Deep Malware Analysis of 902780450c82f0cfdce73134d7145842 | md5: 902780450c82f0cfdce73134d7145842 | .Net | PE (Portable Executable) | SOS: 0.82 | Executable | Managed .NET | PE File Layout | Win 32 Exe | x86 | RAT | AsyncRAT

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Very high

MD5	902780450c82f0cfdce73134d7145842
Sha1	2d7eb4db27a5486b513511d18903eb370690f0a1
Sha256	c11464f548d27189b733bfb8ecca375d91bf5550b7b51a3962554ab4e74831cb
Sha384	a3703db1f8ba73d11923f0257bbd08ae001ac889edd8a4f4213f0470117b88da5fa8726ce03ac600d3b7a428fd2c6f17
Sha512	7c3cf231b8a2c97cfc384a92379b386b3a3b72e2e0656c2bcc9e5db340cb2b899e79f7cc45b3285e168a6ed310c0326ec557ddc5e9521a6d0d28daaac293fd13
SSDeep	768:NuYHKTsufqG9vSLjWUvlPRmo2qb7e3ufBPItu5joELf0bXRCUjA/yKL1W5rV0BDU:NuYHKTsjMvSX2fUetqM88bXQu7KB8VCQ
TLSH	16233D0437E9C12BF2BE4F74A8F22146857AF2673603D64D1CD842975A23FC696426FE

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Config. Field	Value
Key (AES_256)	cVU3c0huhuhuhuhuhuhuhuhuhuhu
Pastebin	-huhuhuhu
Certificate	MIIE8jhuhuhuhuhuhuhuhuhuhuhu
ServerSignature	ZCpYDBhuhuhuhuhuhuhuhuhuhuhu
Install	thuhuhuhu
BDOS	thuhuhuhu
Anti-VM	thuhuhuhu
Install File	Chromhuhuhuhuhuhuhu
Install-Folder	%Aphuhuhuhu
Hosts	allahuhuhuhuhuhuhu
Ports	4huhuhuhu
Mutex	IxPehuhuhuhu
Version	0huhuhuhu
Delay	3huhuhuhu
Group	allahuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	OMkJvCAgCUcmGIL
Full Name	OMkJvCAgCUcmGIL
EntryPoint	System.Void LYBIiKEFCJbHiT.vOjeDmnPMOG::Main()
Scope Name	OMkJvCAgCUcmGIL
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	download1
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	120
Main Method	System.Void LYBIiKEFCJbHiT.vOjeDmnPMOG::Main()
Main IL Instruction Count	51
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String LYBIiKEFCJbHiT.CMzyyyShtyoueGF::shBfrcInPavWO call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean LYBIiKEFCJbHiT.CMzyyyShtyoueGF::pJvrnevULkRP() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean NcYDHLcfqGwgBn.wvpWrnLtWoptEE::emnArhWljF() brtrue IL_0043: ldsfld System.String LYBIiKEFCJbHiT.CMzyyyShtyoueGF::mvQHJgmkGvioFHD ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String LYBIiKEFCJbHiT.CMzyyyShtyoueGF::mvQHJgmkGvioFHD call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String LYBIiKEFCJbHiT.CMzyyyShtyoueGF::UsbQTDoddEXjXJbe call System.Void NcYDHLcfqGwgBn.DWwvjgWrXSmZR::VVjwlHdDvlC() ldsfld System.String LYBIiKEFCJbHiT.CMzyyyShtyoueGF::UsbQTDoddEXjXJbe call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String LYBIiKEFCJbHiT.CMzyyyShtyoueGF::pusxfJxLcnSY call System.Void DwpdfAjYaU.kEwYgNdqwZYp::WRYTuGmfzdSC() ldsfld System.String LYBIiKEFCJbHiT.CMzyyyShtyoueGF::pusxfJxLcnSY call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void NcYDHLcfqGwgBn.VLHhtzHymV::whEVmPoJhX() call System.Boolean NcYDHLcfqGwgBn.VLHhtzHymV::scHYvhLvDXVhfI() brfalse IL_0089: call System.Void NcYDHLcfqGwgBn.VLHhtzHymV::whEVmPoJhX() call System.Void NcYDHLcfqGwgBn.bcAYhmMegjdqyA::FzFONnmcAQkm() call System.Void NcYDHLcfqGwgBn.VLHhtzHymV::whEVmPoJhX() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean uYLABxKrkD.qTofJeRbrKEeMV::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void uYLABxKrkD.qTofJeRbrKEeMV::IOOtdhtnRnB() call System.Void uYLABxKrkD.qTofJeRbrKEeMV::DLVjTdhPeifSSbTv() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Info	PE Detect: PeReader OK (file layout)
Module Name	OMkJvCAgCUcmGIL
Full Name	OMkJvCAgCUcmGIL
EntryPoint	System.Void LYBIiKEFCJbHiT.vOjeDmnPMOG::Main()
Scope Name	OMkJvCAgCUcmGIL
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	download1
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	120
Main Method	System.Void LYBIiKEFCJbHiT.vOjeDmnPMOG::Main()
Main IL Instruction Count	51
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String LYBIiKEFCJbHiT.CMzyyyShtyoueGF::shBfrcInPavWO call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean LYBIiKEFCJbHiT.CMzyyyShtyoueGF::pJvrnevULkRP() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean NcYDHLcfqGwgBn.wvpWrnLtWoptEE::emnArhWljF() brtrue IL_0043: ldsfld System.String LYBIiKEFCJbHiT.CMzyyyShtyoueGF::mvQHJgmkGvioFHD ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String LYBIiKEFCJbHiT.CMzyyyShtyoueGF::mvQHJgmkGvioFHD call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String LYBIiKEFCJbHiT.CMzyyyShtyoueGF::UsbQTDoddEXjXJbe call System.Void NcYDHLcfqGwgBn.DWwvjgWrXSmZR::VVjwlHdDvlC() ldsfld System.String LYBIiKEFCJbHiT.CMzyyyShtyoueGF::UsbQTDoddEXjXJbe call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String LYBIiKEFCJbHiT.CMzyyyShtyoueGF::pusxfJxLcnSY call System.Void DwpdfAjYaU.kEwYgNdqwZYp::WRYTuGmfzdSC() ldsfld System.String LYBIiKEFCJbHiT.CMzyyyShtyoueGF::pusxfJxLcnSY call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void NcYDHLcfqGwgBn.VLHhtzHymV::whEVmPoJhX() call System.Boolean NcYDHLcfqGwgBn.VLHhtzHymV::scHYvhLvDXVhfI() brfalse IL_0089: call System.Void NcYDHLcfqGwgBn.VLHhtzHymV::whEVmPoJhX() call System.Void NcYDHLcfqGwgBn.bcAYhmMegjdqyA::FzFONnmcAQkm() call System.Void NcYDHLcfqGwgBn.VLHhtzHymV::whEVmPoJhX() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean uYLABxKrkD.qTofJeRbrKEeMV::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void uYLABxKrkD.qTofJeRbrKEeMV::IOOtdhtnRnB() call System.Void uYLABxKrkD.qTofJeRbrKEeMV::DLVjTdhPeifSSbTv() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop

Key (AES_256) MUTEXmalicious

cVU3c0huhuhuhuhuhuhuhuhuhuhu

CnC CNCmalicious

allahuhuhuhuhuhuhu

Ports PORTmalicious

4huhuhuhu

Mutex MUTEXmalicious

IxPehuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential