njRat PE Executable malware analysis – 12e3fdc59be7

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Very high

1 malicious · 6 files

EXE12e3fdc59be7f551e0f4520cf2d9e111njRat

Structure

BINResources

Config. Field	Value
Key (AES_256)	dE1VbGhuhuhuhuhuhuhuhuhuhuhu
Pastebin	-huhuhuhu
Certificate	MIIE8jhuhuhuhuhuhuhuhuhuhuhu
ServerSignature	ZmFyg4huhuhuhuhuhuhuhuhuhuhu
Install	fhuhuhuhu
BDOS	fhuhuhuhu
Anti-VM	fhuhuhuhu
Install File	pdf_huhuhuhuhuhuhu
Install-Folder	%Aphuhuhuhu
Mutex	umYrhuhuhuhu
Version	0huhuhuhu
Delay	3huhuhuhu
Group	syhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	ODeKmxbZTZ
Full Name	ODeKmxbZTZ
EntryPoint	System.Void jAyZXIPBIiaPHlebdk.JJMTTceOkT::Main()
Scope Name	ODeKmxbZTZ
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	helikopter
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	120
Main Method	System.Void jAyZXIPBIiaPHlebdk.JJMTTceOkT::Main()
Main IL Instruction Count	51
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String jAyZXIPBIiaPHlebdk.DLIThjBRhlgH::TbigIfGRxESX call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean jAyZXIPBIiaPHlebdk.DLIThjBRhlgH::lHTQumXqJK() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean CoSvbSSYnXeZTma.sLbppGqpTymvRYR::dINeKHXiZxBiV() brtrue IL_0043: ldsfld System.String jAyZXIPBIiaPHlebdk.DLIThjBRhlgH::vHzMvPOTfMzPc ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String jAyZXIPBIiaPHlebdk.DLIThjBRhlgH::vHzMvPOTfMzPc call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String jAyZXIPBIiaPHlebdk.DLIThjBRhlgH::ZsQFHezLqVJJoHSc call System.Void CoSvbSSYnXeZTma.szSEfthHNmKvyz::SYhAsuXFrjqVIb() ldsfld System.String jAyZXIPBIiaPHlebdk.DLIThjBRhlgH::ZsQFHezLqVJJoHSc call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String jAyZXIPBIiaPHlebdk.DLIThjBRhlgH::yqOrAYeTpXyssndy call System.Void WgiNlHoKgLO.zVMdEJUgdj::WaDBoeLxMTV() ldsfld System.String jAyZXIPBIiaPHlebdk.DLIThjBRhlgH::yqOrAYeTpXyssndy call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void CoSvbSSYnXeZTma.NJDZHeQybhC::TsvZkJRWOIL() call System.Boolean CoSvbSSYnXeZTma.NJDZHeQybhC::jpFxgIUpgRWA() brfalse IL_0089: call System.Void CoSvbSSYnXeZTma.NJDZHeQybhC::TsvZkJRWOIL() call System.Void CoSvbSSYnXeZTma.QgZRBjunhWyw::ZEGismBWuIGZ() call System.Void CoSvbSSYnXeZTma.NJDZHeQybhC::TsvZkJRWOIL() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean hVZBPbZDJZ.ckbNmQCwCVieaR::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void hVZBPbZDJZ.ckbNmQCwCVieaR::kaNODqPQKjNCZE() call System.Void hVZBPbZDJZ.ckbNmQCwCVieaR::vGKmwSlHfDrPZ() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Module Name	ODeKmxbZTZ
Full Name	ODeKmxbZTZ
EntryPoint	System.Void jAyZXIPBIiaPHlebdk.JJMTTceOkT::Main()
Scope Name	ODeKmxbZTZ
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	helikopter
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	120
Main Method	System.Void jAyZXIPBIiaPHlebdk.JJMTTceOkT::Main()
Main IL Instruction Count	51
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String jAyZXIPBIiaPHlebdk.DLIThjBRhlgH::TbigIfGRxESX call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean jAyZXIPBIiaPHlebdk.DLIThjBRhlgH::lHTQumXqJK() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean CoSvbSSYnXeZTma.sLbppGqpTymvRYR::dINeKHXiZxBiV() brtrue IL_0043: ldsfld System.String jAyZXIPBIiaPHlebdk.DLIThjBRhlgH::vHzMvPOTfMzPc ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String jAyZXIPBIiaPHlebdk.DLIThjBRhlgH::vHzMvPOTfMzPc call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String jAyZXIPBIiaPHlebdk.DLIThjBRhlgH::ZsQFHezLqVJJoHSc call System.Void CoSvbSSYnXeZTma.szSEfthHNmKvyz::SYhAsuXFrjqVIb() ldsfld System.String jAyZXIPBIiaPHlebdk.DLIThjBRhlgH::ZsQFHezLqVJJoHSc call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String jAyZXIPBIiaPHlebdk.DLIThjBRhlgH::yqOrAYeTpXyssndy call System.Void WgiNlHoKgLO.zVMdEJUgdj::WaDBoeLxMTV() ldsfld System.String jAyZXIPBIiaPHlebdk.DLIThjBRhlgH::yqOrAYeTpXyssndy call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void CoSvbSSYnXeZTma.NJDZHeQybhC::TsvZkJRWOIL() call System.Boolean CoSvbSSYnXeZTma.NJDZHeQybhC::jpFxgIUpgRWA() brfalse IL_0089: call System.Void CoSvbSSYnXeZTma.NJDZHeQybhC::TsvZkJRWOIL() call System.Void CoSvbSSYnXeZTma.QgZRBjunhWyw::ZEGismBWuIGZ() call System.Void CoSvbSSYnXeZTma.NJDZHeQybhC::TsvZkJRWOIL() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean hVZBPbZDJZ.ckbNmQCwCVieaR::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void hVZBPbZDJZ.ckbNmQCwCVieaR::kaNODqPQKjNCZE() call System.Void hVZBPbZDJZ.ckbNmQCwCVieaR::vGKmwSlHfDrPZ() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop

Key (AES_256) MUTEXmalicious

dE1VbGhuhuhuhuhuhuhuhuhuhuhu

Mutex MUTEXmalicious

umYrhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential