Deep Malware Analysis of fcf5c0b9e4a6cb5b034f32a75a4396aa | md5: fcf5c0b9e4a6cb5b034f32a75a4396aa | RAT | AsyncRAT | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | Win 32 Exe | x86 | PDB Path | .Net | SOS: 0.21

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Low

MD5	fcf5c0b9e4a6cb5b034f32a75a4396aa
Sha1	e15367001747acd7677288d3ce3d123b903d6827
Sha256	8f6502f9cc4e6916a6481bf77b2e52473143f39a6fb258186edbb146e577fa65
Sha384	b654f82f4a0b60c3783d93979e3be623d62bdc39bf404f60ee2ad0692d6bf2b53e470e1c97ed536c09204b6fd3b8e176
Sha512	cec19f4a829c90848e8da016121d908f07bb2fc654606c57317a1445d48c5a3fe55b8484a4c8b1352aafe1011ef96bd518e6a2dcdd4f8e7a652d141172b42789
SSDeep	384:bNHPiWD4iXdRz2DgtyeEHjP2S3auH9qbuUsU/QxnCJfJbndnjJ/S7uq0+:bFPJcA72styneSXIb4BibnjYuq0+
TLSH	F3D24D0433E8C5B2D2FD46BED83286008775E5974953DB6A1FC990EE2A237CD8E14BD5

Config. Field	Value
Key (AES_256)	U2VjdXhuhuhuhuhuhuhuhuhuhuhu
Pastebin	-huhuhuhu
Install	fhuhuhuhu
Install File	au8huhuhuhu
Install-Folder	%huhuhuhu
Version	0.huhuhuhu
Hosts	ok9huhuhuhu
Ports	4huhuhuhu
Mutex	Aphuhuhuhu
Delay	0huhuhuhu
Group	Dhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Info	PE Detect: PeReader OK (file layout)
Info	PDB Path: C:\wow\update\obj\Debug\I9BETAPP.pdb
Module Name	I9BETAPP.exe
Full Name	I9BETAPP.exe
EntryPoint	System.Void Client.Program::Main()
Scope Name	I9BETAPP.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	I9BETAPP
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.8
Total Strings	123
Main Method	System.Void Client.Program::Main()
Main IL Instruction Count	101
Main IL	nop <null> ldc.i4.0 <null> stloc.0 <null> br.s IL_0016: ldloc.0 nop <null> ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) nop <null> nop <null> ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) clt <null> stloc.1 <null> ldloc.1 <null> brtrue.s IL_0005: nop call System.Boolean Client.Settings::InitializeSettings() ldc.i4.0 <null> ceq <null> stloc.2 <null> ldloc.2 <null> brfalse.s IL_003A: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> nop <null> nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() ldc.i4.0 <null> ceq <null> stloc.3 <null> ldloc.3 <null> brfalse.s IL_004F: ldsfld System.String Client.Settings::Anti ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> ldsfld System.String Client.Settings::Anti call System.Boolean System.Convert::ToBoolean(System.String) stloc.s V_4 ldloc.s V_4 brfalse.s IL_0065: ldsfld System.String Client.Settings::Install call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() nop <null> ldsfld System.String Client.Settings::Install call System.Boolean System.Convert::ToBoolean(System.String) stloc.s V_5 ldloc.s V_5 brfalse.s IL_007B: ldsfld System.String Client.Settings::BDOS call System.Void Client.Install.NormalStartup::Install() nop <null> ldsfld System.String Client.Settings::BDOS call System.Boolean System.Convert::ToBoolean(System.String) brfalse.s IL_008E: ldc.i4.0 call System.Boolean Client.Helper.Methods::IsAdmin() br.s IL_008F: stloc.s V_6 ldc.i4.0 <null> stloc.s V_6 ldloc.s V_6 brfalse.s IL_009B: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.ProcessCritical::Set() nop <null> call System.Void Client.Helper.Methods::PreventSleep() nop <null> nop <null> leave.s IL_00A9: br.s IL_00DD pop <null> nop <null> nop <null> leave.s IL_00A9: br.s IL_00DD br.s IL_00DD: ldc.i4.1 nop <null> nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() ldc.i4.0 <null> ceq <null> stloc.s V_7 ldloc.s V_7 brfalse.s IL_00C9: nop nop <null> call System.Void Client.Connection.ClientSocket::Reconnect() nop <null> call System.Void Client.Connection.ClientSocket::InitializeClient() nop <null> nop <null> nop <null> leave.s IL_00D1: ldc.i4 5000 pop <null> nop <null> nop <null> leave.s IL_00D1: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) nop <null> nop <null> ldc.i4.1 <null> stloc.s V_8 br.s IL_00AB: nop

Key (AES_256) MUTEXmalicious

U2VjdXhuhuhuhuhuhuhuhuhuhuhu

CnC CNCmalicious

ok9huhuhuhu

Ports PORTmalicious

4huhuhuhu

Mutex MUTEXmalicious

Aphuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential