Deep Malware Analysis of c9b8fcaa3ec2df09aade3bfa52f6a1a9 | md5: c9b8fcaa3ec2df09aade3bfa52f6a1a9 | .Net | PE (Portable Executable) | SOS: 0.80 | Executable | Managed .NET | PE File Layout | Win 32 Exe | x86 | RAT | AsyncRAT

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Very high

MD5	c9b8fcaa3ec2df09aade3bfa52f6a1a9
Sha1	aa2b324fcde776b2008ceaff2080c761535130f1
Sha256	f45ee7d02115d754375ae4bf7ad74a51a64565f41efad4b0d85444232723c5f4
Sha384	01e0e0dcb2bf8a61a0ff8684ef76cf6049f2e439a33f0a5d9ba4a2bd04a58fdde99406e86a65035e85a6eea59fd69e75
Sha512	9006ae0944140ea3bc1a8df6fb203f5df2b2caa97cd5a6eddb986ee16ac6b5f6bdf689729eda15e8f4fdd76c6114263248a455acbe7e18229eb3c25cc0cb901b
SSDeep	768:MuYHKTsufqG9vSLjWUvlPRmo2qbsOvFNEnNaIxPImqSomd0bqrZN20WrlTcSnJcK:MuYHKTsjMvSX2DOvvs+mqSom6bqzirhL
TLSH	D3231A0037E9C16BF2BE4F7869F26245857BF2637603D6492CC441975B13FC29A42AEE

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Config. Field	Value
Key (AES_256)	alJxeEhuhuhuhuhuhuhuhuhuhuhu
Pastebin	-huhuhuhu
Certificate	MIIE8jhuhuhuhuhuhuhuhuhuhuhu
ServerSignature	VhNpCjhuhuhuhuhuhuhuhuhuhuhu
Install	thuhuhuhu
BDOS	thuhuhuhu
Anti-VM	thuhuhuhu
Install File	Chromhuhuhuhuhuhuhu
Install-Folder	%Aphuhuhuhu
Hosts	ryanhuhuhuhuhuhuhu
Ports	4huhuhuhu
Mutex	II9yhuhuhuhu
Version	0huhuhuhu
Delay	3huhuhuhu
Group	ryanhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	ZpKCwPNBXuB
Full Name	ZpKCwPNBXuB
EntryPoint	System.Void ZJKVppIgjC.ynhvwlrNzMmXW::Main()
Scope Name	ZpKCwPNBXuB
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	tgryan
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	120
Main Method	System.Void ZJKVppIgjC.ynhvwlrNzMmXW::Main()
Main IL Instruction Count	51
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String ZJKVppIgjC.yiMgEjjmgHt::VyjwLYkxRQtNz call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean ZJKVppIgjC.yiMgEjjmgHt::AELIToYrRbz() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean TinVvsPLVfENuVQ.LWsROHUXNsQ::eoQOojwaLkyke() brtrue IL_0043: ldsfld System.String ZJKVppIgjC.yiMgEjjmgHt::VLrukKZwaGaAA ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String ZJKVppIgjC.yiMgEjjmgHt::VLrukKZwaGaAA call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String ZJKVppIgjC.yiMgEjjmgHt::ryrgNnlMDBgP call System.Void TinVvsPLVfENuVQ.BnyBIclvXxMHH::UUtajyDSmC() ldsfld System.String ZJKVppIgjC.yiMgEjjmgHt::ryrgNnlMDBgP call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String ZJKVppIgjC.yiMgEjjmgHt::RNZNetfOdvP call System.Void YJeegUrkidnT.yuPlBejrzSL::MJkxWSzGvsuL() ldsfld System.String ZJKVppIgjC.yiMgEjjmgHt::RNZNetfOdvP call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void TinVvsPLVfENuVQ.iolEXIKFbzYZU::rclmfgFphGxlhQ() call System.Boolean TinVvsPLVfENuVQ.iolEXIKFbzYZU::FKadqyXhuUBQ() brfalse IL_0089: call System.Void TinVvsPLVfENuVQ.iolEXIKFbzYZU::rclmfgFphGxlhQ() call System.Void TinVvsPLVfENuVQ.MheiGNihUEI::NYYiutrIhFA() call System.Void TinVvsPLVfENuVQ.iolEXIKFbzYZU::rclmfgFphGxlhQ() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean mwjGKjLGijsGG.XadIaZmyoelbVz::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void mwjGKjLGijsGG.XadIaZmyoelbVz::yVkQthECja() call System.Void mwjGKjLGijsGG.XadIaZmyoelbVz::sLazNrhrIliovKo() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Info	PE Detect: PeReader OK (file layout)
Module Name	ZpKCwPNBXuB
Full Name	ZpKCwPNBXuB
EntryPoint	System.Void ZJKVppIgjC.ynhvwlrNzMmXW::Main()
Scope Name	ZpKCwPNBXuB
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	tgryan
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	120
Main Method	System.Void ZJKVppIgjC.ynhvwlrNzMmXW::Main()
Main IL Instruction Count	51
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String ZJKVppIgjC.yiMgEjjmgHt::VyjwLYkxRQtNz call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean ZJKVppIgjC.yiMgEjjmgHt::AELIToYrRbz() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean TinVvsPLVfENuVQ.LWsROHUXNsQ::eoQOojwaLkyke() brtrue IL_0043: ldsfld System.String ZJKVppIgjC.yiMgEjjmgHt::VLrukKZwaGaAA ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String ZJKVppIgjC.yiMgEjjmgHt::VLrukKZwaGaAA call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String ZJKVppIgjC.yiMgEjjmgHt::ryrgNnlMDBgP call System.Void TinVvsPLVfENuVQ.BnyBIclvXxMHH::UUtajyDSmC() ldsfld System.String ZJKVppIgjC.yiMgEjjmgHt::ryrgNnlMDBgP call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String ZJKVppIgjC.yiMgEjjmgHt::RNZNetfOdvP call System.Void YJeegUrkidnT.yuPlBejrzSL::MJkxWSzGvsuL() ldsfld System.String ZJKVppIgjC.yiMgEjjmgHt::RNZNetfOdvP call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void TinVvsPLVfENuVQ.iolEXIKFbzYZU::rclmfgFphGxlhQ() call System.Boolean TinVvsPLVfENuVQ.iolEXIKFbzYZU::FKadqyXhuUBQ() brfalse IL_0089: call System.Void TinVvsPLVfENuVQ.iolEXIKFbzYZU::rclmfgFphGxlhQ() call System.Void TinVvsPLVfENuVQ.MheiGNihUEI::NYYiutrIhFA() call System.Void TinVvsPLVfENuVQ.iolEXIKFbzYZU::rclmfgFphGxlhQ() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean mwjGKjLGijsGG.XadIaZmyoelbVz::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void mwjGKjLGijsGG.XadIaZmyoelbVz::yVkQthECja() call System.Void mwjGKjLGijsGG.XadIaZmyoelbVz::sLazNrhrIliovKo() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop

Key (AES_256) MUTEXmalicious

alJxeEhuhuhuhuhuhuhuhuhuhuhu

CnC CNCmalicious

ryanhuhuhuhuhuhuhu

Ports PORTmalicious

4huhuhuhu

Mutex MUTEXmalicious

II9yhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential