Deep Malware Analysis of f28fb8aa4c05801c7cd3ad6de3790b5c | md5: f28fb8aa4c05801c7cd3ad6de3790b5c | RAT | SnakeKeylogger | .Net | PE (Portable Executable) | Executable | Managed .NET | PE File Layout | Win 32 Exe | x86 | SOS: 0.56

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Medium

MD5	f28fb8aa4c05801c7cd3ad6de3790b5c
Sha1	16de2181c5677fc32b07d1165c3968a5428de371
Sha256	1d0f2d9db8cc9498ffed71d038690bfe52b39b3a1771bbfae0088db2d603cca0
Sha384	c029949656bc4b29fde604d9d9ff125e29fc6398e145494cb30e7205a526a3b40180a2c5d2e9fa63e78337a8f87fbb8d
Sha512	68ca8f68ff1df0e4565f467245ed055ad0c0a525046dd98e653ed81fe6e59cf033277c51a3082d6f6464180a20054397bab327d79c23d52061957fb3f5a41e47
SSDeep	3072:099yINAgKjV545jbvk5Hbe7fMuJN07TwNumqoyw787b5Nb3mWHwvcXmwgbY:PINAgKjV5Cjbvk5Hbe7fMuJN07TQN87G
TLSH	07D3074927F49804E1FF99730771A115C775B8020A67DF1D1BC2F86A2B3D6A18E0AFA3

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Path pe:exe>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Module Name	lfwhUWZlmFnGhDYPudAJ.exe
Full Name	lfwhUWZlmFnGhDYPudAJ.exe
EntryPoint	System.Void Ю̆ƌ߻�.�ɮ�ɩױ::Main()
Scope Name	lfwhUWZlmFnGhDYPudAJ.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	lfwhUWZlmFnGhDYPudAJ
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Info	PE Detect: PeReader OK (file layout)
Total Strings	1479
Main Method	System.Void Ю̆ƌ߻�.�ɮ�ɩױ::Main()
Main IL Instruction Count	160
Main IL	nop <null> call System.Void Ю̆ƌ߻�.�ɮ�ɩױ::�䇹Ŵ盀�() nop <null> call System.Void Ю̆ƌ߻�.�ɮ�ɩױ::Kި—Ųִ() nop <null> call System.Void Ю̆ƌ߻�.�ɮ�ɩױ::�ӚǎΩë() nop <null> call System.Void Ю̆ƌ߻�.�ɮ�ɩױ::ɛӛ@�Ц() nop <null> call System.Void Ю̆ƌ߻�.�ɮ�ɩױ::盀ꓞk�() nop <null> call System.Void Ю̆ƌ߻�.�ɮ�ɩױ::ĂƚҭŚΑ() nop <null> call System.Void Ю̆ƌ߻�.�ɮ�ɩױ::ִAôۣӥ() nop <null> call System.Void Ю̆ƌ߻�.�ɮ�ɩױ::᳼��̔�() nop <null> call System.Void Ю̆ƌ߻�.�ɮ�ɩױ::؝⛊ߡƚ�() nop <null> call System.Void Ю̆ƌ߻�.�ɮ�ɩױ::iٷj��() nop <null> call System.Void Ю̆ƌ߻�.�ɮ�ɩױ::콪�⛊ˤ䕃() nop <null> call System.Void Ю̆ƌ߻�.�ɮ�ɩױ::ӥ䕃؝ZҢ() nop <null> call System.Void Ю̆ƌ߻�.�ɮ�ɩױ::�ڿmɮt() nop <null> call System.Void Ю̆ƌ߻�.�ɮ�ɩױ::⥤c-׉ϱ() nop <null> call System.Void Ю̆ƌ߻�.�ɮ�ɩױ::�Ӛ֏չ콪() nop <null> call System.Void Ю̆ƌ߻�.�ɮ�ɩױ::늻ۨ⥤𗕡() nop <null> call System.Void Ю̆ƌ߻�.�ɮ�ɩױ::ӛ�ɇ2&() nop <null> call System.Void Ю̆ƌ߻�.�ɮ�ɩױ::Ŕ�Bj׉() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::ŧζ꾯У븤() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::�;�ľ() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::ˤ�ۨޗ�() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::ŎՕҟt�() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::ٷʤɩ˳Ŕ() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::⥤ӛִݶ䕃() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::皍Ӛ�Łۣ() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::מגԜ؉ܪ() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::׃꼺Jלt() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::׃�ۨ𗖵() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::��Īֵ�() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::̮Ɖ�嵱̮() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::أ—ی؜꾯() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::ǎ̳ɢ޹�() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::ۨȨӺήی() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::�Ң�ל޸() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::ִ̮̮ۚ丐() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::�ٷӤڿ�() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::̔t�ב�() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::؝ƌ󼅡ҏ() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::ֵ��꼺泮() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::��Ԝ^븤() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::ɢבۚ�鈟() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::U㠰«-콪() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::éۨՄŔ嵱() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::̳ۚڿс،() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::늻�ꓞ똛Ī() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::�ﾭ�Ɵ쐬() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::cϒ̱сc() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::ΩŲŲiӓ() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::̱O쐬tt() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::�ՄЮٵ֏() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::C�ߡ⛊œ() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::�Қۨᔖɮ() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::іC��߂() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::ôzֵ皍ﾭ() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::ՕÒҢ늻ִ() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::꾯ɮ꾯ē�() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::یƌӥĂ޻() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::�ٷ�ۚɩ() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::WK�ĪϘ() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::BŴՄߡŴ() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::ζϒ盀�뫆() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::��Ł泮�() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::̱Ò׉ƚ�() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::؉�m�&() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::�ڿ�ב̳() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::ߟ̲z̧ɛ() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::޸—ֵ꾯J() nop <null> call System.Void �ޗ،�Ɯ.ی��Ɯ؜::أۨչԹמ() nop <null> call System.Void �ޗ،�Ɯ.ی��Ɯ؜::ʪ뫆ϒӺڿ() nop <null> call System.Void �ޗ،�Ɯ.ی��Ɯ؜::��Òҡչ() nop <null> call System.Void �ޗ،�Ɯ.ی��Ɯ؜::ިܹƟܣۚ() nop <null> call System.Void �ޗ،�Ɯ.ی��Ɯ؜::ŴĂŎ̔ô() nop <null> call System.Void �ޗ،�Ɯ.ی��Ɯ؜::ֵ�W֏ɮ() nop <null> call System.Void �ޗ،�Ɯ.ی��Ɯ؜::ϒۚȨ⛊ζ() nop <null> call System.Void �ޗ،�Ɯ.ی��Ɯ؜::ܣӓ�̧ک() nop <null> call System.Void �ޗ،�Ɯ.ی��Ɯ؜::ۨ츠Օҭٚ() nop <null> call System.Void Ю̆ƌ߻�.�ɮ�ɩױ::ᔖᔖņ˳ۨ() nop <null> call System.Void Ю̆ƌ߻�.�ɮ�ɩױ::ҚсεŎ‰() nop <null> call System.Void System.Windows.Forms.Application::Run() nop <null> ret <null>
Module Name	lfwhUWZlmFnGhDYPudAJ.exe
Full Name	lfwhUWZlmFnGhDYPudAJ.exe
EntryPoint	System.Void Ю̆ƌ߻�.�ɮ�ɩױ::Main()
Scope Name	lfwhUWZlmFnGhDYPudAJ.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	lfwhUWZlmFnGhDYPudAJ
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	1479
Main Method	System.Void Ю̆ƌ߻�.�ɮ�ɩױ::Main()
Main IL Instruction Count	160
Main IL	nop <null> call System.Void Ю̆ƌ߻�.�ɮ�ɩױ::�䇹Ŵ盀�() nop <null> call System.Void Ю̆ƌ߻�.�ɮ�ɩױ::Kި—Ųִ() nop <null> call System.Void Ю̆ƌ߻�.�ɮ�ɩױ::�ӚǎΩë() nop <null> call System.Void Ю̆ƌ߻�.�ɮ�ɩױ::ɛӛ@�Ц() nop <null> call System.Void Ю̆ƌ߻�.�ɮ�ɩױ::盀ꓞk�() nop <null> call System.Void Ю̆ƌ߻�.�ɮ�ɩױ::ĂƚҭŚΑ() nop <null> call System.Void Ю̆ƌ߻�.�ɮ�ɩױ::ִAôۣӥ() nop <null> call System.Void Ю̆ƌ߻�.�ɮ�ɩױ::᳼��̔�() nop <null> call System.Void Ю̆ƌ߻�.�ɮ�ɩױ::؝⛊ߡƚ�() nop <null> call System.Void Ю̆ƌ߻�.�ɮ�ɩױ::iٷj��() nop <null> call System.Void Ю̆ƌ߻�.�ɮ�ɩױ::콪�⛊ˤ䕃() nop <null> call System.Void Ю̆ƌ߻�.�ɮ�ɩױ::ӥ䕃؝ZҢ() nop <null> call System.Void Ю̆ƌ߻�.�ɮ�ɩױ::�ڿmɮt() nop <null> call System.Void Ю̆ƌ߻�.�ɮ�ɩױ::⥤c-׉ϱ() nop <null> call System.Void Ю̆ƌ߻�.�ɮ�ɩױ::�Ӛ֏չ콪() nop <null> call System.Void Ю̆ƌ߻�.�ɮ�ɩױ::늻ۨ⥤𗕡() nop <null> call System.Void Ю̆ƌ߻�.�ɮ�ɩױ::ӛ�ɇ2&() nop <null> call System.Void Ю̆ƌ߻�.�ɮ�ɩױ::Ŕ�Bj׉() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::ŧζ꾯У븤() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::�;�ľ() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::ˤ�ۨޗ�() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::ŎՕҟt�() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::ٷʤɩ˳Ŕ() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::⥤ӛִݶ䕃() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::皍Ӛ�Łۣ() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::מגԜ؉ܪ() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::׃꼺Jלt() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::׃�ۨ𗖵() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::��Īֵ�() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::̮Ɖ�嵱̮() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::أ—ی؜꾯() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::ǎ̳ɢ޹�() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::ۨȨӺήی() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::�Ң�ל޸() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::ִ̮̮ۚ丐() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::�ٷӤڿ�() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::̔t�ב�() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::؝ƌ󼅡ҏ() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::ֵ��꼺泮() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::��Ԝ^븤() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::ɢבۚ�鈟() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::U㠰«-콪() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::éۨՄŔ嵱() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::̳ۚڿс،() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::늻�ꓞ똛Ī() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::�ﾭ�Ɵ쐬() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::cϒ̱сc() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::ΩŲŲiӓ() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::̱O쐬tt() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::�ՄЮٵ֏() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::C�ߡ⛊œ() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::�Қۨᔖɮ() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::іC��߂() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::ôzֵ皍ﾭ() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::ՕÒҢ늻ִ() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::꾯ɮ꾯ē�() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::یƌӥĂ޻() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::�ٷ�ۚɩ() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::WK�ĪϘ() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::BŴՄߡŴ() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::ζϒ盀�뫆() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::��Ł泮�() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::̱Ò׉ƚ�() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::؉�m�&() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::�ڿ�ב̳() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::ߟ̲z̧ɛ() nop <null> call System.Void �ٚ΅ֵ쐬.ҟٵߡۨZ::޸—ֵ꾯J() nop <null> call System.Void �ޗ،�Ɯ.ی��Ɯ؜::أۨչԹמ() nop <null> call System.Void �ޗ،�Ɯ.ی��Ɯ؜::ʪ뫆ϒӺڿ() nop <null> call System.Void �ޗ،�Ɯ.ی��Ɯ؜::��Òҡչ() nop <null> call System.Void �ޗ،�Ɯ.ی��Ɯ؜::ިܹƟܣۚ() nop <null> call System.Void �ޗ،�Ɯ.ی��Ɯ؜::ŴĂŎ̔ô() nop <null> call System.Void �ޗ،�Ɯ.ی��Ɯ؜::ֵ�W֏ɮ() nop <null> call System.Void �ޗ،�Ɯ.ی��Ɯ؜::ϒۚȨ⛊ζ() nop <null> call System.Void �ޗ،�Ɯ.ی��Ɯ؜::ܣӓ�̧ک() nop <null> call System.Void �ޗ،�Ɯ.ی��Ɯ؜::ۨ츠Օҭٚ() nop <null> call System.Void Ю̆ƌ߻�.�ɮ�ɩױ::ᔖᔖņ˳ۨ() nop <null> call System.Void Ю̆ƌ߻�.�ɮ�ɩױ::ҚсεŎ‰() nop <null> call System.Void System.Windows.Forms.Application::Run() nop <null> ret <null>