njRat PE Executable malware analysis – 4f645d513ea4

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Detection

Symbol obfuscation

Low

1 malicious · 3 files

EXE4f645d513ea410be1f3a97e8bba7c376njRat

Structure

BINResources

Config. Field	Value
Key (AES_256)	Z3Jzbmhuhuhuhuhuhuhuhuhuhuhu
Pastebin	-huhuhuhu
Certificate	MIIE5Dhuhuhuhuhuhuhuhuhuhuhu
ServerSignature	TiiXhbhuhuhuhuhuhuhuhuhuhuhu
Install	thuhuhuhu
BDOS	fhuhuhuhu
Anti-VM	fhuhuhuhu
Install File	Kubhuhuhuhu
Install-Folder	%Aphuhuhuhu
Hosts	kubet.huhuhuhuhuhuhuhuhuhuhu
Ports	80,443huhuhuhuhuhuhuhuhuhuhu
Mutex	dYpahuhuhuhu
Version	0huhuhuhu
Delay	3huhuhuhu
Group	Dehuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	Kubet.exe
Full Name	Kubet.exe
EntryPoint	System.Void Client.Program::Main()
Scope Name	Kubet.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Kubet
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	120
Main Method	System.Void Client.Program::Main()
Main IL Instruction Count	51
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0043: ldsfld System.String Client.Settings::Anti ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String Client.Settings::Install call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() ldsfld System.String Client.Settings::Install call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BDOS call System.Void Client.Install.NormalStartup::Install() ldsfld System.String Client.Settings::BDOS call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.ProcessCritical::Set() call System.Void Client.Helper.Methods::PreventSleep() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop

Key (AES_256) MUTEXmalicious

Z3Jzbmhuhuhuhuhuhuhuhuhuhuhu

CnC CNCmalicious

kubehuhuhuhu

CnC CNCmalicious

www.khuhuhuhuhuhuhu

CnC CNCmalicious

logs.huhuhuhuhuhuhu

CnC CNCmalicious

altehuhuhuhuhuhuhu

CnC CNCmalicious

www.ahuhuhuhuhuhuhu

CnC CNCmalicious

logs.ahuhuhuhuhuhuhu

Ports PORTmalicious

8huhuhuhu

Ports PORTmalicious

4huhuhuhu

Ports PORTmalicious

5huhuhuhu

Ports PORTmalicious

6huhuhuhu

Ports PORTmalicious

8huhuhuhu

Ports PORTmalicious

8huhuhuhu

Ports PORTmalicious

8huhuhuhu

Ports PORTmalicious

8huhuhuhu

Mutex MUTEXmalicious

dYpahuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential