Deep Malware Analysis of b9b9e94e807a98caa367cf2b4b995eeb | md5: b9b9e94e807a98caa367cf2b4b995eeb | RAT | AsyncRAT | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | Win 32 Exe | x86 | PDB Path | .Net | SOS: 0.20

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Low

MD5	b9b9e94e807a98caa367cf2b4b995eeb
Sha1	ac38d4936c5bdf74c2ecdd3d6da8adc35db12b6b
Sha256	85a229fa75bcf5ef41066bb0618ade943cba3b72c377fee22bc2ff94dfaf4160
Sha384	48f1eb854460b28d206f02afe5cf7bdd52b4c307cfbb16489aa876f0588b8713bd4b369a22f0e0b2f7141bbc9a8748bc
Sha512	7413ebb58f9bd7f55d27f40a829d191e4ab74e569aae5f13d5b43d731aa265a1c000a12b628c58b51f9fda8cb2e9b70359e7dd475116f514cbc758c84b20f55b
SSDeep	384:5Tdv2D9YfxWcvHtZARPn9j/H9qbuUsMbQxnCJfJBndnjJXKyl:1dvhDt+LIbIBiBnGS
TLSH	D1C22A0833E4C671D2FD4ABA8C33D5009B75E95B9913D75A6FC890AD29237CD8A14FE4

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Config. Field	Value
Key (AES_256)	Byhuhuhuhu
Pastebin	-huhuhuhu
Install	fhuhuhuhu
Install File	Tehuhuhuhu
Install-Folder	%huhuhuhu
Version	0.huhuhuhu
Hosts	jjkhuhuhuhu
Ports	4huhuhuhu
Mutex	Aphuhuhuhu
Delay	0huhuhuhu
Group	NYhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Info	PE Detect: PeReader OK (file layout)
Info	PDB Path: C:\new\Client\obj\Debug\F8BETAPP.pdb
Module Name	F8BETAPP.exe
Full Name	F8BETAPP.exe
EntryPoint	System.Void Client.Program::Main()
Scope Name	F8BETAPP.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	F8BETAPP
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.8
Total Strings	122
Main Method	System.Void Client.Program::Main()
Main IL Instruction Count	101
Main IL	nop <null> ldc.i4.0 <null> stloc.0 <null> br.s IL_0016: ldloc.0 nop <null> ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) nop <null> nop <null> ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) clt <null> stloc.1 <null> ldloc.1 <null> brtrue.s IL_0005: nop call System.Boolean Client.Settings::InitializeSettings() ldc.i4.0 <null> ceq <null> stloc.2 <null> ldloc.2 <null> brfalse.s IL_003A: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> nop <null> nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() ldc.i4.0 <null> ceq <null> stloc.3 <null> ldloc.3 <null> brfalse.s IL_004F: ldsfld System.String Client.Settings::Anti ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> ldsfld System.String Client.Settings::Anti call System.Boolean System.Convert::ToBoolean(System.String) stloc.s V_4 ldloc.s V_4 brfalse.s IL_0065: ldsfld System.String Client.Settings::Install call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() nop <null> ldsfld System.String Client.Settings::Install call System.Boolean System.Convert::ToBoolean(System.String) stloc.s V_5 ldloc.s V_5 brfalse.s IL_007B: ldsfld System.String Client.Settings::BDOS call System.Void Client.Install.NormalStartup::Install() nop <null> ldsfld System.String Client.Settings::BDOS call System.Boolean System.Convert::ToBoolean(System.String) brfalse.s IL_008E: ldc.i4.0 call System.Boolean Client.Helper.Methods::IsAdmin() br.s IL_008F: stloc.s V_6 ldc.i4.0 <null> stloc.s V_6 ldloc.s V_6 brfalse.s IL_009B: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.ProcessCritical::Set() nop <null> call System.Void Client.Helper.Methods::PreventSleep() nop <null> nop <null> leave.s IL_00A9: br.s IL_00DD pop <null> nop <null> nop <null> leave.s IL_00A9: br.s IL_00DD br.s IL_00DD: ldc.i4.1 nop <null> nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() ldc.i4.0 <null> ceq <null> stloc.s V_7 ldloc.s V_7 brfalse.s IL_00C9: nop nop <null> call System.Void Client.Connection.ClientSocket::Reconnect() nop <null> call System.Void Client.Connection.ClientSocket::InitializeClient() nop <null> nop <null> nop <null> leave.s IL_00D1: ldc.i4 5000 pop <null> nop <null> nop <null> leave.s IL_00D1: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) nop <null> nop <null> ldc.i4.1 <null> stloc.s V_8 br.s IL_00AB: nop

Key (AES_256) MUTEXmalicious

Byhuhuhuhu

CnC CNCmalicious

jjkhuhuhuhu

Ports PORTmalicious

4huhuhuhu

Mutex MUTEXmalicious

Aphuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential