Deep Malware Analysis of 3315f37af72ee9ecf9107199ceadb7eb | md5: 3315f37af72ee9ecf9107199ceadb7eb | RAT | njRat | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | Win 32 Exe | x86 | .Net | SOS: 0.25

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Low

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Config. Field	Value
packet_size [b]	5huhuhuhu
BD [BD]	Thuhuhuhu
directory [DR]	Aphuhuhuhu
executable_name [EXE]	SERhuhuhuhu
cnc_host [HH]	192.huhuhuhuhuhuhu
is_dir_defined [Idr]	Thuhuhuhu
is_startup_folder [IsF]	Thuhuhuhu
is_user_reg [Isu]	Thuhuhuhu
NH [NH]	0huhuhuhu
cnc_port [P]	4huhuhuhu
reg_key [RG]	494e01huhuhuhuhuhuhuhuhuhuhu
reg_path [sf]	Softwahuhuhuhuhuhuhuhuhuhuhu
sizk	2huhuhuhu
victim_name [VN]	achuhuhuhu
version [VR]	ihuhuhuhu
splitter [Y]	\|huhuhuhu
HD	Thuhuhuhu
anti [anti]	Exsahuhuhuhu
anti2 [anti2]	Fhuhuhuhu
usb [usb]	Fhuhuhuhu
usbx [usbx]	svchuhuhuhu
task [task]	Thuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	w.exe
Full Name	w.exe
EntryPoint	System.Void w.A::main()
Scope Name	w.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v2.0.50727
Tables Header Version	512
WinMD Version	<null>
Assembly Name	w
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	338
Main Method	System.Void w.A::main()
Main IL Instruction Count	5
Main IL	`nop <null> call System.Void w.OK::ko() nop <null> nop <null> ret <null>`
Module Name	w.exe
Full Name	w.exe
EntryPoint	System.Void w.A::main()
Scope Name	w.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v2.0.50727
Tables Header Version	512
WinMD Version	<null>
Assembly Name	w
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	338
Main Method	System.Void w.A::main()
Main IL Instruction Count	5
Main IL	`nop <null> call System.Void w.OK::ko() nop <null> nop <null> ret <null>`

Port PORTmalicious

4huhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential