njRat PE Executable malware analysis – 1cbbf458d5d9

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Medium

1 malicious · 3 files

EXE1cbbf458d5d9f47703d5dc404de3ec6enjRat

Structure

BINResources

Config. Field	Value
Key (AES_256)	WVlVVEhuhuhuhuhuhuhuhuhuhuhu
Pastebin	-huhuhuhu
Certificate	MIIE8jhuhuhuhuhuhuhuhuhuhuhu
ServerSignature	Vvgwy1huhuhuhuhuhuhuhuhuhuhu
Install	thuhuhuhu
BDOS	thuhuhuhu
Anti-VM	thuhuhuhu
Install File	svchuhuhuhu
Install-Folder	%Aphuhuhuhu
Hosts	127huhuhuhu
Ports	6606huhuhuhuhuhuhu
Mutex	q3wVhuhuhuhu
Version	0huhuhuhu
Delay	5huhuhuhu
Group	Dehuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	RzfARulwlFG
Full Name	RzfARulwlFG
EntryPoint	System.Void gnksijcaPoTcc.fXXYusMDJaqyRU::Main()
Scope Name	RzfARulwlFG
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	AsyncClient
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	120
Main Method	System.Void gnksijcaPoTcc.fXXYusMDJaqyRU::Main()
Main IL Instruction Count	51
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String gnksijcaPoTcc.BXGYxggPgFV::@ӣ call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean gnksijcaPoTcc.BXGYxggPgFV::@ӥ() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean szpmyTNxdkS.cnNZFPmxHnsEz::@Ӕ() brtrue IL_0043: ldsfld System.String gnksijcaPoTcc.BXGYxggPgFV::@Ӟ ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String gnksijcaPoTcc.BXGYxggPgFV::@Ӟ call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String gnksijcaPoTcc.BXGYxggPgFV::@Ӗ call System.Void @Ә::@ӓ() ldsfld System.String gnksijcaPoTcc.BXGYxggPgFV::@Ӗ call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String gnksijcaPoTcc.BXGYxggPgFV::@ӡ call System.Void @ӗ::@ӓ() ldsfld System.String gnksijcaPoTcc.BXGYxggPgFV::@ӡ call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void szpmyTNxdkS.OTjMTwxdBs::@ӗ() call System.Boolean szpmyTNxdkS.OTjMTwxdBs::@ӓ() brfalse IL_0089: call System.Void szpmyTNxdkS.OTjMTwxdBs::@ӗ() call System.Void szpmyTNxdkS.MxCmUvVgDdZ::@Ӕ() call System.Void szpmyTNxdkS.OTjMTwxdBs::@ӗ() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean yQMIGzFZgay.LkzxMuyyVKCx::@ӵ() brtrue IL_00AE: leave IL_00B9 call System.Void yQMIGzFZgay.LkzxMuyyVKCx::@ԁ() call System.Void yQMIGzFZgay.LkzxMuyyVKCx::@Ӿ() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Module Name	RzfARulwlFG
Full Name	RzfARulwlFG
EntryPoint	System.Void gnksijcaPoTcc.fXXYusMDJaqyRU::Main()
Scope Name	RzfARulwlFG
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	AsyncClient
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	120
Main Method	System.Void gnksijcaPoTcc.fXXYusMDJaqyRU::Main()
Main IL Instruction Count	51
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String gnksijcaPoTcc.BXGYxggPgFV::@ӣ call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean gnksijcaPoTcc.BXGYxggPgFV::@ӥ() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean szpmyTNxdkS.cnNZFPmxHnsEz::@Ӕ() brtrue IL_0043: ldsfld System.String gnksijcaPoTcc.BXGYxggPgFV::@Ӟ ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String gnksijcaPoTcc.BXGYxggPgFV::@Ӟ call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String gnksijcaPoTcc.BXGYxggPgFV::@Ӗ call System.Void @Ә::@ӓ() ldsfld System.String gnksijcaPoTcc.BXGYxggPgFV::@Ӗ call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String gnksijcaPoTcc.BXGYxggPgFV::@ӡ call System.Void @ӗ::@ӓ() ldsfld System.String gnksijcaPoTcc.BXGYxggPgFV::@ӡ call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void szpmyTNxdkS.OTjMTwxdBs::@ӗ() call System.Boolean szpmyTNxdkS.OTjMTwxdBs::@ӓ() brfalse IL_0089: call System.Void szpmyTNxdkS.OTjMTwxdBs::@ӗ() call System.Void szpmyTNxdkS.MxCmUvVgDdZ::@Ӕ() call System.Void szpmyTNxdkS.OTjMTwxdBs::@ӗ() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean yQMIGzFZgay.LkzxMuyyVKCx::@ӵ() brtrue IL_00AE: leave IL_00B9 call System.Void yQMIGzFZgay.LkzxMuyyVKCx::@ԁ() call System.Void yQMIGzFZgay.LkzxMuyyVKCx::@Ӿ() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop

Key (AES_256) MUTEXmalicious

WVlVVEhuhuhuhuhuhuhuhuhuhuhu

CnC CNCmalicious

127huhuhuhu

Ports PORTmalicious

6huhuhuhu

Ports PORTmalicious

7huhuhuhu

Ports PORTmalicious

8huhuhuhu

Mutex MUTEXmalicious

q3wVhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential