55901c2d5489d6ac5a0671971d29a31f4cdfa2e03d56e18c1585d78547a26396

Metadata

SHA256: 55901c2d5489d6ac5a0671971d29a31f4cdfa2e03d56e18c1585d78547a26396
Difficulty: easy
Platform: Windows
Tags: .net almondrat rat string deobfuscation
Likes: 2
Views: 4
Submitter: 0xdeluks

Analysis

Goal

Deobfuscate the strings and identify the functionality of all commands.

Description

This sample is a simple .NET RAT with various functionalities. It contains little to no obfuscation, making it well suited for beginners to learn from.

Recommended Tools

dnspyex

Solutions

Solution Jot Notes (rough, will pretty-up later) by nanoamano

2
AlmondRAT Analysis Reference by 0xdeluks

Sample