njRat PE Executable malware analysis – 55a471eb4b21

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Detection

Symbol obfuscation

Very high

1 malicious · 3 files

EXE55a471eb4b21151ccdaeaaff327bf4e3njRat

Structure

BINResources

Config. Field	Value
Key (AES_256)	MnkwcVhuhuhuhuhuhuhuhuhuhuhu
Ports	6606huhuhuhuhuhuhu
Hosts	127huhuhuhu
Version	0huhuhuhu
Install	fhuhuhuhu
Install-Folder	%Aphuhuhuhu
Install File	huhuhuhu
Mutex	IXgehuhuhuhu
Certificate	MIIE8jhuhuhuhuhuhuhuhuhuhuhu
ServerSignature	XbWac1huhuhuhuhuhuhuhuhuhuhu
Anti-VM	fhuhuhuhu
PasteBin	nhuhuhuhu
BDOS	fhuhuhuhu
Delay	3huhuhuhu
Group	Dehuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	PHIORPPjnXly
Full Name	PHIORPPjnXly
EntryPoint	System.Void xgrsSRzvKOt.eBmQFQiIKJbqG::Main()
Scope Name	PHIORPPjnXly
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	AsyncClient
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	120
Main Method	System.Void xgrsSRzvKOt.eBmQFQiIKJbqG::Main()
Main IL Instruction Count	51
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String xgrsSRzvKOt.XAWnXIFfVx::cTkIGYxycYxg call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean xgrsSRzvKOt.XAWnXIFfVx::PeccUeinkdWG() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean QbeYJuQtMAGNuq.JOZqHeKofZyYF::YSHUpyFyQjPuKp() brtrue IL_0043: ldsfld System.String xgrsSRzvKOt.XAWnXIFfVx::GEVjkomVmS ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String xgrsSRzvKOt.XAWnXIFfVx::GEVjkomVmS call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String xgrsSRzvKOt.XAWnXIFfVx::ZqcDJsVLssVFk call System.Void QbeYJuQtMAGNuq.WKROTXIXcyZ::OudRzDCNVoUAa() ldsfld System.String xgrsSRzvKOt.XAWnXIFfVx::ZqcDJsVLssVFk call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String xgrsSRzvKOt.XAWnXIFfVx::aDRsuaRZQSL call System.Void bQvMAzsMdgQb.utWQRZeNtz::AMJXRXXjBuSC() ldsfld System.String xgrsSRzvKOt.XAWnXIFfVx::aDRsuaRZQSL call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void QbeYJuQtMAGNuq.ODJNaFEULJbpDx::SfbFsANsyiZpu() call System.Boolean QbeYJuQtMAGNuq.ODJNaFEULJbpDx::NfdgLxGTSZkLD() brfalse IL_0089: call System.Void QbeYJuQtMAGNuq.ODJNaFEULJbpDx::SfbFsANsyiZpu() call System.Void QbeYJuQtMAGNuq.JOuRDodMVnXihx::IJKhZYZZsxJmdk() call System.Void QbeYJuQtMAGNuq.ODJNaFEULJbpDx::SfbFsANsyiZpu() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean RkSCKuwSoIPh.UGoILSHccLUnTbx::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void RkSCKuwSoIPh.UGoILSHccLUnTbx::SRfUITdWOLHFNx() call System.Void RkSCKuwSoIPh.UGoILSHccLUnTbx::jtKtZUHFyRMFM() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop

Key (AES_256) MUTEXmalicious

MnkwcVhuhuhuhuhuhuhuhuhuhuhu

Ports PORTmalicious

6huhuhuhu

Ports PORTmalicious

7huhuhuhu

Ports PORTmalicious

8huhuhuhu

CnC CNCmalicious

127huhuhuhu

Mutex MUTEXmalicious

IXgehuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential