUe::get_IsConnected() brtrue.s IL_009A: newobj System.Void System.Random::.ctor() call System.Void LZMpkjWKmTOqj.huNCfHKmleUe::rPtDYdOqZOKB() call System.Void LZMpkjWKmTOqj.huNCfHKmleUe::BlsnBPqekbr() newobj System.Void System.Random::.ctor() ldc.i4 1000 ldc.i4 5000 callvirt System.Int32 System.Random::Next(System.Int32,System.Int32) call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0089: call System.Boolean LZMpkjWKmTOqj.huNCfHKmleUe::get_IsConnected()

Key (AES_256) MUTEXmalicious

dXZtMEhuhuhuhuhuhuhuhuhuhuhu

CnC CNCmalicious

tatohuhuhuhu

Ports PORTmalicious

4huhuhuhu

Mutex MUTEXmalicious

mkhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential