55901c2d5489d6ac5a0671971d29a31f4cdfa2e03d56e18c1585d78547a26396

Metadata

SHA256: 55901c2d5489d6ac5a0671971d29a31f4cdfa2e03d56e18c1585d78547a26396
Difficulty: easy
Platform: Windows
Tags: .net almondrat rat string deobfuscation
Likes: 5
Views: 88
Submitter: 0xdeluks

Analysis

Goal

Deobfuscate the strings and identify the functionality of all commands.

Description

This sample is a simple .NET RAT with various functionalities. It contains little to no obfuscation, making it well suited for beginners to learn from.

Recommended Tools

dnspyex

Solutions

Analysis Report: AlmondRAT (stdrcl.exe) by hexwarden

46
Solution Jot Notes (rough, will pretty-up later) by nanoamano

62
AlmondRAT Analysis Reference by 0xdeluks

Sample