Deep Malware Analysis of d9e3aad9d528c2cbcf57362306e6b5df | md5: d9e3aad9d528c2cbcf57362306e6b5df | .Net | PE (Portable Executable) | SOS: 0.81 | Executable | Managed .NET | PE File Layout | Win 32 Exe | x86 | RAT | AsyncRAT

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Very high

MD5	d9e3aad9d528c2cbcf57362306e6b5df
Sha1	c51dca474e7874c4b1056499e4df10dfec3d5afe
Sha256	0fecb72b1e5b1fc4f5a00fec90beb85b22b6ec9be8139dd4cdf448087decefd5
Sha384	0fe589cd81135ccbe3647fbdf99ae47ad01bab850a0caf3b181d2496c691e8f4eba65bb86494a34304cf1c254120b8b3
Sha512	55291d93c8960daebf6ae7165581b14c6bb57a8fa4c8b6256f8b6a222c9e23f8cb577ca5da2ce47e126f58ab603508c6e3ad5f4dbaabafee07bbc6b719e116e6
SSDeep	768:suwpFTAY3IQWUe9jqmo2qLfcVj+gyILCYOPIdepvotG0bgRmei1F7jojoMpeYx22:suwpFTA4/2EOKILCY3d5Xbgk919oHRCE
TLSH	33233C0037E9822BF27E5F78ACF22245867BF6672613D54E2CC441D75A23FC256425FA

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Config. Field	Value
Key (AES_256)	WXpzUEhuhuhuhuhuhuhuhuhuhuhu
Pastebin	-huhuhuhu
Certificate	MIIE8jhuhuhuhuhuhuhuhuhuhuhu
ServerSignature	c1/Kr5huhuhuhuhuhuhuhuhuhuhu
Install	thuhuhuhu
BDOS	thuhuhuhu
Anti-VM	thuhuhuhu
Install File	svchuhuhuhu
Install-Folder	%Aphuhuhuhu
Hosts	ae88huhuhuhu
Ports	4huhuhuhu
Mutex	T64Mhuhuhuhu
Version	0huhuhuhu
Delay	3huhuhuhu
Group	ae88huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	dKrbyKYVLYwHxl
Full Name	dKrbyKYVLYwHxl
EntryPoint	System.Void YfTcbPUipGcW.kypnWzuTZmsqOJ::Main()
Scope Name	dKrbyKYVLYwHxl
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	mko1
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	120
Main Method	System.Void YfTcbPUipGcW.kypnWzuTZmsqOJ::Main()
Main IL Instruction Count	51
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String YfTcbPUipGcW.bGQZHMXXbSbEH::kptdWFTxkWUr call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean YfTcbPUipGcW.bGQZHMXXbSbEH::pWipxAVnwZE() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean kImsWDHRWCIC.FZSpdXGzpDgT::rsQCkIRxUQKCj() brtrue IL_0043: ldsfld System.String YfTcbPUipGcW.bGQZHMXXbSbEH::KWrveVQaibxoj ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String YfTcbPUipGcW.bGQZHMXXbSbEH::KWrveVQaibxoj call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String YfTcbPUipGcW.bGQZHMXXbSbEH::axIrxTZEIxjWBbJ call System.Void kImsWDHRWCIC.lmpDkzvVYNTVJYj::QdbzPBbhXl() ldsfld System.String YfTcbPUipGcW.bGQZHMXXbSbEH::axIrxTZEIxjWBbJ call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String YfTcbPUipGcW.bGQZHMXXbSbEH::UBHXBcbryaWKJe call System.Void mQcHcTHBdmgQhH.ZKKXDCnqOH::xmVgFUZtBYA() ldsfld System.String YfTcbPUipGcW.bGQZHMXXbSbEH::UBHXBcbryaWKJe call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void kImsWDHRWCIC.MLkcHoFQzdEDuy::ElAtGywTWMNqW() call System.Boolean kImsWDHRWCIC.MLkcHoFQzdEDuy::KjLTgzyGOTS() brfalse IL_0089: call System.Void kImsWDHRWCIC.MLkcHoFQzdEDuy::ElAtGywTWMNqW() call System.Void kImsWDHRWCIC.oWABqLaMzoaQKZ::gTzHQsiZdOn() call System.Void kImsWDHRWCIC.MLkcHoFQzdEDuy::ElAtGywTWMNqW() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean prGhoMlrOZgSIO.xQoAcwHOYU::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void prGhoMlrOZgSIO.xQoAcwHOYU::iOAVCfLgZaYea() call System.Void prGhoMlrOZgSIO.xQoAcwHOYU::bCvodmHZoievb() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Info	PE Detect: PeReader OK (file layout)
Module Name	dKrbyKYVLYwHxl
Full Name	dKrbyKYVLYwHxl
EntryPoint	System.Void YfTcbPUipGcW.kypnWzuTZmsqOJ::Main()
Scope Name	dKrbyKYVLYwHxl
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	mko1
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	120
Main Method	System.Void YfTcbPUipGcW.kypnWzuTZmsqOJ::Main()
Main IL Instruction Count	51
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String YfTcbPUipGcW.bGQZHMXXbSbEH::kptdWFTxkWUr call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean YfTcbPUipGcW.bGQZHMXXbSbEH::pWipxAVnwZE() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean kImsWDHRWCIC.FZSpdXGzpDgT::rsQCkIRxUQKCj() brtrue IL_0043: ldsfld System.String YfTcbPUipGcW.bGQZHMXXbSbEH::KWrveVQaibxoj ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String YfTcbPUipGcW.bGQZHMXXbSbEH::KWrveVQaibxoj call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String YfTcbPUipGcW.bGQZHMXXbSbEH::axIrxTZEIxjWBbJ call System.Void kImsWDHRWCIC.lmpDkzvVYNTVJYj::QdbzPBbhXl() ldsfld System.String YfTcbPUipGcW.bGQZHMXXbSbEH::axIrxTZEIxjWBbJ call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String YfTcbPUipGcW.bGQZHMXXbSbEH::UBHXBcbryaWKJe call System.Void mQcHcTHBdmgQhH.ZKKXDCnqOH::xmVgFUZtBYA() ldsfld System.String YfTcbPUipGcW.bGQZHMXXbSbEH::UBHXBcbryaWKJe call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void kImsWDHRWCIC.MLkcHoFQzdEDuy::ElAtGywTWMNqW() call System.Boolean kImsWDHRWCIC.MLkcHoFQzdEDuy::KjLTgzyGOTS() brfalse IL_0089: call System.Void kImsWDHRWCIC.MLkcHoFQzdEDuy::ElAtGywTWMNqW() call System.Void kImsWDHRWCIC.oWABqLaMzoaQKZ::gTzHQsiZdOn() call System.Void kImsWDHRWCIC.MLkcHoFQzdEDuy::ElAtGywTWMNqW() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean prGhoMlrOZgSIO.xQoAcwHOYU::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void prGhoMlrOZgSIO.xQoAcwHOYU::iOAVCfLgZaYea() call System.Void prGhoMlrOZgSIO.xQoAcwHOYU::bCvodmHZoievb() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop

Key (AES_256) MUTEXmalicious

WXpzUEhuhuhuhuhuhuhuhuhuhuhu

CnC CNCmalicious

ae88huhuhuhu

Ports PORTmalicious

4huhuhuhu

Mutex MUTEXmalicious

T64Mhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential