Deep Malware Analysis of eda231aeeaaa67506cc277d13e683854 | md5: eda231aeeaaa67506cc277d13e683854 | RAT | njRat | AsyncRAT | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | Win 32 Exe | x86 | .Net | SOS: 0.22

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Low

MD5	eda231aeeaaa67506cc277d13e683854
Sha1	2b092674f6b33d55c87ebc3c11d2e3b2499ceebc
Sha256	bf139e8d4cc73239afcbbac7591c0fd609d2ca358ff2c4aedf991ad08f1bbe12
Sha384	c1e25e0caeab93a3e7758cdd955c5211c6034c44c37dd9220c70dc6c04d475e783df167f684561ef3ce7b214dc1aca37
Sha512	9726b1216efc699b5083575506edbbc922f608ae2122053d73f0df7f64a32649fdab9beee70b06e67b17c5371127d3d5665a613b12da75448e1766060a031b55
SSDeep	768:so+QXMM5bJ44GnJ3DNk13wRCn1OCDyjb5gr3iId1KeOr1QMPwaClZB2tYcFmVc6K:so+QXMMR/AUVebWrSIXj61GPrBKmVcl
TLSH	5D232D1037E9812BE27E5FB859F26241867BF2733603D94A3CC811DB5B13BC696426ED

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Config. Field	Value
Key (AES_256)	ektHMmhuhuhuhuhuhuhuhuhuhuhu
Pastebin	-huhuhuhu
Certificate	MIIE8jhuhuhuhuhuhuhuhuhuhuhu
ServerSignature	oc1Ai6huhuhuhuhuhuhuhuhuhuhu
Install	thuhuhuhu
BDOS	fhuhuhuhu
Anti-VM	fhuhuhuhu
Install File	avehuhuhuhu
Install-Folder	%Aphuhuhuhu
Version	0.huhuhuhu
Hosts	ronymhuhuhuhuhuhuhu
Ports	6606huhuhuhuhuhuhu
Mutex	uffamhuhuhuhuhuhuhu
Delay	8huhuhuhu
Group	Dehuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	AsyncClient.exe
Full Name	AsyncClient.exe
EntryPoint	System.Void Client.Program::Main()
Scope Name	AsyncClient.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	AsyncClient
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	121
Main Method	System.Void Client.Program::Main()
Main IL Instruction Count	50
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0043: ldsfld System.String Client.Settings::Anti ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String Client.Settings::Install call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() ldsfld System.String Client.Settings::Install call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BDOS call System.Void Client.Install.NormalStartup::Install() ldsfld System.String Client.Settings::BDOS call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.ProcessCritical::Set() call System.Void Client.Helper.Methods::PreventSleep() leave IL_0099: call System.Boolean Client.Connection.ClientSocket::get_IsConnected() pop <null> leave IL_0099: call System.Boolean Client.Connection.ClientSocket::get_IsConnected() call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00AD: newobj System.Void System.Random::.ctor() call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() newobj System.Void System.Random::.ctor() ldc.i4 2000 ldc.i4 5000 callvirt System.Int32 System.Random::Next(System.Int32,System.Int32) call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: call System.Boolean Client.Connection.ClientSocket::get_IsConnected()
Module Name	AsyncClient.exe
Full Name	AsyncClient.exe
EntryPoint	System.Void Client.Program::Main()
Scope Name	AsyncClient.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	AsyncClient
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	121
Main Method	System.Void Client.Program::Main()
Main IL Instruction Count	50
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0043: ldsfld System.String Client.Settings::Anti ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String Client.Settings::Install call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() ldsfld System.String Client.Settings::Install call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BDOS call System.Void Client.Install.NormalStartup::Install() ldsfld System.String Client.Settings::BDOS call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.ProcessCritical::Set() call System.Void Client.Helper.Methods::PreventSleep() leave IL_0099: call System.Boolean Client.Connection.ClientSocket::get_IsConnected() pop <null> leave IL_0099: call System.Boolean Client.Connection.ClientSocket::get_IsConnected() call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00AD: newobj System.Void System.Random::.ctor() call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() newobj System.Void System.Random::.ctor() ldc.i4 2000 ldc.i4 5000 callvirt System.Int32 System.Random::Next(System.Int32,System.Int32) call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: call System.Boolean Client.Connection.ClientSocket::get_IsConnected()

Key (AES_256) MUTEXmalicious

ektHMmhuhuhuhuhuhuhuhuhuhuhu

CnC CNCmalicious

ronymhuhuhuhuhuhuhu

Ports PORTmalicious

6huhuhuhu

Ports PORTmalicious

7huhuhuhu

Ports PORTmalicious

8huhuhuhu

Mutex MUTEXmalicious

uffamhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential