Deep Malware Analysis of c6fa433638c26773708cb30d81b98aef | md5: c6fa433638c26773708cb30d81b98aef | .Net | PE (Portable Executable) | SOS: 0.32 | Fody/Costura Packer | SOS: 0.20 | Executable | Managed .NET | PE File Layout | PDB Path | SOS: 0.22 | SOS: 0.24 | SOS: 0.00 | SOS: 0.21 | SOS: 0.44 | SOS: 0.31 | Win 32 Exe | x86 | SOS: 0.37 | SOS: 0.26 | SOS: 0.30 | SOS: 0.28 | SOS: 0.29 | SOS: 0.23 | SOS: 0.35 | SOS: 0.25 | SOS: 0.18 | SOS: 0.27 | SOS: 0.38 | RAT | Malicious | QuasarRat | SOS: 0.33 | SOS: 0.15 | SOS: 0.11 | SOS: 0.40

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Low

MD5	c6fa433638c26773708cb30d81b98aef
Sha1	1f45ca0c3e317b7483c031f95806d407a80faabb
Sha256	46bdc54ed6ca8f9200d5445880c687d0e3730ec8adb9b5d57f420b951aa2be68
Sha384	84f307f0894ee0f226f4ac6ce7a2632cc5030b3d625a20dd23f6020b93ca57bd38a1f2d66bb696187c82231e89b36bc1
Sha512	dc11d66c56bd41230af244e167aab25cc8d4dba793838080a5d90321af18da7410b793c190194ff6ff9bd9fc1a16df3d27f574ba2f3cb739c236e4b6d9bf63bc
SSDeep	196608:usSbk9fcCkbVN8iNIS8TkSIviB6tQJmUci4gFx:us2CkbXWkS0tQGiTb
TLSH	E26633194BD11D98EB7301399CB87041CAE5B662FD43DFEC4746220E48AABCF5A2B375

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

4 / 4

Path pe:exe>pe:dll>pe:rsrc>bin

Shape pe:exe>pe:dll>pe:rsrc>bin

malicious 4 nodes

Path pe:exe>pe:dll>bin

Shape pe:exe>pe:dll>bin

malicious 3 nodes

Config. Field	Value
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key
Version	Objehuhuhuhu
Port	Chainhuhuhuhuhuhuhu
Host	Chainhuhuhuhuhuhuhu
ReconnectDelay	Authhuhuhuhuhuhuhu
Key	Chaihuhuhuhu
SubDirectory	Keyhuhuhuhu
InstallName	Ahuhuhuhu
Install	Microshuhuhuhuhuhuhuhuhuhuhu
Startup	1huhuhuhu
Mutex	1huhuhuhu
StartupKey	-10huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	RedDolphinClient.exe
Full Name	RedDolphinClient.exe
EntryPoint	System.Void RedDolphinClient.Program::<Main>(System.String[])
Scope Name	RedDolphinClient.exe
Scope Type	ModuleDef
Kind	Console
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	RedDolphinClient
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.7.2
Total Strings	419
Main Method	System.Void RedDolphinClient.Program::<Main>(System.String[])
Main IL Instruction Count	7
Main IL	`ldarg.0 <null> call System.Threading.Tasks.Task RedDolphinClient.Program::Main(System.String[]) callvirt System.Runtime.CompilerServices.TaskAwaiter System.Threading.Tasks.Task::GetAwaiter() stloc.0 <null> ldloca.s V_0 call System.Void System.Runtime.CompilerServices.TaskAwaiter::GetResult() ret <null>`
Info	PE Detect: PeReader OK (file layout)
Info	`PDB Path: /Users/djhiphouse/RiderProjects/RedDelphin/RedDolphinClient/obj/Release/RedDolphinClient.pdb`
Module Name	RedDolphinClient.exe
Full Name	RedDolphinClient.exe
EntryPoint	System.Void RedDolphinClient.Program::<Main>(System.String[])
Scope Name	RedDolphinClient.exe
Scope Type	ModuleDef
Kind	Console
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	RedDolphinClient
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.7.2
Total Strings	419
Main Method	System.Void RedDolphinClient.Program::<Main>(System.String[])
Main IL Instruction Count	7
Main IL	`ldarg.0 <null> call System.Threading.Tasks.Task RedDolphinClient.Program::Main(System.String[]) callvirt System.Runtime.CompilerServices.TaskAwaiter System.Threading.Tasks.Task::GetAwaiter() stloc.0 <null> ldloca.s V_0 call System.Void System.Runtime.CompilerServices.TaskAwaiter::GetResult() ret <null>`

CnC CNCmalicious

Chainhuhuhuhuhuhuhu

Port PORTmalicious

Chainhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential